Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

Filter by
Sorted by
Tagged with
0
votes
0answers
9 views

Internal Website flagged as Dangerous site in Browser [on hold]

Our internal web application has a domain name a sample.antam.com.When I try to access a URL https://sample.antam.com/components/script.js the chrome browser is flagged site a Dangerous. You can even ...
12
votes
3answers
4k views

How to decide whether an eshop is safe or compromised

So, I am having this issue where I want to buy a specific wacom product but their online store eu-store.wacom.com and us-store.wacom.com, even though it is being accessed through https, does not ...
9
votes
3answers
302 views

Security implications of download attribute

The download attribute in an a element tells the browser to force the download of a file that otherwise would be interpreted by the browser. This is very convenient, since often users want to download ...
10
votes
5answers
5k views

Running code generated in realtime in JavaScript with eval()

Consider a front-end JavaScript application where menu items needed to be shown or hidden based on somewhat simple logic (roles that user has and some other logical state). A simple language was ...
2
votes
3answers
147 views

Why is it not possible for browsers to completely detect the Phishing pages?

The browsers have some capability to detect the phishing pages, but they are not able to detect all. Why is that? Phishing still remains to be one of the most convenient way to hacking. Why is it not ...
0
votes
0answers
33 views

Url Storage, History & Personal Data

Just Curious to Know, Where my information is being stored and how long its kept for I'm running the latest version of windows 10, my main Browser being firefox developer edition 68. I clear my ...
0
votes
0answers
107 views

Why does this user's Chrome browser send ICMP type 3 packet before accessing the webserver? [closed]

Details of this user is the following: Linux; Andriod 9; SAMSUNG SM-J400F/J400FXXU3BSDD Build/PRI.180610.011) ApplewebKit/537.36 (KHTML.like Gecko) SamsungBrowser/9.4 Chrome/67.0.3396.87 Mobile ...
2
votes
1answer
123 views

Should a browser make its own password manager? [on hold]

I'm trying to figure out if products such as Firefox's Lockwise are a superb idea or a terrible one. On the one hand, installing a third-party addon to your browser comes with inherent risks, so ...
3
votes
4answers
476 views

How come <img> calls do not violate the SOP (Same Origin Policy)?

I'm a bit confused regarding the subject of Same Origin Policy. If understand correctly. SOP's purpose is to prevent one page from obtaining access to sensitive data on another web page. So for ...
5
votes
1answer
131 views

What is the proper terminology and base CVSS score for the following cache related behaviour?

An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in ...
0
votes
5answers
299 views

How do keyloggers tell it's a password? (And how to fool them.)

This question also applies to clipboard monitoring. Imagine you are planning to deploy 100,000 copies of a Windows trojan with keylogger functionality. (For the record, I'm not talking about myself ...
37
votes
5answers
10k views

How secure are my passwords in the hands of Firefox using a Master Password?

I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
0
votes
1answer
58 views

Would cookie always change when browser changes?

I have been told that when the browser changes, the cookie will also change. If a user uses same machine, same IP, but different browser, is there any case that the cookie could stay the same? Or it'...
135
votes
4answers
70k views

Why is the same origin policy so important?

I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
0
votes
2answers
70 views

is it possible to bypass cookie protection to perform a CSRF on HUAWEI HG531 v1 router?

the AJAX login script var xhr1 = new XMLHttpRequest(); xhr1.open("post", 'https://192.168.1.1/index/login.cgi', false); xhr1.send("Username=admin&Password=...
0
votes
0answers
71 views

How do I create a secure authentication service which works both for web apps and mobile apps?

As far as I am aware the best way to securely store session data on a client is to use an HTTP-only, secure cookie + HTTPS on a browser and to store a (JWT) token in a secure place for a mobile app. ...
39
votes
5answers
32k views

Why do you need to close your browser window after logging out of a website?

I might be wrong, but I believe the request to close the browser window after logging out is common, though it's completely unclear what the risks might be of failing to close a browser window (...
1
vote
2answers
132 views

What can a 3rd party learn about a user through only CSS and images?

In its default settings, uMatrix content blocker allows CSS and images (JPG, PNG, etc) from all sources, unless denied by a site-specific block list. It also allows 1st party cookies, scripts, and ...
2
votes
1answer
74 views

Are there any security reasons for an organization to disable browser session restoration?

Does the browser setting to restore the previous session on startup pose any security concerns on a machine with separate logins for each user? Are there any security reasons for an organization to ...
105
votes
4answers
60k views

What is the website checking about my browser to protect the website from a DDoS?

Some sites I visit take me to a page that says roughly, "Checking your browser before accessing example.com. DDoS attack protection by CloudFlare". What exactly about my browser is being checked and ...
17
votes
5answers
7k views

Is using “HTTPS everywhere” extension secure?

I would like to know if one should use 'HTTPS everywhere' extension? Is it secure to use it? Are there any better alternatives? HTTPS Everywhere is a Firefox and Chrome extension that encrypts ...
0
votes
1answer
416 views

Google Chrome Linux with Activity of Unknown Device

I've recently noticed a strange comportment on my Google Chrome Browser with GMail, where suddenly appeared a connected Unknown Device, with a double connection and with the same IP than mine, looking ...
1
vote
1answer
39 views

Having web client do requests with User's 3rd party API key?

I am trying to figure out the best way to do this. I have done some searching and all I have found is about storing API keys in a back end, nothing like my use-case where there is no back end. ...
1
vote
3answers
196 views

Why do web browsers provide websites with plain text passwords? [duplicate]

Suppose I sign up for website.com with username "John" and password "Secret". Currently the webbrowser supplies website.com with my real plain text password, and we must trust them to salt and hash ...
2
votes
1answer
218 views

Opera browser: no master password?

I've recently moved from Firefox to Opera (for performance issues). I used to protect my passwords in Firefox with a Master Password. But Opera, so it appears, lacks such feature. I use Debian 9.7 ...
23
votes
2answers
2k views

How does Firefox encrypt passwords without selecting Master Password?

I know that the file logins.json contains all my encrypted passwords in Firefox browser. How does Firefox encrypt these passwords if I don't use the 'Master Password' option? Does this mean key3.db ...
0
votes
0answers
17 views

Certificate Pinning with SockJS

What is the SockJS way of pinning SSL Certificates in the client side when contacting wss:// to avoid CA trust? FYI, when using modules like HTTPS or WS, we can listen to the socket event and then on ...
0
votes
2answers
195 views

Why is 0.0.0 an associate of 0.0.0.0? [closed]

When i redirected a single webpage to an address http://0.0.0, i also found that 0.0.0 is an alias of the network address, but since it is only 3 bytes, this seems to be strange. Why would chrome and ...
0
votes
1answer
92 views

How to stop other programs from reading passwords stored in my browser?

I was very surprised and alarmed to see that a free software could list passwords stored by browser in plain text. I thought that these passwords (such as the ones for email) are encrypted and can't ...
7
votes
2answers
1k views

Workarounds for :visited CSS History reconnaissance

Several years ago it was possible to use a:visited { background: url('/log.php'); } to figure out on what website user has been previously. But now it is restricted by browsers. Is there any ...
1
vote
1answer
197 views

How can Instagram cause Chrome to attempt to login and show me my username when I'm using incognito mode?

When I reach Instagram user pages while in Incognito mode, Chrome pops up a window with my non-incognito username asking whether or not to sign in. See screenshot below. Although I assume Chrome ...
6
votes
1answer
484 views

How to make the browser redirect me to HTTPS on a specific site?

I recently learned that StackExchange sites have both HTTP and HTTPS versions, so, for instance, both http://security.stackexchange.com/ and https://security.stackexchange.com/ are accessible. By ...
-2
votes
1answer
143 views

Reason for fake academic pdf files found on sites like Google Scholar? [closed]

Using my web-browser, I clicked a link on Google Scholar that led to a fake paper (in .pdf format). The pdf contained many keywords and phrases related to the research topic, possibly for search ...
0
votes
1answer
365 views

Smart cards and the behaviour of the browser. Is the PIN cached?

When using smart cards for certificate-based authentication, is the PIN entered by the user to authenticate his smart card to the browser is cached? OR does the certificate gets cached by the browser? ...
14
votes
3answers
7k views

Do client certificates provide protection against MITM?

I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
3
votes
1answer
84 views

What mechanism does Firefox use to remember the in-session logins, after entering the Master Password?

After I have entered my Master Password, does Firefox decrypt all the logins and store them somewhere? Or does it store the Master Password itself? Is the in-session period (more) vulnerable to attack?...
0
votes
1answer
814 views

CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not

Following is a CSP policy, for example derived sample response headers. The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
63
votes
6answers
27k views

Can web sites detect whether you are using private browsing mode?

Most modern browsers support "private browsing mode" (also known in Chrome as "Incognito mode"), where the browser does not save any information to disk about your browsing while in this mode. In ...
-1
votes
1answer
74 views

How to delete browser malware? [closed]

I've got some malware so now my browser is sending requests to strange sites: Also if I click on any html element in a browser It may redirect me to unwanted pages I've tried to fix this using ...
60
votes
8answers
17k views

How can I securely develop a local webapp at a coffee shop?

When I'm developing a webapp, let's say a Django site, I run it locally and typically access it at http://localhost. I thought this was inherently secure because I assumed that localhost can only be ...
1
vote
3answers
1k views

Can a blog owner trace my IP address when I use incognito mode?

I access a blog hosted by blogspot using Incognito mode. I comment on one of the posts, by signing into my Gmail account (as the blogger does not allow Anonymous comments). If I comment by visiting ...
0
votes
0answers
26 views

Personal file separation in office workstation

Background: The company I work for is SOC2 and some other Compliant. So to comply with that regulatory compliance they asked us to install SolarWinds RMM agent in our workstations (Not production ...
0
votes
0answers
193 views

“We noticed you’re browsing in private mode.” — how do they know? [duplicate]

I sometimes get messages such as the following from newspapers' web sites (Washington Post and New York Times): We noticed you’re browsing in private mode. Private browsing is permitted exclusively ...
6
votes
4answers
5k views

Javascript - Client side encryption / key storage

I realize this is often described as a bad idea. So first of all I'll state motivation - feel free to critique this. Creating a product for an industry which tends to be overly concerned with ...
-2
votes
1answer
85 views

Inspect Element Prevention?

I was just actually wondering if there is a permanent way of preventing or disabling inspect element on client-side? Assuming with inspect element you could change values in hidden forms as well as ...
11
votes
4answers
2k views

In what way is a partially encrypted webpage insecure?

What are the potential vulnerabilities that might arise if a webpage is only partially encrypted. I can think of 2 possibilities: You can change the non-encrypted parts of the page (HTML, CSS, ...
18
votes
5answers
4k views

Why do browsers warn about mixed content for images?

I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website. However, they want to preserve the traditional forum ...
10
votes
2answers
642 views

Are there any reasons why browsers should block mixed passive content by default?

Most browsers block "active" content that's being loaded over HTTP on HTTPS pages. This includes stuff like javascript which can be modified with an MITM and compromise the security of the entire page....
4
votes
2answers
181 views

Is it possible to track/save Google searches that were never submitted?

When you start typing out a google search, it lists a bunch of options to autocomplete your search. This made me wonder how that autocomplete works. Is there a cache stored somewhere in the browser? ...
0
votes
0answers
33 views

Browser Exploiting - Using SyncManager to keep Service Workers alive forever

I just read the paper "Master of Web Puppets: Abusing Web Browsers for Persistent and Stealthy Computation". The authors claim to use the SyncManager Interface in order to keep Service Workers alive ...