Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

Filter by
Sorted by
Tagged with
-2
votes
0answers
34 views

Why is the browser from my Virtual Machine much slower than from the host? [closed]

When I try to navigate on the browser from my VM, it’s horribly slow and sometimes I get an error followed by abortion of it. In comparison, the same browser works perfectly fine and fast on my host ...
6
votes
1answer
168 views

What is the proper terminology and base CVSS score for the following cache related behaviour?

An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in ...
10
votes
3answers
5k views

How safe is opening any website on new browser tab?

When I do online shopping where I use my credit card information to purchase, I clear the browser cache, cookies and only open that single site. After I am done, I again clear the cache, cookies and ...
7
votes
3answers
517 views

Browser setups to stay safe from malware and unwanted stuff

I have to set up a browser to surf the internet. I'm trying to stay safe from malware as much as possible. (I already know that there's no way to stay 100% safe.) My idea is to use Firefox with these ...
0
votes
0answers
41 views

Allowing 3rd-party cookies in major 2020 browsers

I'm trying to get 3rd party cookies to work on major mid-year 2020 browsers [1]. It's as simple as pointing an iframe to an external URL to make a cookied request and probably get the response ...
0
votes
1answer
50 views

Tor Browser: Could a website or ISP detect modification to DOM done by users if Javascript is disabled?

I have Tor Browser (which is basically Firefox ESR) on "Safest" setting (Javascript disabled). We're generally scolded about using extensions in it, as they can alter web traffic patterns to ...
8
votes
2answers
4k views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
2
votes
1answer
107 views

Is javascript fingerprinting becoming obsolete?

Okta recently sent out an email to admins about changes to their new device detection strategy. According to them: Due to browser advancements in anonymous web browsing, JavaScript fingerprinting ...
0
votes
0answers
30 views

Different Subdomains and Certificates are given from the Same Site Button when I Use Different Internet Providers

I use shenghuo.ali... site for my transaction using my home WiFi internet connection. The Shenghuo Ali site's Confirm Button worked fine last week, it redirected me to Payment Page which is expected. ...
0
votes
2answers
171 views

How do I access a website on my phone without it being able to determine that it was accessed from the same phone and location?

How is it possible to create an account in a website with completely different credentials without the website being able to link the user of the first account and this new one? Tor is not a viable ...
37
votes
8answers
12k views

Why should browser security be prioritized?

From this answer about browser security: time to update if you really care about security So if every other software and functions I need can work on a 32-bit OS, I guess the only reason for ...
1
vote
0answers
34 views

What, if anything, are the consequences of temporarily enabling and then disabling WebRTC in Firefox?

For security and privacy purposes, it's best to keep WebRTC disabled if you aren't using it. Firefox makes this easy by simply setting media.peerconnection.enabled to false. Due to COVID-19, the use ...
0
votes
0answers
60 views

Is it secure to use services in Rambox?

Same question is asked for More secure to use e.g. Whatsapp Web in Franz than in browser? [closed]. On its answer it is said that: No, Franz is not inherently more secure than a regular browser. In ...
0
votes
2answers
124 views

Why do pop up ads automatically download .exe files?

I was using a movie streaming website, (the ones with all the pop-up ads at each click). Usually I just close the ad and nothing happens but recently when the ad pops up a .exe file is downloaded and ...
0
votes
1answer
108 views

Will there be a grace period for the CA change to mandatory 1 year?

As I can see some sites were working yesterday and today they are not working so my guess is browsers have a grace period set in them. certificate lifespans limited to 1 year in browsers. Maybe this ...
27
votes
5answers
31k views

Is it possible to easily retrieve Thunderbird's passwords with access to HDD?

I know Firefox 8 stores it's passwords in a SQLite database, which can easily be stolen with access to the HDD! What about Thunderbird 8? How does it store the passwords and how can one retieve them? ...
0
votes
0answers
13 views

Do browsers create caches of local HTML assets, such as SVGs or scripts? [migrated]

This question was asked over 7 years ago, but there wasn't a definitive answer. In the following example, does the browser know not to create a cache for these local assets? <!doctype html> <...
7
votes
2answers
200 views

Why is the use of TAB (%09) characters in the middle a 'javascript:' URL valid?

Some context: I was assinged on a pentest and found an application that let me place my own links in an a tag's href attribute. As expected, all strange values like javascript: were correctly filtered ...
0
votes
0answers
33 views

How safe is the built in browser on the iOS Facebook app?

There is no option in the iOS Facebook app to open URLs in an external browser by default (although you can open a link, and then choose to open it in Safari). How safe (mainly from a privacy ...
5
votes
5answers
57k views

Using Private Browsing mode while connected to organization's network

At the workplace I use the organization's network for accessing internet (well that's the only option). I am not sure if the network administrators monitor what I browse, how frequently I access ...
4
votes
1answer
549 views

How to brute force a Java Applet in browser?

I am solving a CTF challenge and it is multi-layered: https://net-force.nl/challenge/level314/ (Modern browsers don't support Java Applets anymore and I had to download Opera browser 9.x to run the ...
0
votes
0answers
66 views

Are web worker / service worker secure environments to store a password, credit card information, access tokens?

If there is a case where I wish to store sensitive data like a password, credit card information, or access tokens: Are web workers / service workers a secure environment, where such data can not be ...
9
votes
2answers
21k views

How can you fake geolocation in Firefox?

Google and many other sites know my correct location. How can I fake my location without using a VPN, proxy, Tor or similar? I went to about:config and looked for geo. What I think I have to modify ...
6
votes
3answers
231 views

How to distinguish malware from system crash?

Recently, I browsed to a website, which appeared to consume all the computer's resources. Although the mouse cursor continued to move, the browser (and other applications) slowed down fast and soon ...
66
votes
7answers
30k views

Can web sites detect whether you are using private browsing mode?

Most modern browsers support "private browsing mode" (also known in Chrome as "Incognito mode"), where the browser does not save any information to disk about your browsing while ...
3
votes
1answer
128 views

What mechanism does Firefox use to remember the in-session logins, after entering the Master Password?

After I have entered my Master Password, does Firefox decrypt all the logins and store them somewhere? Or does it store the Master Password itself? Is the in-session period (more) vulnerable to attack?...
1
vote
1answer
3k views

CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not

Following is a CSP policy, for example derived sample response headers. The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
9
votes
3answers
5k views

Should antivirus HTTPS scanning be left on? Is it secure?

Some antivirus software MitMs, or through other methods, HTTPS connections in order to scan for malware, for example, Avast, and maybe other vendors too. Is the method they (let's say Avast as an ...
0
votes
1answer
91 views

Why does Chrome display “Managed by Organisation”? [closed]

My wife inadvertently clicked on a flash player update and suddenly my chrome browser displays that it is being managed by an Organisation. I tried deleting chrome and reinstalling it but nothing ...
6
votes
3answers
5k views

Why do browsers disallow accessing files from local file system even if the HTML document is also on the local file system?

Many browsers do not allow you to access files on the local filesystem with JavaScript (even if the HTML document is also on the local filesystem). (source) Yes I know that the solution is to "...
7
votes
3answers
593 views

Questions on true anonymity

I am going to use Tails to connect to Tor through VPN which has AES-256 data encryption, SHA-256 data authentication and RSA-4096 handshake encryption on my Mac on my school's WiFi (as public as I can ...
0
votes
0answers
61 views

Can someone explain the 'IE No Open' X-Download-Options Header, as enforced by Helmet.js?

I've been preparing to deploy an Express server using Helmet.js for some added security. I've been reading through their docs to make sure I understand what I am doing here, and I don't understand one ...
9
votes
1answer
25k views

How to make Firefox ignore the X-XSS-Protection response header?

I have two questions: How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
1
vote
0answers
62 views

Why are DNS prefetch requests sent in clear text with DNS over HTTPS enabled?

I am trying to understand how DNS-over-HTTPS (DoH) works in both Chrome and Firefox browsers. To do so, I have enabled DoH on each browser and set the DNS provider to Cloudflare DNS servers (1.1.1.1 ...
0
votes
0answers
62 views

Clear Browser Cache of Certificates Used for Authentication

We are using cert based authentication where the client sends a cert to the server, which is validated for authentication for a web application. This all works well. The problem happens when the user ...
-1
votes
1answer
50 views

LinkedIn connection marked unsafe

From time to time my LinkedIn connection gets marked as unsafe: no green lock next to the URL. First, I believed this was a browser issue, but after I switched to another browser, the warning did not ...
0
votes
1answer
41 views

Is it possible for a website to get information about you through its upload feature?

Reddit has a new image upload feature that takes a very long time to work after you click submit-- as long as 30 seconds. It isn't caused by the upload itself; that happens very quickly. I don't know ...
19
votes
2answers
3k views

Can a malicious add-on access internet history and other sensitive info in Chrome/Firefox?

How does Chrome/Firefox make sure add-ons are safe? Do they have any protection against a malicious add-on? How much access can add-ons have? Can they access internet history or maybe even cookies ...
2
votes
1answer
45 views

Is possible to implement a Web Cryptography API custom provider?

I'm reading some basic info about Web Cryptography API and I'm wondering if is possible to implement some crypto provider (C/C++ library or something) with some extra algorithms or is mandatory to use ...
1
vote
1answer
68 views

Which approach is technically more effective to hinder user tracking - fingerprint generalization or randomization?

Tor's approach to countering fingerprinting is to make as many users "appear the same" as possible. Let us call this "generalization". While Brave tries to randomize all fingerprints of each and every ...
6
votes
1answer
3k views

LastPass installer scary message about sideloading

I've been using LastPass for years, generally through the original Chrome extension. In recent months, certain features of the extension have been totally broken, such as the ability to share ...
6
votes
2answers
2k views

Why/how does Firefox bypass my employer's SSL decryption?

My employer has set up what they're calling "SSL decryption" for Internet access from within the company. I believe this is provided by an f5 device. They have installed a trusted root certificate on ...
0
votes
0answers
37 views

Restricting website usage for Google Maps API doesn't prevent it from being used in the browser?

Say I've restricted my Google Maps API key to the website example.com/*. This would mean that no other website domains could use my API key to make requests to maps.googleapis.com. However, using the ...
2
votes
1answer
9k views

Cross Domain Javascript security [duplicate]

I used a web vulnerability scanner to scan my web site. It indicates several links with "Cross domain Java script source file inclusion." May I know how would an attacker exploit this type of ...
0
votes
0answers
39 views

Taking advantage of subdomains for refresh token rotation in SPAs

Say I have three components in a system: An identity service, hosted at identity.mydomain.com A single page application, served from app.mydomain.com An API, protected by requiring a bearer token ...
10
votes
3answers
246 views

Risks of Long-life Session

Most "big" websites seem to have enormous sessions. From looking through the cookies, Stack Exchange seems to have a one-week rolling session, GitHub has 45 days, and Gmail seems to have a never-...
0
votes
1answer
47 views

Credential theft by browser conferencing software?

While using the webex conference software, I noticed that simply pressing a "share content" button allows me to share my full screen. There was no security confirmation from my webbrowser (chrome): I ...
0
votes
0answers
107 views

Chrome extension differences: Urban Shield VS Urban Free VPN proxy Unblocker

What's the difference between these two Chrome extensions, which provide VPN functionality for browsing via Chrome: Urban Shield: https://chrome.google.com/webstore/detail/urban-shield/...
1
vote
1answer
38 views

Why did browser authors not make 127.0.0.1/localhost-hosted webpages skip the referrer?

For a long time, I was so convinced that 127.0.0.1/localhost-hosted webpages, that is, with URLs such as: http://127.0.0.1/MySecretControlPanel/sensitive.php?stuff=goes&here=dude ... did not ...
2
votes
2answers
7k views

Can I spoof my user agent so that the type of device I'm using doesn't show up?

I was looking into spoofing a user agent, but all that has come up so far is spoofing the browser type. However, I can still see what kind of device I am using (tbh I'm not really even sure why ...

1
2 3 4 5
29