Questions tagged [web-browser]
A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.
1,646
questions
0
votes
1
answer
36
views
Can you retrieve messages from instagram or messenger off of a SIM card?
Can you retrieve personal information ie; messages from browsers, off of a SIM card?
0
votes
0
answers
25
views
When using a VPN is the device DNS cache still written to? [duplicate]
When I am using ProtonVPN, does the VPN server run DNS resolution upon receiving the request, similar to a Tor exit node, thereby bypassing the device's DNS cache?
Or do my browser's DNS queries still ...
- 101
0
votes
0
answers
67
views
Are 2FA browser plugins sufficiently secure?
Regarding 2FA browser plugins, I follow the uneducated opinion that they usually provide sufficient security. Since a desktop computer is a unique device (even a virtual machine) and provides that ...
- 101
1
vote
1
answer
89
views
Does not storing passwords in browser really matter given cookie hijacking exists?
I see lots of articles suggesting not storing passwords in the browser, and it made perfect sense to me, if I can access this data easily, an attacker probably can too.
But then I found out about ...
2
votes
1
answer
338
views
In the modern context, what max harm can a webpage do, if the creator is malignant? [duplicate]
Note: this does not answer my question as it mentions Java/Flash(not in the modern context. The question is from like 10 years ago so probably outdated), and mentions weakness introduced by the user(...
- 131
0
votes
0
answers
28
views
Methods to look for when checking if a javascript program is making network requests
I'm trying to quickly audit a js browser extension to see if it doesn't talk to the outside. Am I right in thinking that I can just grep the code for the following:
XMLHttpRequest
fetch
$.ajax
axios....
- 101
0
votes
0
answers
40
views
Which system variables are exposed from browser JavaScript context?
I know that the TZ variable aka TimeZone can be read by servers, especially with fingerprinting.
What are the exposed variables to browser's ?
- 101
1
vote
1
answer
124
views
How safe it is to view PDF file in browser without downloading the file into PC?
When I view the PDF file in a browser such as FireFox without downloading the file into my PC, does FireFox temporarily store the PDF file in my PC?
I heard that FireFox has been sandbox heavily and ...
- 11
1
vote
0
answers
55
views
Does the browser pass the name of the camera being used to the website [closed]
Does the browser pass the name of the camera being used to the website which is accessing our camera like when we use obs virtual cam so is the website able to detect that a virtual camera is being ...
- 11
0
votes
1
answer
48
views
How vulnerable is Opera using a version of Chromium that is 3 versions behind?
Uses Chromium 115 when current stable is 118. They do claim to have the latest chromium security updates.
Does patching old chromium with the latest security fixes bring it on par with the latest ...
1
vote
1
answer
127
views
Since yt-dlp simulates a browser, can it be fingerprinted in the same ways (e.g. canvas and audiocontext)?
I know that wget and curl can mitigate fingerprinting (aside from http header and user agent), but will yt-dlp give away more data?
- 11
0
votes
1
answer
35
views
How to properly migrate authentication cookies to using a new encryption scheme on a website while being backwards compatible?
When a user logs in with their email/password combo and gets authenticated to our website, the backend sends the web browser an encrypted cookie based off of their memberId with us. While this ...
- 295
0
votes
2
answers
132
views
Why do we use Session ID cookies on the web instead of a unique device identifier?
Session IDs aren't exactly secure, you can copy them from one device to another just by copying the browser's temp files. Techniques to tell apart one device from another have existed in browsers for ...
- 1
18
votes
2
answers
6k
views
How is Xiaomi changing my browser home page?
I have recently observed that the home page of Google Chrome on my Xiaomi Android phone has been altered to a website called "Mintnav". I did not update any software. How is Xiaomi able to ...
- 197
0
votes
0
answers
71
views
CSP script-scr blob
What are the risks to allow a "blob:" directive to the script-src CSP? Is it safe?
I have a list of allowed domains defined in script-src, but nonetheless I got an error specifying the ...
0
votes
0
answers
44
views
What can be leaked using a browser extension where one of the extensions loads JavaScript from a remote site?
Can one remotely log my IP, browser history, and saved passwords?
I think the IP should be easily done if one of the extensions load a remote JavaScript to run in my browser. I'm not sure about other ...
- 127
1
vote
1
answer
117
views
Do CSRF Tokens need to be tied to user IDs?
I am implementing a web system using Golang and have incorporated gorilla/csrf for CSRF protection. However, I've encountered an issue. When I have tab1 open in my browser, logged in as user1, and ...
- 11
0
votes
0
answers
94
views
CryptoKey with IndexedDB to secure stateless authentication
Stateless authentication using e.g. JWT can be dangerous as they are non revocable and can leak giving full access. But they are really flexible.
I'm considering scenario where issued JWT is binded to ...
- 309
0
votes
0
answers
62
views
Is there a way to prevent/detect DOM Clobbering in the browser?
It is possible to clobber document attributes, e.g.:
<img name="cookie">
...
typeof(document.cookie)
//=> 'object'
Is there any way to prevent this from happening, access the ...
- 1
0
votes
0
answers
52
views
Recovering Lost Brave Browser Usernames and Passwords
I recently changed my password for my local Windows 10 account and found out that my usernames/passwords in Brave's password manager are no longer visible.
Unfortunately, I executed Brave after the ...
- 1
1
vote
1
answer
149
views
Can a browser-based HTTPS proxy secure browsing data while using a system-level proxy?
I use Nekoray to set up proxies for my Windows system.
When I connect to those proxies, does using a browser-based proxy with HTTPS encryption secure my transferred data through the web browser?
Can ...
- 113
0
votes
0
answers
48
views
Are there any html Sanitizer() API configs that allow javascript execution?
I'm talking specifically about the HTML Sanitizer API: https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API
The API allows you to configure the sanitizer with a list of allowed elements ...
- 101
2
votes
1
answer
115
views
Distinguish origin of password prompts
I am wondering how to distinguish (password) prompts that the OS issued from prompts that are delivered application-side. This question first occurred to me when considering Firefox master passwords, ...
- 21
1
vote
1
answer
382
views
Are CORS headers useless?
It is common to say that CORS headers protect against CSRF, so that if you visit a malicious website, it cannot make a request to your web application because the referer header (the URL of the ...
2
votes
1
answer
1k
views
What is the current (April 2023) browser support for Ed25519 certificate signatures?
It seems that Firefox and Chrome both support x25519 keys, but they do not accept keys signed using Ed25519. Am I correct?
If so, where can I find the official source of this information?
- 23
2
votes
2
answers
462
views
XSS in a href with target=_blank
I have found out that in most browsers the following code won't execute:
<a href="javascript:alert(1)" target=_blank>click</a>
But the same code without blank will.
My question ...
1
vote
2
answers
232
views
How securely is data deleted with IndexedDB?
I'd like to understand how securely is data deleted when we request for its deletion using .clear(). I suspect it being weak. Is there a method available from the browser API (would write/delete junk ...
- 113
0
votes
1
answer
117
views
How to safely share data between 2 SPAs?
Let's say I have 2 SPAs (single page applications), SPA A and SPA B.
I want to share data between the 2 applications for an end-to-end flow.
How can I safely share data such that it would not be ...
- 113
0
votes
1
answer
165
views
How to reliably identify referrer on client browser?
Is there any way to reliably identify the referring site on modern browsers (not considering manual HTTP requests outside of a browser e.g. cURL, etc.)?
Referrer header will not work because the ...
- 113
7
votes
3
answers
3k
views
ESTABLISHED TCP connections after opening browser in linux
I am using netstat -acp | grep ESTABLISHED command to check established connection
between with my system.
$ sudo netstat -acp | grep ESTABLISHED
tcp 0 0 rg-Vostro-3546:51874 server-18-...
- 187
1
vote
1
answer
91
views
Ways to safeguard Internet users from fraudulent websites
Extended Validation SSL certificates have been effectively abandoned, as web browsers do not even show them as something special, so my question is: how would you go about safeguarding the user from ...
- 2,552
2
votes
1
answer
178
views
Is it dangerous to publicly surf the web while my browser is being run in an IDE?
While developing web software, I typically run a browser (chrome) from my IDE. Here's an example launch.json in VSCode:
{
// Use IntelliSense to learn about possible attributes.
// Hover to ...
- 888
3
votes
1
answer
2k
views
Is there any secure way to make sure that a request comes from a browser and via a specific domain (by just using frontend)?
Let us assume that we have a public API, for example, company.com/publicEndpoint, that can accept requests from any source. Various websites, like foo.com and bar.com, use JavaScripts that call this ...
- 31
0
votes
0
answers
76
views
Can WebASM provide JavaScript style interactivity without the same vulnerabilities?
JavaScript is useful for interactivity. However, it is often disabled by security conscious browsers, such as the Tor Browser Bundle, and blocked with plugins such as NoScript.
I was wondering if it ...
- 715
1
vote
0
answers
188
views
Is it safe to enable password sync on Microsoft Edge?
Microsoft Edge, as well as other Chromium browsers, have a password sync feature built into their browsers, which look something like the image below.
Before I enable this feature for convenience and ...
- 111
0
votes
1
answer
273
views
HTTPS/TLS security with an invalid certificate
I'm trying to use a site that's https but has it's own certificate, and when I add an exception it still shows it as unsecure, with an exclamation on the padlock and when I click the padlock it says &...
- 13
1
vote
1
answer
139
views
Reducing web browser artifacts from a web developers perspective
Situation:
Let’s say, I am about to develop a website based on known means of its creation, which would be the luggage of HTML + JS/TS/PHP + CSS wrapped in some framework, e.g. Angular, React, Laravel,...
- 11
0
votes
1
answer
102
views
How do browsers defend the user against XSS?
I'm learning about the different mitigations employed by browsers against XSS vulnerabilities.
Let's say, the developer made a mistake and there is a XSS vulnerability on a site. Unfortunately, a ...
- 1
2
votes
1
answer
234
views
A web browser localy encrypted by default
Some years ago, I've found a web browser which I can't remember the name. It had pretty impressive security standards. For example:
Symmetric encryption key (password) is mandatory for saving ...
- 21
1
vote
1
answer
208
views
How secure is it to implement most of the applications functionality using WASM on the client side/ in the browser?
I understand that nothing is perfectly secured.
If we have a web app where most of the functionality is done inside the browser using WASM, can someone get the binary of that WASM and use most of its ...
- 127
0
votes
1
answer
118
views
How are Fetch Metadata Request Headers more secure than the Referer Header?
https://www.w3.org/TR/fetch-metadata/ for reference.
It seems like this is a simplified version of referer headers. Is the only advantage backend developer usability?
- 494
0
votes
0
answers
223
views
How can I monitor which page in the web browser is making a DNS request?
I manage a Microsoft environment and I use FortiClient EMS for our endpoint security. That system is logging blocked requests to https://h.parrable.com. As best I can tell, this is not a malicious ...
- 153
6
votes
4
answers
905
views
How can non-root intercept privileged loopback ports?
Please walk through how an attacker can intercept Chrome's connection to 127.0.0.1:999, as suggested by the warning below.
This warning is consitently displayed across many versions of Chrome in many ...
- 379
2
votes
3
answers
215
views
Is Chrome's view-source dangerous when visiting malicious sites? [duplicate]
What are the risks of viewing the source code of malicious pages on Google Chrome?
I want to go directly to view-source:https://example-site.com to visit the sites without rendering anything malicious ...
2
votes
1
answer
365
views
How does microsoftonline.com know which device I am on, and whether it is a registered device?
Most of the webprogramming and IT security I know is from ten years ago. I'm far from being a pro, so please keep my ignorance in mind when answering.
Back then, browsers sometimes sent details about ...
- 131
-1
votes
1
answer
238
views
Difference between the telegram (win1) desktop app and web interface when it is "managed by your organization"?
Sometime ago I was told by our cyber department that Telegram desktop app is not "safe" as it allows silent installation of programs (first I heard about it, and they could not back it by ...
1
vote
1
answer
137
views
Can websites, through cookies or other usual means, access PDFs opened in browser?
Can websites through the use of cookies or other usual means, see the content in a PDF (saved and opened locally or opened from the web) that is also opened in the browser at the same time, or in the ...
1
vote
1
answer
71
views
Logging secrets in the user agent (browser)
There are sound reasons not to put any secrets, PII or other sensitive information into the logs on the server side (see OWASP ASVS V7).
But should the same rule apply on the client side? Is there a ...
- 395
0
votes
1
answer
235
views
How dangerous is it to visit a website?
I visited theannoyingsite (not hyperlinked because it is a nightmare)
It tells you to press space for three seconds, and then it unleashes hell upon your senses. Loud noises, bouncing windows, ...
0
votes
1
answer
59
views
What techniques can web server use against user and how to prevent it?
As we surf the web and visit various sites there is a chance to visit malicious web site.
I wish to know what methods can malicious web server use against it's visitor, and what can we do about it, ...
- 131