Questions tagged [web-browser]
A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.
1,644
questions
0
votes
0
answers
52
views
Are 2FA browser plugins sufficiently secure?
Regarding 2FA browser plugins, I follow the uneducated opinion that they usually provide sufficient security. Since a desktop computer is a unique device (even a virtual machine) and provides that ...
- 101
1
vote
1
answer
79
views
Does not storing passwords in browser really matter given cookie hijacking exists?
I see lots of articles suggesting not storing passwords in the browser, and it made perfect sense to me, if I can access this data easily, an attacker probably can too.
But then I found out about ...
2
votes
1
answer
308
views
In the modern context, what max harm can a webpage do, if the creator is malignant? [duplicate]
Note: this does not answer my question as it mentions Java/Flash(not in the modern context. The question is from like 10 years ago so probably outdated), and mentions weakness introduced by the user(...
- 131
0
votes
0
answers
26
views
Methods to look for when checking if a javascript program is making network requests
I'm trying to quickly audit a js browser extension to see if it doesn't talk to the outside. Am I right in thinking that I can just grep the code for the following:
XMLHttpRequest
fetch
$.ajax
axios....
- 101
0
votes
0
answers
37
views
Which system variables are exposed from browser JavaScript context?
I know that the TZ variable aka TimeZone can be read by servers, especially with fingerprinting.
What are the exposed variables to browser's ?
- 101
1
vote
1
answer
112
views
How safe it is to view PDF file in browser without downloading the file into PC?
When I view the PDF file in a browser such as FireFox without downloading the file into my PC, does FireFox temporarily store the PDF file in my PC?
I heard that FireFox has been sandbox heavily and ...
- 11
1
vote
0
answers
51
views
Does the browser pass the name of the camera being used to the website [closed]
Does the browser pass the name of the camera being used to the website which is accessing our camera like when we use obs virtual cam so is the website able to detect that a virtual camera is being ...
- 11
0
votes
1
answer
46
views
How vulnerable is Opera using a version of Chromium that is 3 versions behind?
Uses Chromium 115 when current stable is 118. They do claim to have the latest chromium security updates.
Does patching old chromium with the latest security fixes bring it on par with the latest ...
1
vote
1
answer
110
views
Since yt-dlp simulates a browser, can it be fingerprinted in the same ways (e.g. canvas and audiocontext)?
I know that wget and curl can mitigate fingerprinting (aside from http header and user agent), but will yt-dlp give away more data?
- 11
0
votes
1
answer
32
views
How to properly migrate authentication cookies to using a new encryption scheme on a website while being backwards compatible?
When a user logs in with their email/password combo and gets authenticated to our website, the backend sends the web browser an encrypted cookie based off of their memberId with us. While this ...
- 295
0
votes
2
answers
119
views
Why do we use Session ID cookies on the web instead of a unique device identifier?
Session IDs aren't exactly secure, you can copy them from one device to another just by copying the browser's temp files. Techniques to tell apart one device from another have existed in browsers for ...
- 1
18
votes
2
answers
6k
views
How is Xiaomi changing my browser home page?
I have recently observed that the home page of Google Chrome on my Xiaomi Android phone has been altered to a website called "Mintnav". I did not update any software. How is Xiaomi able to ...
- 197
0
votes
0
answers
65
views
CSP script-scr blob
What are the risks to allow a "blob:" directive to the script-src CSP? Is it safe?
I have a list of allowed domains defined in script-src, but nonetheless I got an error specifying the ...
0
votes
0
answers
42
views
What can be leaked using a browser extension where one of the extensions loads JavaScript from a remote site?
Can one remotely log my IP, browser history, and saved passwords?
I think the IP should be easily done if one of the extensions load a remote JavaScript to run in my browser. I'm not sure about other ...
- 127
1
vote
1
answer
105
views
Do CSRF Tokens need to be tied to user IDs?
I am implementing a web system using Golang and have incorporated gorilla/csrf for CSRF protection. However, I've encountered an issue. When I have tab1 open in my browser, logged in as user1, and ...
- 11
0
votes
0
answers
86
views
CryptoKey with IndexedDB to secure stateless authentication
Stateless authentication using e.g. JWT can be dangerous as they are non revocable and can leak giving full access. But they are really flexible.
I'm considering scenario where issued JWT is binded to ...
- 309
0
votes
0
answers
57
views
Is there a way to prevent/detect DOM Clobbering in the browser?
It is possible to clobber document attributes, e.g.:
<img name="cookie">
...
typeof(document.cookie)
//=> 'object'
Is there any way to prevent this from happening, access the ...
- 1
0
votes
0
answers
46
views
Recovering Lost Brave Browser Usernames and Passwords
I recently changed my password for my local Windows 10 account and found out that my usernames/passwords in Brave's password manager are no longer visible.
Unfortunately, I executed Brave after the ...
- 1
1
vote
1
answer
138
views
Can a browser-based HTTPS proxy secure browsing data while using a system-level proxy?
I use Nekoray to set up proxies for my Windows system.
When I connect to those proxies, does using a browser-based proxy with HTTPS encryption secure my transferred data through the web browser?
Can ...
- 113
0
votes
0
answers
44
views
Are there any html Sanitizer() API configs that allow javascript execution?
I'm talking specifically about the HTML Sanitizer API: https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API
The API allows you to configure the sanitizer with a list of allowed elements ...
- 101
2
votes
1
answer
113
views
Distinguish origin of password prompts
I am wondering how to distinguish (password) prompts that the OS issued from prompts that are delivered application-side. This question first occurred to me when considering Firefox master passwords, ...
- 21
1
vote
1
answer
369
views
Are CORS headers useless?
It is common to say that CORS headers protect against CSRF, so that if you visit a malicious website, it cannot make a request to your web application because the referer header (the URL of the ...
2
votes
1
answer
1k
views
What is the current (April 2023) browser support for Ed25519 certificate signatures?
It seems that Firefox and Chrome both support x25519 keys, but they do not accept keys signed using Ed25519. Am I correct?
If so, where can I find the official source of this information?
- 23
1
vote
2
answers
431
views
XSS in a href with target=_blank
I have found out that in most browsers the following code won't execute:
<a href="javascript:alert(1)" target=_blank>click</a>
But the same code without blank will.
My question ...
1
vote
2
answers
217
views
How securely is data deleted with IndexedDB?
I'd like to understand how securely is data deleted when we request for its deletion using .clear(). I suspect it being weak. Is there a method available from the browser API (would write/delete junk ...
- 113
0
votes
1
answer
109
views
How to safely share data between 2 SPAs?
Let's say I have 2 SPAs (single page applications), SPA A and SPA B.
I want to share data between the 2 applications for an end-to-end flow.
How can I safely share data such that it would not be ...
- 113
0
votes
1
answer
156
views
How to reliably identify referrer on client browser?
Is there any way to reliably identify the referring site on modern browsers (not considering manual HTTP requests outside of a browser e.g. cURL, etc.)?
Referrer header will not work because the ...
- 113
7
votes
3
answers
3k
views
ESTABLISHED TCP connections after opening browser in linux
I am using netstat -acp | grep ESTABLISHED command to check established connection
between with my system.
$ sudo netstat -acp | grep ESTABLISHED
tcp 0 0 rg-Vostro-3546:51874 server-18-...
- 187
1
vote
1
answer
89
views
Ways to safeguard Internet users from fraudulent websites
Extended Validation SSL certificates have been effectively abandoned, as web browsers do not even show them as something special, so my question is: how would you go about safeguarding the user from ...
- 2,552
2
votes
1
answer
131
views
Is it dangerous to publicly surf the web while my browser is being run in an IDE?
While developing web software, I typically run a browser (chrome) from my IDE. Here's an example launch.json in VSCode:
{
// Use IntelliSense to learn about possible attributes.
// Hover to ...
- 888
3
votes
1
answer
2k
views
Is there any secure way to make sure that a request comes from a browser and via a specific domain (by just using frontend)?
Let us assume that we have a public API, for example, company.com/publicEndpoint, that can accept requests from any source. Various websites, like foo.com and bar.com, use JavaScripts that call this ...
- 31
0
votes
0
answers
74
views
Can WebASM provide JavaScript style interactivity without the same vulnerabilities?
JavaScript is useful for interactivity. However, it is often disabled by security conscious browsers, such as the Tor Browser Bundle, and blocked with plugins such as NoScript.
I was wondering if it ...
- 715
1
vote
0
answers
182
views
Is it safe to enable password sync on Microsoft Edge?
Microsoft Edge, as well as other Chromium browsers, have a password sync feature built into their browsers, which look something like the image below.
Before I enable this feature for convenience and ...
- 111
0
votes
1
answer
256
views
HTTPS/TLS security with an invalid certificate
I'm trying to use a site that's https but has it's own certificate, and when I add an exception it still shows it as unsecure, with an exclamation on the padlock and when I click the padlock it says &...
- 13
1
vote
1
answer
135
views
Reducing web browser artifacts from a web developers perspective
Situation:
Let’s say, I am about to develop a website based on known means of its creation, which would be the luggage of HTML + JS/TS/PHP + CSS wrapped in some framework, e.g. Angular, React, Laravel,...
- 11
0
votes
1
answer
97
views
How do browsers defend the user against XSS?
I'm learning about the different mitigations employed by browsers against XSS vulnerabilities.
Let's say, the developer made a mistake and there is a XSS vulnerability on a site. Unfortunately, a ...
- 1
2
votes
1
answer
229
views
A web browser localy encrypted by default
Some years ago, I've found a web browser which I can't remember the name. It had pretty impressive security standards. For example:
Symmetric encryption key (password) is mandatory for saving ...
- 21
1
vote
1
answer
200
views
How secure is it to implement most of the applications functionality using WASM on the client side/ in the browser?
I understand that nothing is perfectly secured.
If we have a web app where most of the functionality is done inside the browser using WASM, can someone get the binary of that WASM and use most of its ...
- 127
0
votes
1
answer
115
views
How are Fetch Metadata Request Headers more secure than the Referer Header?
https://www.w3.org/TR/fetch-metadata/ for reference.
It seems like this is a simplified version of referer headers. Is the only advantage backend developer usability?
- 494
0
votes
0
answers
220
views
How can I monitor which page in the web browser is making a DNS request?
I manage a Microsoft environment and I use FortiClient EMS for our endpoint security. That system is logging blocked requests to https://h.parrable.com. As best I can tell, this is not a malicious ...
- 153
6
votes
4
answers
897
views
How can non-root intercept privileged loopback ports?
Please walk through how an attacker can intercept Chrome's connection to 127.0.0.1:999, as suggested by the warning below.
This warning is consitently displayed across many versions of Chrome in many ...
- 379
2
votes
3
answers
209
views
Is Chrome's view-source dangerous when visiting malicious sites? [duplicate]
What are the risks of viewing the source code of malicious pages on Google Chrome?
I want to go directly to view-source:https://example-site.com to visit the sites without rendering anything malicious ...
2
votes
1
answer
359
views
How does microsoftonline.com know which device I am on, and whether it is a registered device?
Most of the webprogramming and IT security I know is from ten years ago. I'm far from being a pro, so please keep my ignorance in mind when answering.
Back then, browsers sometimes sent details about ...
- 131
-1
votes
1
answer
221
views
Difference between the telegram (win1) desktop app and web interface when it is "managed by your organization"?
Sometime ago I was told by our cyber department that Telegram desktop app is not "safe" as it allows silent installation of programs (first I heard about it, and they could not back it by ...
1
vote
1
answer
134
views
Can websites, through cookies or other usual means, access PDFs opened in browser?
Can websites through the use of cookies or other usual means, see the content in a PDF (saved and opened locally or opened from the web) that is also opened in the browser at the same time, or in the ...
1
vote
1
answer
69
views
Logging secrets in the user agent (browser)
There are sound reasons not to put any secrets, PII or other sensitive information into the logs on the server side (see OWASP ASVS V7).
But should the same rule apply on the client side? Is there a ...
- 395
0
votes
1
answer
230
views
How dangerous is it to visit a website?
I visited theannoyingsite (not hyperlinked because it is a nightmare)
It tells you to press space for three seconds, and then it unleashes hell upon your senses. Loud noises, bouncing windows, ...
0
votes
1
answer
56
views
What techniques can web server use against user and how to prevent it?
As we surf the web and visit various sites there is a chance to visit malicious web site.
I wish to know what methods can malicious web server use against it's visitor, and what can we do about it, ...
- 131
1
vote
1
answer
159
views
Website fingerprinting based on packet traces
Given a set of traces coming from different websites, where each trace is a packet. Assume we only know the time of arrival, size and direction of each packet. How do we go about fingerprinting these ...
- 11
1
vote
2
answers
173
views
Are browser extensions inherently unsafe?
If we're doing sensitive things in the browser, like logging into cryptocurrency exchanges, is it too risky to have any browser extensions, for fear that there's a virus or something in them?
- 13