Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

Filter by
Sorted by
Tagged with
36
votes
8answers
12k views

Why should browser security be prioritized?

From this answer about browser security: time to update if you really care about security So if every other software and functions I need can work on a 32-bit OS, I guess the only reason for ...
0
votes
2answers
402 views

Why IPv6 showing on whatismyip.com?

I use Tor Browser on Whonix. Why I see IPv6 (something like 3221:23f9:c:67h:0:0:0:3) on whatismyip.com? Is that website can see my MAC Address?
2
votes
1answer
197 views

Risks of letting the browser open local/network file system listing

Browsers do not generally allow web pages to interact with client-side file system as a security measure. I would like to know what can go wrong with the following scenario: Clicking a special ...
3
votes
1answer
129 views

Is it possible for page to get your installed extensions through javascript?

When you visit a page, could that page tell what extensions you are running if javascript is enabled? If so then could we stop them or at least make it extremely difficult to increase our privacy?
31
votes
2answers
3k views

How does subresource integrity actually help?

Subresource integrity basically lets me know that a resource I'm about to download is valid, because the hash of its contents matches what I expect. But this assumes that I'm already running on some ...
2
votes
1answer
58 views

Why/how is browser inserting inline SVGs at end of body?

Chrome is inserting the following SVG images at the bottom of pages: <span style="width: 24px; height: 24px; background: url(&quot;data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/...
1
vote
1answer
75 views

Will a browser exploit also work after I have downloaded the website? [closed]

When I visit a website which exploits a vulnerability in my browser and I save this website to my computer and open later the offline version can my browser be hacked again?
3
votes
1answer
576 views

Is cache-control: no-cache enough for sensitive information like bank accounts, etc.?

I have read somewhere that when storing sensitive information on a website you should include cache-control: no-store for telling the browser not to store that information on the local system. But I ...
1
vote
1answer
181 views

Bad medical security

I reside in Michigan, U.S.A and just recently took over the IT of a small medical practice. There is no real security in place and I am still undoing the horrific damage and lockouts put in place by ...
64
votes
2answers
8k views

Are EU cookie consent forms safe? [closed]

Does the EU consent form system pose a new security risk? Today we have to click OK on about 20 cookie consent forms every week, where previously we could mostly dismiss internet forms as being ...
-3
votes
2answers
188 views

Do cookies violate privacy and should not be used? [duplicate]

Cookies are just a simple text file or DB (some parts encrypted). There is no way to execute them and they cannot access other user data store. Normally cookies keep some data like session ID or ...
2
votes
1answer
178 views

GET, “mailto” warning - how can I tell if a site is secure?

My password manager is giving me a warning when I go to certain sites. They say if I think I can trust the site to go ahead and use it .... this leaves me concerned I'll miss something. The pop-up ...
1
vote
3answers
470 views

How exploit this open redirect vulnerability in browser?

I have a problem. I found open redirect vulnerability by burp. Request by server look like here: GET /user/settings/ HTTP/1.1 Host: domain.com User-Agent: etc So i decided to find open redirect ...
1
vote
1answer
47 views

How do modern browsers isolate different addons?

A user may have multiple addons installed on a browser. But typically, the browser is running in userspace with an unprivileged uid. I was wondering how modern browsers can, in such a setting, provide ...
3
votes
2answers
198 views

Is RSA key-like browser authentication feasible?

I see that password based authentication is out of favor today, and Internet is moving toward RSA keys-based authentication. Coming from that fact, I am wondering if there would be a real benefit to ...
2
votes
1answer
479 views

Is there something similar to Firejail for OpenBSD?

On Linux, Firejail (https://firejail.wordpress.com/) offers an easy way to sandbox web browsers and other programs. Is there an easy way to sandbox a web browser on OpenBSD ? (reserve question: is ...
10
votes
4answers
352 views

Security implications of download attribute

The download attribute in an a element tells the browser to force the download of a file that otherwise would be interpreted by the browser. This is very convenient, since often users want to download ...
2
votes
1answer
447 views

Why is the same origin policy sensible - for requests?

This is not the same question as Why is the same origin policy so important?. That one asks only about why cookies are only ever send to origin they came from, which I understand. What I don't ...
3
votes
1answer
51 views

Prevent reflecting page modified by browser extension

Suppose there is a trusted browser extension in a chrome browser that modifies the web page (like editing DOM, appending scripts, etc) I don't want anyone but me to see the page modified by this ...
1
vote
1answer
262 views

Unprotected connection to HTTPS web-page

A couple of days ago we noticed that when we go to our online banking login page (using Opera browser as usual) there is no green lock icon there anymore. Instead, there is a grey globe icon which ...
1
vote
1answer
44 views

Can request from different software on same machine to a server be identified to be from same origin by tracking TLS handshakes?

If two different users visit an website from two different browsers via HTTPS, can they be identified by the server to be from same origin (same client machine) using information available from TLS ...
3
votes
4answers
633 views

How come <img> calls do not violate the SOP (Same Origin Policy)?

I'm a bit confused regarding the subject of Same Origin Policy. If understand correctly. SOP's purpose is to prevent one page from obtaining access to sensitive data on another web page. So for ...
25
votes
7answers
5k views

Why do browsers allow custom root CAs?

At my work all browsers have a custom root CA installed, which then allows them to snoop on all https traffic while the users get the false impression that they are browsing a secure https page. Why ...
1
vote
2answers
124 views

Are quickly closed pop-up windows in browsers a threat?

Occasionally I'll be on sites I trust, and an ad will pop up. There will be an X saying to close the ad, in a pretty standard location (upper right corner of the frame, sometimes just outside the ...
1
vote
2answers
757 views

How to remove or at least change password from browser memory dump file [duplicate]

I am working with JSP. So when a user submits a form, all the form fields say username and password gets stored in browser memory dump file in clear text. I even tried with JSP hidden fields, but ...
2
votes
0answers
195 views

How does the Ruby on Rails CSRF Protection Work?

I am not sure i completely understand how Ruby on Rails handles CSRF protection. My understanding was that a token is generated and embedded in the HTML markup as a meta tag, and at the same time ...
1
vote
1answer
214 views

What is the “validity scope” of a browser cookie?

Consider the standard CSRF protection of a Ruby on Rails application: a CSRF token is embedded in the HTML page, while at the same time stored encrypted as part of the session cookie. When making a ...
3
votes
1answer
596 views

Why Same origin policy is based on host-name and not on IP?

Same origin policy is to restrict one page to access another document from accessing data. Because they have different origin where SOP define an origin as follows. An origin is defineed as ...
1
vote
1answer
124 views

Can an exploit in my browser read login passwords without logging in again?

When I log into my email account through a browser and open an email which exploits some vulnerability in my browser would it be possible for the attacker to take over my account? Passwords for full ...
0
votes
1answer
396 views

How browser parses the escape characters in Javascript (XSS)?

I am new to XSS attacks. Recently, I was doing a project and found that one of my input field (website) is vulnerable to XSS attack. The value in website field is inserted into a href of an anchor tag ...
1
vote
1answer
78 views

How to hide folders inside webroot from being identified?

I have a library inside my webroot: https://my-website.com/wp-content/my-library-i-want-to-hide Accessing the url via a browser gives me the expected permission denied error. However, I want to make ...
2
votes
2answers
435 views

Computer began downloading hundreds of blobs then froze

While my mother was trying to sign into her bank account, the download bar in Chrome filled up with hundreds of downloads. Her computer then froze so she restarted it and it seemed to work fine, and ...
2
votes
1answer
295 views

How do password managers implement secure browser integration? [closed]

Some password managers can automatically fill passwords in user's browser. But for this auto-fill to be secure, they have to make sure they are putting password in the correct input field, plus, the ...
-1
votes
2answers
1k views

What kind of security comes from blocking cross-origin-requests when cors exist? [duplicate]

Modern browsers block cross-origin-requests. That means, this will be blocked: jQuery.get("https://example.net"); Why blocking those requests? it's bad when content is loaded the user hasn't ...
4
votes
1answer
234 views

What does “by continuing you agree to share resources” on a website mean?

I recently encountered this message on a website: "By continuing you agree to share resources. Your browsing speed will not be affected." When I get 'learn more', it redirected to me an obscure ...
3
votes
0answers
162 views

Desktop browser that supports Fido U2F over CCID

Is there any browser that supports Fido U2F over CCID for smart cards? As far as I can see Firefox and Chrome only support U2F over HID, and only Chrome for Android (with Google Authenticator2) ...
2
votes
1answer
659 views

Why is FF in Kali making requests to ocsp.digicert.com?

Warning -> n00b here! For some time now I am learning the tools for pen-testing but I am still complete n00b. I have installed Metasplitable2 in another computer on local network and I am running ...
1
vote
1answer
132 views

Concerns regarding a password manager web app [closed]

I've written a password manager in JavaScript. It works in a browser. Try it out Are there any fundamental issues with the concept of a web based password manager? Should I be concerned if hashes ...
12
votes
1answer
1k views

Current status of SameSite cookie

Recently I got to know about SameSite cookie attribute which is used to mitigate the CSRF attacks. AFAIK SameSite attribute for cookies is implemented in Chrome and some other browsers. Since I'm ...
2
votes
1answer
192 views

Is it as safe to use a programming language as a browser? [closed]

To browse the internet on sensitive websites (government websites, banks, etc...), is it as safe to use a modern web browser as a programming language? Specifically, python + requests + beautifulSoup ...
1
vote
1answer
1k views

Why are cross-domain POST requests allowed? [duplicate]

I understand that best practice is to use tokens to prevent CSRF, but why do browsers permit cross-site POST requests in the first place? It seems like giving untrusted parties unfettered write ...
2
votes
2answers
216 views

Should I wait until Spectre and Meltdown is fixed in hardware? [duplicate]

I have a Laptop that needs replacing due to age. I will be using this laptop for desktop use, including Office Apps, Development, Running VMs & Web Browsing. I will be using separation using ...
3
votes
1answer
662 views

Does user-agent session tracking provide any benefit?

On a phpBB forum I manage a user has requested that we turn off the "Validate browser" setting which invalidates user sessions if they change user-agent, because they use a mod which randomises their ...
1
vote
1answer
944 views

chrome is launched and tries to open a wierd website

I have this wierd problem that once in a while (I guess mostly when I plug my laptop to adapter) chromium is lauched by itself and loads this wbesite: http://gestyy.com/wPEFwy I can guess that there ...
4
votes
1answer
331 views

Can access blocked site using lynx but not cURL nor browser

I am not sure if this is the right place to ask this, but here it goes. The government of the country I live in has blocked wikipedia.org. Out of curiosity, I was messing around to maybe ascertain ...
4
votes
0answers
2k views

Are JWT refresh tokens in browser really that bad?

Note: I fully acknowledge there may be something I'm missing in the picture, which is part of my reason for posting. I'd like to get the opinion of people more experienced than I am on authN/Z related ...
3
votes
2answers
1k views

List of sites that still dont support HSTS?

I'm working on an article for work and seeking a list of the top ~500 websites (ranked by Alexa) that still don't have support for HSTS. Does such a list exist? I'm not getting any interesting hits ...
3
votes
1answer
2k views

Is window.history.back() safe to use?

I am doing a penetration test on a web application and it is using window.history.back() to go back to the previous page. Is this safe to use? For example, if I visit google.com and then go to the ...
0
votes
1answer
88 views

What is ScriptSafe's “Client Rectangles” and what information does it leak?

Just wondering how this one affects the privacy and security because it breaks a lot of sites displaying images for example.
9
votes
2answers
291 views

Pitfalls when rolling your own “show password” functionality

I'm considering emulating the "Show password" functionality, available in some newer browsers, on a website, essentially as a polyfill for browsers which don't. The common way to do this is to call a ...