Hot answers tagged

264

IMPORTANT: this is based on data I got from your link, but the server might implement some protection. For example, once it has sent its "silver bullet" against a victim, it might answer with a faked "silver bullet" to the same request, so that anyone investigating is led astray. I have tried sending a fake parameter of cHVwcGFtZWxv to see whether it ...


226

What processes and systems are in place so that Google is not able to copy the data on my computer? None. Google Chrome usually runs with the permissions of your user account. The application can then read and modify local files to the same extent your user account can. (These permissions apply to most of the programs you're using.) So you need to trust ...


180

Conor's answer is a good starting point, but if you dig into Chromium's source the situation starts to look a little bleaker (but still better than not using a password manager at all). Chrome 68 (current version as of August 1st, 2018) Up through version 68 Chrome follows FIPS 181 to generate a 15 character pronounceable password allowing uppercase ...


150

Note: If you're here because your certificate isn't trusted by Chrome, this is not the reason. Chrome will still trust certificates without CT information. If your certificate isn't trusted, there is an additional factor that you may have missed. This has to do with the concept of Certificate Transparency. The Problem Browsers currently trust ...


138

Chrome not only stores your password text, it will show it to you. Under settings -> advanced -> manage passwords you can find all your passwords for all your sites. Click show on any of them and it will appear in the clear. Hashed passwords work for the site authenticating you. They are not an option for password managers. Many will encrypt the data ...


85

A piece of unsandboxed software running on a PC/Mac has (generally) the same privileges as the user running it and therefore can access any data that can be accessed by the user. You are trusting Google (and any other software vendor whose code you execute) not to do anything malicious with that access. If you don't trust Google, your only option as a ...


82

Chrome (under Windows) actually does encrypt the passwords when stored. But it does it in a way that only someone knowing your login password (or hijacking your login session) can actually use or view the stored passwords. This is well-documented (it uses the so-called Data Protection API (DPAPI), which is in Windows from NT 5.0 (i.e. Windows 2000) onwards, ...


69

To expand on what @d1str0 said: if the creator of your browser wanted to steal your passwords, it would be trivial to send them to a manufacturer controlled server whenever you entered them - they don't need to bother with the hassle of telling you about sync procedures, or offering to remember passwords. All browsers by default send a certain level of usage ...


55

Your exact case is that RSA is used as the key exchange mechanism. Instead, you should use DHE_RSA or ECDHE_RSA. To remove the "obsolete cryptography" warning, you'll need to use "modern cryptography" which is defined as: Protocol: TLS 1.2 or QUIC Cipher: AES_128_GCM or CHACHA20_POLY1305 Key exchange: DHE_RSA or ECDHE_RSA or ECDHE_ECDSA Twitter discussion:...


53

The page that your browser displays on the screen might consist of many elements: the HTML code, CSS, images, etc. Also some of the content might be provided, enhanced, or altered by (legitimate) scripts downloaded from the site. These elements might be included from the same server or from other servers. For Chrome to display the "Your connection to this ...


52

There used to be a "vulnerability" where the image could send a HTTP 401 Unauthenticated response, which would trigger a login screen for the user. If you set this as forum avatar, it would spawn a login popup for anyone visiting a page where your avatar appears. Lots of people will then attempt to log in with some username and password combination, probably ...


50

I cannot answer the asked question, but I hope this could shed some light on your problem. Should corporate security rules forbid usage of some browser extension? IMHO the answer is YES here. Browser extensions can virtually do almost anything on behalf of the regular browser. That means that a local firewall will not detect them. Are there objective ...


50

What exactly Not Secure means ? Does it means HTTP only website ? "Not secure" in Chrome means that the site isn't using HTTPS. What are all possible reasons for site being Not Secure ? To get the exact error above, it's just when a site doesn't use HTTPS. However, you can get a similar not secure error if the site's certificate is invalid or if there ...


47

If you were worried about Chrome or Firefox stealing your passwords, you wouldn't be using them as a web browser in the first place. An application like Keepass or LastPass can keep your passwords encrypted with a master password. If you don't use a master password, your web browser can unencrypt your passwords at any time. It's up to you on what level ...


46

Yes, your settings page is secure. What you're seeing is just an inconsistency on Chrome's side. In the devtools, only valid HTTPS connections are labeled "secure". Other documents, including local files and settings pages, are shown as "not secure", even if they don't ever go through a network. The notion of a "secure connection" just doesn't apply to ...


41

I suspect that Anders is right, and whoever set up the Chrome extension ban just didn't think about Firefox. If they realized that you were using Firefox to get around the ban, they'd probably forbid that too (or try to, anyway). FWIW, yes, browser extensions can be problematic from a security viewpoint, and I can see reasons for banning or heavily ...


40

This is a project by Google called Certificate Transparency that attempts to fix flaws with the SSL certificate system. It essentially has three main goals. (Lifted from http://www.certificate-transparency.org/what-is-ct) Make it impossible (or at least very difficult) for a CA to issue a SSL certificate for a domain without the certificate being visible ...


38

If you are running a Linux distribution with SELinux, it is possible to have an additional layer of security. SELinux is an OS-level technology which allows tight restrictions on what processes — like your browser process — can access. In fact, in Fedora and in Red Hat Enterprise Linux (disclaimer: I work for Red Hat, on Fedora!), there is a light ...


38

Let me start with an important and accurate caveat: http://dilbert.com/strip/2001-10-25 The math Looking at the actual odds, there are 62 possible characters (a-zA-Z0-9) and therefore assuming all are equally distributed that means that any given character has a ~16% chance of being a digit. You have shown us 136 characters in total which means that on ...


37

With a cookie! Chrome, like any other browser, is storing a cookie in your file system. Those cookies are what enable you to reconnect automatically to some site. Since it's in your file system, even if you reboot they will still be there. Multiple processes or not is irrelevant here. Then you might wonder, if the cookies are in my file system, does it ...


37

Click on the 🔒 lock icon in the location bar Click on the “Details” link next to “Your connection to this site is private.” This opens the Security tab of the Developer Tools. Reload the page. The Security thing’s left column goes “🔒 Overview”, “Main Origin”… Click on the next one, “⚫ https://security.stackexchange.com”. Connection Protocol ...


37

This is a proxy authentication pop up! And it's most likely a proxy related attack. When you connect to the Internet through a proxy, you'll be asked to enter username and password if the proxy requires an authentication. For example: Note that the whole text The server http:// ... The server says is editable, and you can change it in the proxy server ...


36

TL;TR: it is probably a BlueCoat ProxySG or similar proxy which can be configured to behave that way. Nothing to worry about. Details: What you see is a dialog for HTTP basic access authentication. This is not what Facebook uses for authentication. This means that this dialog is not from Facebook itself. My guess is that facebook.com is filtered by your "...


34

Your certificate only contains a sha1 signature, probably with a lifetime past 1 January 2017. These are deprecated, and Chrome therefore removes the appearance of security. See https://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html for more info.


33

You cannot assume that an add-on is safe "because it's hosted in one of the official extension galleries". In this answer, I start with the explanation of how extensions end up in the extension galleries for the popular browsers. At the end, I dedicate an extra section to Chrome. How does an item get listed in the official stores? Anyone with Google ...


28

Please, please, please stop reusing your passwords! In Firefox you can actually set a master password which will protect your stored passwords from being viewed. This master password will also be required once per session before the browser will start filling in passwords for you. You could also use a general purpose password manager for example Keepass. ...


26

Modern browser extensions use the WebExtensions API, which enforces a permission model; basically, addons can only have the access that you grant them (you can't reject individual permissions though; if you are uncomfortable with some, you can't install the addon). Regarding your specific questions: The browser history can only be requested if the history ...


25

Yes Yes Yes Updated, See the comment from George Bailey for this one. No - like you say the sandbox will prevent that. Read (and send) data on all the pages you visit. Some more details on why this is often needed, but not always is discussed in this question Why do Chrome extensions need access to 'all my data' and 'browsing activity'?


23

No, because the XSS filter only looks whether it sees XSS code in the input back in the HTML outputted by your server. For example, if Chrome sees your web page is accessed with an URL that contains the following: ?q=<script>alert("XSS!")</script> and if the HTML returned by the server contains this: <p>You have searched for <b>&...


23

Lawyers. You have a contract with Google stating what they will do / you allow them to do. This is called the Google Chrome Terms of Service . And obviously, you have carefully read it before installing it. This includes¹ excerpts like this (emphasis by me): By default, usage statistics and crash reports are sent to Google (…). Usage statistics contain ...


Only top voted, non community-wiki answers of a minimum length are eligible