461 votes
Accepted

Why is Math.random() not designed to be cryptographically secure?

I was one of the implementers of JScript and on the ECMA committee in the mid to late 1990s, so I can provide some historical perspective here. The JavaScript Math.random() function is designed to ...
Eric Lippert's user avatar
  • 4,446
159 votes
Accepted

Important data can be modified from the developer console. What should I do?

Most of the details in your question are irrelevant. That the ID is stored in a HTML id attribute, the developer tools, that you are using jQuery... None of that really matters. The only thing that ...
Anders's user avatar
  • 65.6k
135 votes
Accepted

Tell browser my site has no scripts

A good option is to harden your Content Security Policy. It allows you to fine-tune which resources the browser will load/run, and is supported by most browsers. Consider the following header: ...
grc's user avatar
  • 1,855
120 votes

Why is Math.random() not designed to be cryptographically secure?

Because there actually is a cryptographically secure alternative to Math.random(): window.crypto.getRandomValues(typedArray) This allows the developer to use the right tool for the job. If you want ...
Philipp's user avatar
  • 49.4k
119 votes
Accepted

Can "Accept cookie" button in a website be malicious?

Technically, browsers do not have to ask the user a question in order to use cookies. Furthermore, they are not technically bound to the answer given by the user. Legally, that is another matter. In ...
A. Hersean's user avatar
  • 10.6k
111 votes
Accepted

Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?

From a security perspective, you need to revalidate everything on the server. This will always be the case, no matter how pretty and advanced HTML5 features become. You simply can not trust the client....
Anders's user avatar
  • 65.6k
107 votes
Accepted

How to replace SSL/TLS?

No SSL, no security. Things in the real world are rarely simple, but here it is the case. This is easily seen as follows: whatever you do in Javascript, will be done in Javascript sent by the server. ...
Thomas Pornin's user avatar
106 votes
Accepted

Why is JavaScript "safe" to run in the browser?

The standard is designed to be safe. The implementation may not be. The browser isolates JavaScript, as it executes within a browser process itself. It cannot do anything which is not permitted by the ...
forest's user avatar
  • 66.6k
97 votes
Accepted

Discouraging users from copying images off a website?

There is no way to block saving of images, but here are some ideas to make it harder. To prevent right-clicking the image to save it, you can overlay a transparent div on it. The user will then right-...
Sjoerd's user avatar
  • 30.4k
90 votes
Accepted

Anonymous surveys that aren't so anonymous

If the site is based on ASPX files, then it is more than likely that this is a ASP.NET application - most probably hosted on IIS. IIS has a very simple checkbox to enable Windows Integrated ...
AviD's user avatar
  • 73.3k
88 votes
Accepted

Preventing users from tampering with input

TL,DR: It's impossible to do so client side. Client side validation is just a client convenience, not useful to really validate anything. You don't want the client to mistype his email, putting an ...
ThoriumBR's user avatar
  • 53.9k
82 votes
Accepted

How can I prove to users that my obfuscated code is not malicious without unobfuscating?

How can I prove to users that my obfuscated code is not malicious without unobfuscating? Probably, you can't. Maybe, if trusted persons were willing to audit your code (subject to NDA etc) and sign a ...
Kate's user avatar
  • 7,927
79 votes

Can "Accept cookie" button in a website be malicious?

A malicious website could harm you without you having to click on anything. However, the fact that the user clicked on a page element simplifies the task: for example, most browsers would ...
Dmitry Grigoryev's user avatar
74 votes

Why is Math.random() not designed to be cryptographically secure?

JavaScript (JS) was invented in 1995. Potentially illegal: cryptography was still under tight export control in 1995, so a good CSPRNG might not even have been legal to distribute in a browser. ...
Luc's user avatar
  • 32.9k
70 votes

How can I ensure my API is only called by my client?

You can't. Even for things that aren't a website, like an embedded device, somebody could always open up the hardware and inspect the firmware or, in an extreme case, de-cap the chips and examine them ...
CBHacking's user avatar
  • 47.5k
63 votes

Magic hash attack in JavaScript

Being loosely typed with a crazy == operator, JavaScript is vulnerable to type juggling. But it is not as vulnerable as PHP. Here are a few things that are equal in PHP, but not in JavaScript: '...
Anders's user avatar
  • 65.6k
62 votes
Accepted

eBay web site tries to connect to wss://localhost:xxxxx - is this legit or they have some Malware JS running?

This is ebay running a local port scan over websockets. It has been reported recently: https://twitter.com/JackRhysider/status/1264415919691841536 (original research) https://www.bleepingcomputer.com/...
Pedro's user avatar
  • 3,931
57 votes
Accepted

Can ISPs replace a website's HTML/JavaScript/HTTP headers with something else?

Your ISP is per definition a MITM (man-in-the-middle) and therefore can serve you any content it desires. You mentioned HTTPS and this is of course a game changer. Yes, the ISP can server any ...
Demento's user avatar
  • 7,465
53 votes

What's the danger of having some random, out of my control, JavaScript code running on my pages?

Risk In the worst scenario, it could render website completely inaccessible for the users, it could perform particular actions as them (for example, requesting account removal, spending money) or it ...
Przemek's user avatar
  • 591
53 votes

How can I prove to users that my obfuscated code is not malicious without unobfuscating?

It is not possible to prove that code isn't malicious if users cannot read it. The best you could hope for is a web-of-trust where a third-party certifies that it's not malicious, but that doesn't ...
Síle's user avatar
  • 531
50 votes

Why is JavaScript "safe" to run in the browser?

How is it safe? It is not. Or more exactly it is as safe as the browser implementation is. Browsers (including their JavaScript engine) are complex pieces of software, with regular addition of new ...
Serge Ballesta's user avatar
48 votes
Accepted

How to deobfuscate suspicious JavaScript code?

The procedure for dealing with obfuscated JavaScript is very similar to how you deal with it in PHP. In this case, the real action is going on in this line: uumod=(new Function("fgwus","var ccuru=...
Anders's user avatar
  • 65.6k
47 votes
Accepted

What is formjacking?

The Symantec article you are referring to is like this one. Looking at the graphic: Point 1 is what is generally the most interesting to security researchers, because that is where the ...
tim's user avatar
  • 29.6k
42 votes

What is formjacking?

Direct access to the server is not required There are a number of ways that malicious javascript could end up on a webpage without the attacker having access to the server. The author of the website ...
DaveMongoose's user avatar
42 votes

Why is there no web client for Signal?

Yes HTTPS is used. The thread doesn't say that the web app will be completely insecure, instead it says This effectively reduces the security of your end-to-end encrypted communication to that of ...
nobody's user avatar
  • 11.5k
40 votes
Accepted

Predicting Math.random() numbers?

Indeed, Math.random() is not cryptographically secure. Definition of Math.random() The definition of Math.random() in the ES6 specification left a lot of freedom about the implementation of the ...
Benoit Esnard's user avatar
39 votes

How can I ensure my API is only called by my client?

Implement authentication and allow the proxying of the requests for authenticated users only. Otherwise your service will become known with the time and other people or even companies can use it, and ...
mentallurg's user avatar
  • 12.3k
38 votes
Accepted

Running code generated in realtime in JavaScript with eval()

Using eval in this context doesn't create any vulnerability, as long as an attacker can't interfere with the arguments passed to matchCondition. If you find it easier to read / program it this way, ...
Benoit Esnard's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible