93 votes

Why use HTTPS Everywhere when we have HSTS supported browsers?

HSTS uses a Trust on First Use model. If your first connection to the site was already compromised, you may not receive an HSTS error on subsequent requests. The HTTPS Everywhere plugs this hole, by ...
Lie Ryan's user avatar
  • 31.4k
48 votes

Why use HTTPS Everywhere when we have HSTS supported browsers?

HTTPS Everywhere is client-side, and HSTS is server-side. So the answer is that HTTPS Everywhere is to defend in cases where the server does not set an HSTS header.
tim's user avatar
  • 29.6k
22 votes
Accepted

Why use HTTPS Everywhere when we have HSTS supported browsers?

even then if we browse to a website say www.facebook.com, the response header from the Facebook servers would have HSTS mentioned I made a curl request to http://www.facebook.com and this is what I ...
A.Jesin's user avatar
  • 418
7 votes
Accepted

Are inactive vulnerable Wordpress plugins still unsafe?

Depends on the plugin, they can be if there is say a PHP script that can be called directly (doesn't depend on wordpress code or includes the right statements to load the wordpress libraries it needs)....
ewanm89's user avatar
  • 2,053
6 votes
Accepted

How trustful are KeePass plugins?

So in short, the only way to ensure an optimum security with the KeePass plugins is to review their codes by yourself. The only problem is that some of them are open source, some others are not. ...
Jérôme MEVEL's user avatar
5 votes

How trustful are KeePass plugins?

A KeePass plugin can do pretty much anything that KeePass itself can, it is effectively just a .NET library. AFAIK, there is no sandboxing at all to a KeePass plugin. So unless you decompile and do a ...
Lie Ryan's user avatar
  • 31.4k
5 votes
Accepted

Metasploit. Is always replacing domain names with resolved ips on RHOST/RHOSTS?

You are searching for the VHOST option. As you may know, when you rent some web hosting services, you may choose between a dedicated server and a shared one (which is much more cheaper) On shared ...
Baptiste's user avatar
  • 1,673
5 votes

Why use HTTPS Everywhere when we have HSTS supported browsers?

I see none of the answers have touched on HSTS preloading yet. To summarize: the caveats mentioned in existing answers, such as @Lie Ryan's: HSTS uses a Trust on First Use model. If your first ...
user2428118's user avatar
  • 2,786
5 votes

Why use HTTPS Everywhere when we have HSTS supported browsers?

The question rests on false premises. ...if we browse to a website say www.facebook.com, the response header from the Facebook servers would have HSTS mentioned and our browser would direct us from ...
Peter Taylor's user avatar
5 votes

Why use HTTPS Everywhere when we have HSTS supported browsers?

HSTS is at the discretion of the website operator. They must decide whether the security benefits of mandatory HTTPS are worth the extra server load, blocking of users who can't use HTTPS and ...
Peter Green's user avatar
  • 5,300
4 votes

Why would website block password manager auto-fill?

The policy-based justification (which is spurious logic) is that passwords to sensitive data should never be written down, and therefore, at risk of being stolen. Passwords should be memorised and ...
schroeder's user avatar
  • 129k
4 votes

Why use HTTPS Everywhere when we have HSTS supported browsers?

A lot of domains don't have HSTS configured correctly. For example Google has HSTS on www.google.com and it's subdomains, but not on google.com and its subdomains. So HSTS is not enforced on mail....
seanieb's user avatar
  • 188
3 votes
Accepted

What could a malicious website do if you don't update Adobe Flash?

There are several vulnerabilities known in previous versions of Flash which allow to execute arbitrary program code. That means an exploitive website can do anything a program can do which doesn't ...
Philipp's user avatar
  • 49.4k
2 votes

How trustful are KeePass plugins?

This was already been answered, but I've made a small Windows tool for unpacking KeePass PLGX files. No KeePass executable dependency is required. It can also integrate into Shell Context Menu and ...
Cristian S's user avatar
2 votes

How trustful are KeePass plugins?

In Windows you could also create a firewall rule that prevents KEEPASS.EXE from doing outgoing communications. It will prevent KEEPASS from checking for updates, but at least it prevents the small ...
Ilka's user avatar
  • 21
2 votes

Detecting disabled Chrome plugins using JavaScript

I have banged my head in the wall for awhile with the same question and failed to find a reliable answer in SO or elsewhere. There are ways to tell if a third-party plugin (like an add blocker) is ...
Brevering's user avatar
2 votes

Making an encrypted SMS app (Android)

You are reinventing the wheel. I don't think the state of art really warrants creating a new app from scratch (OTOH if you want to do so for other reasons, like practising creating an app, then go for ...
Ángel's user avatar
  • 18.8k
2 votes

What could a malicious website do if you don't update Adobe Flash?

The real base question here is What can a malicious website do if it gains access to a run an application on your computer? Which further boils down to What can a malicious application do on ...
Robert Mennell's user avatar
2 votes
Accepted

Haunted Google Account?

To summarize the checks that can be done in order to assess wheather and how the account has been compromised: First of all see if the files in question are shared with other users (which may be the ...
rudib's user avatar
  • 166
1 vote
Accepted

Is possible to implement a Web Cryptography API custom provider?

See the specification 5.1: This specification assumes, but does not require, that conforming user agents do not and will not be directly implementing cryptographic operations within the user ...
mentallurg's user avatar
  • 12.4k
1 vote

Can plugins for text editors and IDEs be malicious?

Plugins affect the way that the software behaves. So, it would be possible to write a plugin to do something malicious. And it's not just IDEs or text editors, but browsers or any software that allows ...
schroeder's user avatar
  • 129k
1 vote
Accepted

Why request and response calls in my burp suite python plugin come in such random order?

Requests are processed asynchronously in Burp, so every time the browser makes a new HTTP request it'll trigger your script. You cannot switch this behaviour off (it's integral to Burp's proxy engine) ...
Polynomial's user avatar
  • 135k
1 vote

How can I programatically keep track of number of certificate warnings in browser?

I'm unsure of a easy browser add on but there are web content inspection systems that should be able to count this for you in logs. You would then consolidate and perform counts on the logs if it's ...
SCIS Security's user avatar
1 vote
Accepted

Plugins to increase security of Chrome?

I am not sure this is the place for this question. Maybe refer to SuperUser but... I use uBlock Origin. It is a highly customizable tool for ad blocking, malicious site blocking and much more. It ...
MiaoHatola's user avatar
  • 2,304
1 vote

Plugin / extension security practices

This is a question of trust, and I would argue that this it is more of a social than a technological problem. Sure, there are technical solutions (like only giving access to a limited scripting ...
Anders's user avatar
  • 65.6k
1 vote

Plugin / extension security practices

If you want to allow plugins, the only realistic methods to keep the parent application secure are: Review the code Only permitting submissions that can be reviewed and putting in place sufficient ...
Julian Knight's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible