157
votes
Accepted
Should I contact the manufacturer if their product allows access to other users' location information?
Yes, you should notify the problem to the company - with caution.
Update: a shorter, very complete answer was supplied by @crovers. But if you have patience...
...the problem here is not simply the ...
- 23k
146
votes
Accepted
Can I safely preview a short link?
Most of the link shortening providers also offer a possibility to preview the URL a short link will redirect to. Most times, it is sufficient to modify a little detail of the short link:
Bitly
Add a + ...
- 1,703
121
votes
Can secret GET requests be brute forced?
You are essentially asking if it is safe to pass secret parameters in a GET request. This is actually classified as a vulnerability. It is not feasible to brute force a sufficiently long pseudorandom ...
- 67.3k
114
votes
Should I contact the manufacturer if their product allows access to other users' location information?
Yes. They ought to be using a long, unguessable string instead of a predictable, short one.
I would consider this a security flaw that is relatively simple for them to fix.
However, I would caution ...
- 6,391
89
votes
Accepted
In SQL injections why do they put "-- -" at the end of the URL?
The last dash basically protects the trailing space. If you exploit SQL injection in a browser (e.g. via the URL), some browsers remove trailing space characters. Some prominent SQL flavors explicitly ...
- 7,545
84
votes
Accepted
What attacks are made possible by public release of my web history?
Your question might be more undefined than you realise. Any kind of data can be passed using URL parameters. Usernames, passwords, authentication tokens, settings, form data, or anything the web ...
- 132k
70
votes
Accepted
Are Cyrillic characters a real threat?
Cyrillic characters by themselves are not a threat. There are whole nations which use these characters without additional risks.
The problem is when characters look similar to others, since these then ...
- 208k
68
votes
Accepted
Security risks of fetching user-supplied URLs
This particular vulnerability indeed has a name. It is called Server-Side Request Forgery (SSRF). SSRF is when a user can make a server-side application retrieve resources that were unintended by the ...
- 13.2k
51
votes
Can ISPs selectively block a page URL on a HTTPS website leaving its other page URLs alone?
No, the ISP cannot block specific HTTPS protected pages because it cannot determine which page is being accessed.
HTTPS does not hide the server that is being accessed, because it needs the SNI (...
- 55.5k
48
votes
Accepted
Is there any security benefit from emailing a "secure link"?
It provides some benefits in that the sensitive contents are stored on the server, rather than in the body of the email. This means that the link can be revoked to block access (for example, if the ...
- 16.5k
45
votes
Browser is accepting italic/bold Unicode as part of SPAM email's URL
Previous answers both tell part of the story here, but there's a few different aspects to understand.
Firstly, why do these code points exist? Unicode has the ambition to replace all previous ways of ...
- 3,920
43
votes
Should I contact the manufacturer if their product allows access to other users' location information?
To add to the other answers - be aware of the risks of reporting the problem yourself:
If you're inexperienced with reporting security issues, you might come across to them as dodgy and potentially ...
- 45.1k
43
votes
Accepted
Could receiving a URL link, not clicking on it, ever pose a security problem?
Many browsers send "pings" to any links on a page by performing a DNS query on them to populate the cache. This makes clicking the link faster because the IP is already in the DNS cache. In ...
- 67.3k
36
votes
Could receiving a URL link, not clicking on it, ever pose a security problem?
Some software will automatically fetch any URL it sees, even if you don't click it. A few examples:
Browsers that are configured to pre-fetch certain URLs so that they load instantly after clicking (...
- 52.1k
34
votes
Can secret GET requests be brute forced?
This is a common approach to share public things restricted to the ones who know the URL. An example is Google Docs:
The second option, "Anyone with the link", creates a link similar to yours. Same ...
- 9,088
32
votes
What attacks are made possible by public release of my web history?
Quite a bit actually:
Extortion based off content
Mapping systems that are not public
Sensitive parameters in certain requests
Personal information
Extortion
That search of yours that may be ...
- 3,270
32
votes
Security risks of fetching user-supplied URLs
We store the URL instead of the image.
In addition, this will add information and privacy risks. Let me show with a visual demo.
If you try to upload any image to StackExchange, you will notice that ...
- 5,418
30
votes
Accepted
What's a "safe" URL shortening algorithm?
Entropy is your friend. Using only alphanumeric characters (special characters are best avoided in this case because they often need URL encoding, which complicates things) you have a "language&...
- 31.7k
29
votes
Are Cyrillic characters a real threat?
As you say, most browsers will display punycode URLs, so that something like http://exаmple.org will be displayed as http://xn--exmple-4nf.org.
However, there are cases where an attacker may be able ...
- 16.5k
28
votes
Security risks of fetching user-supplied URLs
Instead of uploading an image, the user can provide the (self-hosted) URL of an image. We store the URL instead of the image.
You mean these kind of JPEGs?
It is a bad idea. First of all, you will ...
- 2,180
26
votes
Accepted
Generating one time URLs which can be revoked
Looks like you have a pretty good idea what you're doing.
The one-time link pattern is pretty common for things like email verification. Typically, you'd store the expiration date in a database and/...
- 4,028
26
votes
Accepted
Browser is accepting italic/bold Unicode as part of SPAM email's URL
What you have here are mathematical symbols, see output from unicode text analyzer:
Browser
Codepoint
Name
# Fonts
Script
𝙪
U+1D66A
MATHEMATICAL SANS-SERIF BOLD ITALIC SMALL U
12
Common
𝙯
U+1D66F
...
- 208k
25
votes
Accepted
Is it possible to sniff HTTPS URLs?
TL;DR An attacker cannot see anything past the domain.
Structure of a HTTP request
HTTP works by sending two things to a website: the method, and the headers. The most common methods are GET, POST, ...
- 67.3k
25
votes
Should a bank/financial service use external URL shortener services?
Is it better for a bank/financial service to host this sort of short link to long link translation service on their own domain and infrastructure?
I think the question contains the answer. For me, ...
- 8,465
23
votes
Should I contact the manufacturer if their product allows access to other users' location information?
If I were you, I would say something like
Hello,
I have mistyped my ID (e.g. 12345) and pressed enter instead of backspace,
and I was dumbfounded to find that the page loaded and found
the location ...
- 433
23
votes
Accepted
Is a plain password in the URL a potential security threat?
This is a serious security problem. URLs should never contain sensitive information.
URLs show up in your browsing history. So even after logging out it will be trivial to access your account for ...
- 45.1k
22
votes
Can ISPs selectively block a page URL on a HTTPS website leaving its other page URLs alone?
Just for completeness, there are actually ways to achieve this, but they are usually the work of totalitarian regimes who want to eavesdrop on everyone's conversations and/or block content not ...
- 3,865
21
votes
Accepted
How to defend against homograph attacks?
Browser vendors already try to protect you from homograph attacks by enforcing policies how IDNs (Internationalized Domain Names) should be displayed in the URL bar.
Their measures include ...
- 45.1k
20
votes
Can secret GET requests be brute forced?
Bad idea. A number of times I have seen a "secret" URL very quickly getting search engine crawler hits, and then discoverable by web search. Once I even saw someone set up a copy of a reputable ...
- 588
Only top scored, non community-wiki answers of a minimum length are eligible