23

So if I wish to open "any" site on a new tab while doing my online shopping, is it safe The same origin policy should prevent other sites from accessing your data in the online shopping site. That is assuming that the shopping site has no vulnerabilities that leak data (CSRF, XSS, XSSI, broken CORS, broken messaging, etc.). Having only one tab ...


8

The only useful thing about your routine is cleaning the cookies. It's not useful in itself, it is just that, this way, you delete your login session and so a new login (which requires inputting a secret like a password) is required to interact with the shopping site. A better alternative (in terms of your user experience and security) would be logging out ...


8

"Usually I just close the ad" Well, you think you closed the window. What you did was click on something, which permitted the download. Most everyone just looks for the little "X" to close the window. The scammers know this and manipulate what looks like a window so that you actually click a download button.


4

When an element is clicked, the link is followed and its URL is resolved. This causes the string to be processed by the basic URL parser. In your example, the parameter is processed in the path state during which TAB (U+0009) characters, along with carriage return and line feed characters, are ignored, and therefore do not form part of the resolved URL.Why ...


3

Given a site can use browser fingerprinting methods, there no tool that would completely cover everything. The paradox is that the more you try to make your browser look like something it isn't, the more unique it becomes. You can use tools like Panopticlick or AmIUnique to investigate your current browser. Therefore, even with Tor, it's better to use the ...


3

I found an old discussion that you might find interesting for understanding the possible historical reasons behind this choice. https://bugzilla.mozilla.org/show_bug.cgi?id=87298 That's a 19-year-old bug in Mozilla. The problem was that one website was not working as expected, because Mozilla didn't strip tab characters inside the URL in a link. The page ...


2

I do this to ensure any other websites that I open on new tab does not sneak into my credit card information. Is this even possible or just a myth? That is simply not possible, because the browser doesn't allow such a request due to the same origin policy without the website explicitly stating it in their CORS headers; apart from that, credit card info isn'...


2

Numerous public CAs have multiple root certificates in trust store for different reasons and largely depends on their business operations. Often roots from same vendor differ by: List of usages Public key or signature algorithm support Assurance level Redundancy For example, Amazon Root CA 2 and Amazon Root CA 4 allows Code Signing certificates in their ...


1

Installing malware through websites is not as common as you seem to think. The malicious website needs to exploit a vulnerability in your browser which permits to get root access (quite uncommon). So, as far as your browser is up to date, only the 0days (rare) could affect you. But, even with less privilege, the malicious website could still tamper the ...


1

You are assuming that distinguishing yourself from the others will only be done if Javascript is enabled. But, assuming that all but you have Javascript enabled , exactly disabling Javascript might result (depending on the site you visit) in a behavior which is clearly different from the other users. Apart from that there are HTML features like responsive ...


1

Fingerprinting is a cat and mouse game. Trackers are always finding new undocumented features that respond differently on each system, and browser makers always closing them as soon as they can. That's the "quickly becoming obsolete" part. That means it does not work anymore? Not at all. It's that older fingerprinting tricks (those ancient ones ...


1

There is already a grace period build in. To cite from digicert: ... Apple announced that beginning Sept. 1, newly issued publicly trusted TLS certificates are valid for no longer than 398 days. Thus, this is only about certificates issued after Sept. 1. and it does not affect already issued certificates. This also means that there is nothing to worry ...


1

This Python script uses the Thunderbird/Firefox libraries to read the passwords stored in the logins.sqlite or signons.sqlite files from your profile folder. It prompts you for your master password, which you can leave empty if didn't use one.


Only top voted, non community-wiki answers of a minimum length are eligible