Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
7

As inefficient as it sounds, that's exactly how it works. Head on over to google.com, bring up your developer tools in your browser (CTRL+SHIFT+I or CTRL+OPTION+I in Chrome), click the network tab, and then start typing in the search box. You'll see a series of GET requests to to the /complete/search url path, like this: https://www.google.com/complete/...


7

HTML 5 local storage check allows you to reliably detect private browsing mode now (2019). It works by attempting to write then read "Local Storage". see: https://gist.github.com/jherax/a81c8c132d09cc354a0e2cb911841ff1 or https://github.com/jLynx/PrivateWindowCheck with PoC


4

The only thing to know when coding an application is that you should not trust the client. This being said, all calculations that you do client-side need to be checked and sanitized by the server. If everything is properly sanitized, then you do not need to block something on the browser. Furthermore, let's say that you use a Javascript function ...


4

I see there's a bounty because you want a more precise and up-to-date answer, but the truth is that the right answer was already given by others. I can just give you a few more details, even though I'm not a JS developer and I've never known how this stuff works either. The short answer is: they use JavaScript to implement some kind of heuristics that ...


2

If using asymmetric encryption from openpgp.js, the private key is stored encrypted by default and then briefly decrypted to decrypt or sign a message with the users passphrase. It is never stored un-encrypted and relies on the user remembering the passphrase he used to create the key pair. In this case even if the hacker found the private keys they are ...


2

Another possible scenario is that a MITM replaces an image with one that exploits an RCE (remote code execution) vulnerability in the user's browser. Here's an example of such vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2017-2416 --basically you can serve a crafted image containing executable code and have that code executed on older versions of ...


1

I'm already authenticated when I log in and I can view all other courses, so I don't know why just this one particular course requires this change but not any of the others (even newer ones). We could conjecture that people "share" this video out to friends more often than others, thus triggering increased scrutiny of viewers from their end. You'd have ...


1

It's virtually impossible to do this on your own. There are dozens of fingerprinting vectors that can be used to detect the operating system you are running or uniquely identify a browser, and sometimes even your individual hardware irrespective of the OS you use. Paradoxically, any changes you make to your browser configuration actually make this worse. In ...


1

A possible scenario for Case 4 is one where a MITM replaces an image with one that exploits an RCE (remote code execution) vulnerability in the user's browser. Here's an example of such vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2017-2416 --basically you can serve a crafted image containing executable code and have that code executed on older ...


1

Another reason why warning about mixed content is a good idea is that a MITM can replace an "insecure" image with one that exploits an RCE (remote code execution) vulnerability in the user's browser. Here's an example of such vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2017-2416 --basically you can serve a crafted image containing executable ...


Only top voted, non community-wiki answers of a minimum length are eligible