4

Is there any way to access the contents of a cross domain iframe Not programmatically (see below for another approach), as the same origin policy will not allow this. If it did, that would be cause for alarm, not just in your situation. An attacker could steal CSRF tokens and perform arbitrary actions, read all data the user has access to, etc. I found ...


3

tl/dr: Just let flash die. Adobe officially announced the End-of-Life for Flash a while back. It will officially be EOL at the very end of this year (2020). This means that there will no longer be new or updated flash players after that. Given the long history of dangerous flash vulnerabilities, using unpatchable software with a history of dangerous bugs ...


2

With form-based auth, how does the browser know which HTML page contains fields for credentials, and how does it know which fields to look for? The browser does not know and the browser does not need to know. The server is sending a HTML document with a form and which form fields have which kind of meaning is known to the server. The browser is just ...


2

How the "Share Your Location" button works depends on your browser. In Google Chrome, for example, this sends information from Google Location Services giving your best estimated position. Your position can be determined in many ways, including: Your GPS location Your IP address geolocation Nearby wifi access points (Google scrapes access point data with ...


2

You assume that IP provides accurate location. It doesn't. IPs might narrow down the city, unless you are using a VPN or tunneling to a remote corporate network, for instance.


2

In case you already have a <keygen>-based setup and want to keep using it, I created a project which attempts to implement a JavaScript polyfill for <keygen>: https://github.com/CyberShadow/keygen.js


1

Cookies with a MUST of "httponly" and "secure" attributes are the only secure way forward. This is because in a scenario of a XSS (Cross Site Scripting) attack LocalStorage or the DOM data can be easily read by the attacker. If you define a cookie with httponly tag Javascript can't access that value, preventing XSS attacks. https://developer.mozilla.org/en-...


1

As of March 2020, it seems that it is still possible for sites to detect whether or not Firefox is running in private mode, based on the fact that IndexedDB does not function when Firefox is running in private mode. There are a number of mainstream media outlets that seem to be using the technique to block users from browsing their site in private mode, or ...


1

Public keys of certificate authorities are stored locally for every applicatives on the system. For example, on Debian GNU/Linux: $ dpkg -l|grep -i ca-certificates ii ca-certificates 20190110 all Common CA certificates ii ca-certificates-java 20190909 all ...


Only top voted, non community-wiki answers of a minimum length are eligible