137

Can you explain why browser security should be placed on the top priority ... Because the browser is processing lots of untrusted content from the internet. Of course, if you use any other programs which does this (like Mail client, maybe Office program, PDF reader) you should keep these updated too since vulnerabilities in these programs are a regular ...


119

Technically, browsers do not have to ask the user a question in order to use cookies. Furthermore, they are not technically bound to the answer given by the user. Legally, that is another matter. In the European Union, the websites are now required to ask the user for their consent before using tracking cookies or other means to collect personal data about ...


112

No, it's not dangerous at all. Your browser is warning you because a non-Paypal website has Paypal in its name. This is a common technique used by phishing sites that attempt to fool you into thinking the site is official. For example, a website might be called paypal.secure1234.com and made to look like the official site, enticing you to trust it and input ...


101

The standard is designed to be safe. The implementation may not be. The browser isolates JavaScript, as it executes within a browser process itself. It cannot do anything which is not permitted by the browser JavaScript interpreter or JIT compiler. However, owing to its complexity, it's not at all uncommon for vulnerabilities to be found that allow ...


84

Your question might be more undefined than you realise. Any kind of data can be passed using URL parameters. Usernames, passwords, authentication tokens, settings, form data, or anything the web developer chooses. It's not always good practice to use URL parameters to for this, but it is always possible. And it's entirely up to each individual web ...


79

A malicious website could harm you without you having to click on anything. However, the fact that the user clicked on a page element simplifies the task: for example, most browsers would automatically block unsolicited popus (which can e.g. trick users into installing malware), but allow a popup in response to a click. And yes, in my opinion, a ...


79

Do not use an outdated OS, even with a modern browser. Assuming that after that day I still use an updated browser, is it true that I'm still safe? No, you cannot avoid browser-based security holes only by updating the browser. There are a few reasons for this. Primarily, the browser is not entirely self-contained. It makes use of operating system ...


68

Interesting question! I just so happen to have a browser full of test certs, and a number of test sites to connect to! Let's test this! (Skip to the bottom for a summary) Investigation Testing on Firefox Firefox loaded with certs, a test site that requires a TLS client cert, Wireshark. I restarted Firefox to get a clean session. Then I entered the URL ...


58

This is a typical false positive. Since Firefox is using Google safe browsing API, it will show similar warning as in Chrome browser. Since some antivirus also use the API, it will be warned by those antivirus as well. Here is the Google safe browsing transparency report. Somebody needs to file an incorrect phishing warning to google to remove the ...


48

How is it safe? It is not. Or more exactly it is as safe as the browser implementation is. Browsers (including their JavaScript engine) are complex pieces of software, with regular addition of new features - because users want them. That means that, even if well-known ones certainly have quality procedure to test their code against known vulnerabilities, ...


36

Using eval in this context doesn't create any vulnerability, as long as an attacker can't interfere with the arguments passed to matchCondition. If you find it easier to read / program it this way, and you're confident that no untrusted input will ever go into your expression compiler, then go for it. eval isn't evil, untrusted data is. Please note that ...


32

An XSS attack is not primarily about cookies. It is not about stealing sensitive data either. It is instead about executing attacker-controlled code on the client side within the context of the site you visit. What kind of harm can be done by this code depends on the actual site and context. Using a private browsing session will not prevent XSS by itself ...


32

Quite a bit actually: Extortion based off content Mapping systems that are not public Sensitive parameters in certain requests Personal information Extortion That search of yours that may be embarrassing and taken out of context. A WebMD search for a medical condition you don't want made known to co-workers for example. A search that was best done in ...


32

Today, everything is written by developers. Next month or next year, someone will say "hey, why not let the users write those themselves?" Bam. Also, even if the rules are written by the developers only, do they or will they include any user-originated data? Something like titles, names, categories, for instance? This could quickly lead to an XSS attack. ...


26

Modern browser extensions use the WebExtensions API, which enforces a permission model; basically, addons can only have the access that you grant them (you can't reject individual permissions though; if you are uncomfortable with some, you can't install the addon). Regarding your specific questions: The browser history can only be requested if the history ...


21

Not all the websites you visit have certificates. You can’t smell fishy websites. Certificate doesn’t mean the site isn’t trying to hack you. The browser is the biggest attack vector against your computer. It will tend to run unvetted JavaScript code at least, and god knows what else. It constantly processes data from untrusted sources.


19

It's true that at the JavaScript level the browsers are designed to sandbox the code under execution (primarily by not exposing any dangerous API), but JavaScript is a very complex language to parse and execute. ECMAScript is the standard behind JavaScript, due to the huge marketing inflation around beginner-friendly programming languages we are ...


18

Each of your statements is making a false assumption here: Most of the websites I visit have SSL certificate. This is great, but SSL/TLS only protects you against certain types of attacks. Pretty much, a site having a (valid) TLS certificate simply means that the owner of that website has in some way proven ownership of the domain name that is used to ...


16

One of the threats I'd like to mention that has not been named yet is de-anonymization. The URIs in your history could leak information about your user accounts on different sites - for instance if you constantly check your own profile on social media sites. If you use some web services anonymously and others under your real name (Facebook, Twitter) an ...


15

On eu-store.wacom.com, some images from their Amazon CDN are requested over http instead of https. This can be solved by installing HTTPS Everywhere and turning on "Encrypt All Sites Eligible": The gray padlock means all resources are served securely. So the webstore is most likely not compromised. They are still using an outdated cipher based on CBC and ...


12

With recent regulations around data privacy, websites are asking for express permission from users to collect their info from cookies. Cookies do not harm PCs. The data collected from cookies could conceivably be used in ways that users do not like (Cambridge Analytica comes to mind). Those interested in more private and more anonymous browsing would want ...


12

One benefit of the newer operating systems, like Windows 10 over Windows 7, is that they have more advanced features built in to the operating system to protect against entire classes of vulnerabilities. There have actually been examples of web browsers being more secure on Windows 10 than Windows 7 even though Windows 7 is still supported! See for example ...


9

HTML 5 local storage check allows you to reliably detect private browsing mode now (2019). It works by attempting to write then read "Local Storage". see: https://gist.github.com/jherax/a81c8c132d09cc354a0e2cb911841ff1 or https://github.com/jLynx/PrivateWindowCheck with PoC ------ edit to add functional description ---- From the jherax link ...


9

As stated in other answers, each browser has its own script engine that is designed to sandbox JavaScript execution and each engine attempts to limit JavaScript functionality that could lead to malicious behavior. But as a rule JavaScript has never been safe within the browser. Malicious code developers are constantly finding ways to exploit how each ...


9

how does chrome/firefox make sure addons are safe? They inspect them before publishing, and ban those found abusing its rights. But this ban can take from days to weeks. how much access can addons have? Addons can make anything you can, and more. They can access any server, read any cookie, alter any data, even encrypted by HTTPS, and send any data ...


8

~4 sources that will make you think twice about the security of AV TLS decryption: Antivirus Software Weakens HTTPS Security: Researcher “It seems strange that it turned into something people consider a legitimate security technology. Filtering should happen on the endpoint or not at all. Browsers do a lot these days to make your HTTPS connections ...


8

Since nobody pointed this out yet: Anti virus software is way less useful than you think. In fact, if you ask security professionals, the main recommendation to stay safe will be to update all your software, above the recommendation to run an AntiVirus - so exactly what you're planning not to do. Why? All that anti virus software does is stop known, old ...


8

JavaScript is pretty powerful It is which is why many users consider it unsafe and block it using browser extensions. JavaScript allows websites to track users in ways not possible without it including identifying users after they have deleted their cookies by fingerprinting the browser. Many of the newer web APIs like WebUSB allow things that are not at ...


8

My questions are, why is this inconsistency happening This is known as mixed-content,where the page is loaded with HTTPS,while some parts(images) are loaded via Insecure HTTP. how can I verify that the store page is indeed wacom's As long as your system has not been compromised then the only way is to use HTTPS everywhere and visit the correct URL or ...


7

Yes, but not more than any other button or link. The main concern is clickjacking. Somebody who knows exactly where you will click can try to move another click target at this position in the moment you are clicking, so you may for example click "delete my account" on another site opened in an iframe. Furthermore clicks sometimes unlock more permissions, e....


Only top voted, non community-wiki answers of a minimum length are eligible