79

Do not use an outdated OS, even with a modern browser. Assuming that after that day I still use an updated browser, is it true that I'm still safe? No, you cannot avoid browser-based security holes only by updating the browser. There are a few reasons for this. Primarily, the browser is not entirely self-contained. It makes use of operating system ...


69

Resources are cached by their URL, and the protocol (http:// or https://) is part of the URL. Since the protocol differs, the URL must also differ, and you have two separate cache entries.


61

Any extension that has access to the DOM can read whatever is written to the console by intercepting calls. The console is a JavaScript object; it is simple to proxy calls to console.log, like this example from zzzzBov on Stack Overflow: (function () { var log = console.log; console.log = function () { log.call(this, 'My Console!!!'); log.apply(...


53

Yes, DOM-based XSS is still a concern. While some issues cannot be exploited due to URL encoding, there a number of situations where URL encoding will not stand in the way of exploitation. The gist of the example is to form a hashbang query with injection That's one example, but DOM-based XSS encompasses all XSS issues that result from insecurely ...


46

It is perfectly fine if a http:// and a https:// resource provide different data, even if everything but the access method is the same. For example access to http:// will today often result in a redirect response while access to https:// provide the real content. A browser will therefore cache these resources independent from each other.


43

In many jurisdictions, school districts are legally required to have web filtering in place. Google & Bing are two examples of companies who's "Safe Search" API has been around and stable for some time now. While DuckDuckGo does have Safe Search abilities, your client's web filtering vendor may not have had the time/motivation to add it into their ...


38

One thing Firefox Focus uses this embedded web server for is to detect whether Safari Content Blocking rules were successfully enabled. It seems from this answer and the Focus source code that iOS 10 provides an API for determining whether a Safari Content Blocking extension is enabled, but that in iOS 9 there wasn't such an API. Instead, it was necessary to ...


37

Using eval in this context doesn't create any vulnerability, as long as an attacker can't interfere with the arguments passed to matchCondition. If you find it easier to read / program it this way, and you're confident that no untrusted input will ever go into your expression compiler, then go for it. eval isn't evil, untrusted data is. Please note that ...


31

Today, everything is written by developers. Next month or next year, someone will say "hey, why not let the users write those themselves?" Bam. Also, even if the rules are written by the developers only, do they or will they include any user-originated data? Something like titles, names, categories, for instance? This could quickly lead to an XSS attack. ...


18

The Connection is secure badge is in respect to the information transmitted via the network / internet. As you correctly observed, the file:// protocol uses no network connection, neither a mechanism to secure the same (because there is none), hence the badge absent. Note that the browser does not label the file:// protocol as insecure. The browser simply ...


15

On eu-store.wacom.com, some images from their Amazon CDN are requested over http instead of https. This can be solved by installing HTTPS Everywhere and turning on "Encrypt All Sites Eligible": The gray padlock means all resources are served securely. So the webstore is most likely not compromised. They are still using an outdated cipher based on CBC and ...


13

One benefit of the newer operating systems, like Windows 10 over Windows 7, is that they have more advanced features built in to the operating system to protect against entire classes of vulnerabilities. There have actually been examples of web browsers being more secure on Windows 10 than Windows 7 even though Windows 7 is still supported! See for example ...


10

HTML 5 local storage check allows you to reliably detect private browsing mode now (2019). It works by attempting to write then read "Local Storage". see: https://gist.github.com/jherax/a81c8c132d09cc354a0e2cb911841ff1 or https://github.com/jLynx/PrivateWindowCheck with PoC ------ edit to add functional description ---- From the jherax link ...


9

If the enterprise considers search engines which aren't Google and Bing "untrustworthy" for some reason (e.g., because they believe they are more likely to intentionally or unintentionally disclose search history to third parties), it makes sense to block them. Your search history at work can reveal internal information about the company, two ways off the ...


8

My questions are, why is this inconsistency happening This is known as mixed-content,where the page is loaded with HTTPS,while some parts(images) are loaded via Insecure HTTP. how can I verify that the store page is indeed wacom's As long as your system has not been compromised then the only way is to use HTTPS everywhere and visit the correct URL or ...


8

Summary: The primary cache key for any standards-compliant browser is an absolute URI The absolute URI begins http: for all insecure requests and https: for all secure requests Consequently, a resource fetched securely can never use the same cache key as a resource fetched insecurely The current standard for HTTP is split across multiple "RFC" documents, ...


8

Not sure whether Firefox Focus actually does this, but some mobile adblockers have a built-in internal web server which answers requests by serving empty content (zero byte text files, 1x1 GIFs, etc). The adblocker redirects blocked requests to this internal server. This generally results in rendered web pages showing nothing instead of the ad, whereas ...


7

As inefficient as it sounds, that's exactly how it works. Head on over to google.com, bring up your developer tools in your browser (CTRL+SHIFT+I or CTRL+OPTION+I in Chrome), click the network tab, and then start typing in the search box. You'll see a series of GET requests to to the /complete/search url path, like this: https://www.google.com/complete/...


6

Oh goodie a surface area question. The surface area of attacks against the OS via the browser varies wildly with the browser. With Internet Explorer, the surface area is vast. On the other hand, Firefox mostly uses its own decoders for everything, crushing the surface area down to only a few pieces. In any case, the TCP stack, DNS, and the font rendering ...


6

I see there's a bounty because you want a more precise and up-to-date answer, but the truth is that the right answer was already given by others. I can just give you a few more details, even though I'm not a JS developer and I've never known how this stuff works either. The short answer is: they use JavaScript to implement some kind of heuristics that ...


6

First of all, good job on choosing Firefox and the right plugins, it's really the browser to go privacywise. To extend upon the points that nobody mentioned yet, an important part of you hardening your browser would be the configuration of your Firefox browser! You can do that by typing about:config into the address bar and accepting the risks. Then you ...


5

Appearances and expectations If something looks like a safe expression, people will probably treat it like one. If a field looks like any other data-field, people (even developers) will probably put untrusted data in there. If something is evaluated with full level application access, it should look and feel like code. Another problem are subtle bugs in ...


5

On eu-store.wacom.com, some images from their Amazon CDN are requested over http instead of https Let me continue from that. Firefox says it's not 100% secure because it's loading unprotected content. I would say, naively... it's 95% secure Now, it doesn't mean the site wacom.com is not legitimate, but perhaps misconfigured. If you buy today from that site,...


5

There's really no good reason to block them. Search engines only return content based on their algorithm. It could be that they are blocking on a predefined firewall vendor list by categories where DuckDuckGo is categorized differently. There have been attacks where using SEO a malicious actor has put his site above a legitimate one in the search results, ...


5

Not very well. In theory, the system should work. In practice, it doesn't. The implementations intended to manage revocation - namely CRL and OCSP - both have problems. Most of this answer is based on this article by Alexey Samoshkin, as well as this article by Scott Helme. What about CRLs? A certificate revocation list is a remarkably simple way of ...


5

Once someone has access to your computer then can get absolutely everything you have access to. If this was not possible, then you would not be able to do those things either. The way to avoid this is to not give someone access to your computer or your logged in session on the computer. Log out and have them log into another user.


4

This felt creepy and made me think how Opera browser can do this? Consider how session cookies are stored. It's stored on disk, as a database of some sort. In Chrome, it appears to be a sqlite database, which is readable by any program running as your user. The same goes for bookmarks and other user data; it's stored in some form on disk. Accessing it is ...


4

There are some potential benefits of using <a ping>, but they are not unique to <a ping>. It is not outside the realm of possibilities that the attackers simply chose any working method to trigger network requests. <a ping> works when JavaScript is disabled. But in this case the attack started with JavaScript. Even if JavaScript were to be ...


4

The only thing to know when coding an application is that you should not trust the client. This being said, all calculations that you do client-side need to be checked and sanitized by the server. If everything is properly sanitized, then you do not need to block something on the browser. Furthermore, let's say that you use a Javascript function ...


4

The answer is in your warning: found that it is malicious. When a malevolent person creates a malicious pdf, (s)he wants as many victims as possible. So , adding a wagon-load of keywords attracts readers (you in this case), and therewith possible infected computers.


Only top voted, non community-wiki answers of a minimum length are eligible