137

Can you explain why browser security should be placed on the top priority ... Because the browser is processing lots of untrusted content from the internet. Of course, if you use any other programs which does this (like Mail client, maybe Office program, PDF reader) you should keep these updated too since vulnerabilities in these programs are a regular ...


119

Technically, browsers do not have to ask the user a question in order to use cookies. Furthermore, they are not technically bound to the answer given by the user. Legally, that is another matter. In the European Union, the websites are now required to ask the user for their consent before using tracking cookies or other means to collect personal data about ...


112

No, it's not dangerous at all. Your browser is warning you because a non-Paypal website has Paypal in its name. This is a common technique used by phishing sites that attempt to fool you into thinking the site is official. For example, a website might be called paypal.secure1234.com and made to look like the official site, enticing you to trust it and input ...


108

It increases dialog box fatigue. By overflowing the user with mundane dialog boxes, they are more likely to get into the habit of just clicking OK to remove the dialog box from their screen. This increases the risk of a user clicking OK on some important security decision presented in a dialog window.


99

The standard is designed to be safe. The implementation may not be. The browser isolates JavaScript, as it executes within a browser process itself. It cannot do anything which is not permitted by the browser JavaScript interpreter or JIT compiler. However, owing to its complexity, it's not at all uncommon for vulnerabilities to be found that allow ...


84

Your question might be more undefined than you realise. Any kind of data can be passed using URL parameters. Usernames, passwords, authentication tokens, settings, form data, or anything the web developer chooses. It's not always good practice to use URL parameters to for this, but it is always possible. And it's entirely up to each individual web ...


79

A malicious website could harm you without you having to click on anything. However, the fact that the user clicked on a page element simplifies the task: for example, most browsers would automatically block unsolicited popus (which can e.g. trick users into installing malware), but allow a popup in response to a click. And yes, in my opinion, a ...


79

Do not use an outdated OS, even with a modern browser. Assuming that after that day I still use an updated browser, is it true that I'm still safe? No, you cannot avoid browser-based security holes only by updating the browser. There are a few reasons for this. Primarily, the browser is not entirely self-contained. It makes use of operating system ...


68

Interesting question! I just so happen to have a browser full of test certs, and a number of test sites to connect to! Let's test this! (Skip to the bottom for a summary) Investigation Testing on Firefox Firefox loaded with certs, a test site that requires a TLS client cert, Wireshark. I restarted Firefox to get a clean session. Then I entered the URL ...


58

This is a typical false positive. Since Firefox is using Google safe browsing API, it will show similar warning as in Chrome browser. Since some antivirus also use the API, it will be warned by those antivirus as well. Here is the Google safe browsing transparency report. Somebody needs to file an incorrect phishing warning to google to remove the ...


52

As pointed out in comments and answers, there are plenty of legitimate reasons why you would want to add a CA to your browser's trust store, and the mechanisms for doing this require admin access to the machine / browser. You're implying a trust model where you don't consider your administrator (or past you) to be trustworthy and would like the browser to ...


48

How is it safe? It is not. Or more exactly it is as safe as the browser implementation is. Browsers (including their JavaScript engine) are complex pieces of software, with regular addition of new features - because users want them. That means that, even if well-known ones certainly have quality procedure to test their code against known vulnerabilities, ...


40

Subresource integrity is not about protecting your own code of the web application against modification. What SRI is intended to do can be seen from the description of the goals: Compromise of a third-party service should not automatically mean compromise of every site which includes its scripts. Thus, it is about protecting your use of resources ...


32

An XSS attack is not primarily about cookies. It is not about stealing sensitive data either. It is instead about executing attacker-controlled code on the client side within the context of the site you visit. What kind of harm can be done by this code depends on the actual site and context. Using a private browsing session will not prevent XSS by itself ...


32

Quite a bit actually: Extortion based off content Mapping systems that are not public Sensitive parameters in certain requests Personal information Extortion That search of yours that may be embarrassing and taken out of context. A WebMD search for a medical condition you don't want made known to co-workers for example. A search that was best done in ...


30

What you want is to have the browser defend the user against "attack" performed by local administrator. In such scenario, defense is impossible. The "malicious" admin can always substitute your legit Firefox for an impostor he compiled using his own CAs, that will display green padlock. When you're at work and you're using someone's machine (company's in ...


26

Modern browser extensions use the WebExtensions API, which enforces a permission model; basically, addons can only have the access that you grant them (you can't reject individual permissions though; if you are uncomfortable with some, you can't install the addon). Regarding your specific questions: The browser history can only be requested if the history ...


23

Let's say you have a site built around jQuery. You don't download jQuery and use your copy, but you use a version from a CDN, making use of the caching on client's browsers. That works because if one site uses the CDN version, it will be cached and every site that uses the same version will benefit, not having to download an identical file every time. One ...


21

Not all the websites you visit have certificates. You can’t smell fishy websites. Certificate doesn’t mean the site isn’t trying to hack you. The browser is the biggest attack vector against your computer. It will tend to run unvetted JavaScript code at least, and god knows what else. It constantly processes data from untrusted sources.


19

This form effectively gave all websites a valid excuse to interfere with browsing until the user clicks on something. This is indeed a bad thing: browsers have gone a long way protecting the user from malicious websites by limiting the actions that can be performed without clicking (like blocking pop-ups which are not a response to a click). Once the users ...


18

Each of your statements is making a false assumption here: Most of the websites I visit have SSL certificate. This is great, but SSL/TLS only protects you against certain types of attacks. Pretty much, a site having a (valid) TLS certificate simply means that the owner of that website has in some way proven ownership of the domain name that is used to ...


18

It's true that at the JavaScript level the browsers are designed to sandbox the code under execution (primarily by not exposing any dangerous API), but JavaScript is a very complex language to parse and execute. ECMAScript is the standard behind JavaScript, due to the huge marketing inflation around beginner-friendly programming languages we are ...


16

One of the threats I'd like to mention that has not been named yet is de-anonymization. The URIs in your history could leak information about your user accounts on different sites - for instance if you constantly check your own profile on social media sites. If you use some web services anonymously and others under your real name (Facebook, Twitter) an ...


12

With recent regulations around data privacy, websites are asking for express permission from users to collect their info from cookies. Cookies do not harm PCs. The data collected from cookies could conceivably be used in ways that users do not like (Cambridge Analytica comes to mind). Those interested in more private and more anonymous browsing would want ...


12

One benefit of the newer operating systems, like Windows 10 over Windows 7, is that they have more advanced features built in to the operating system to protect against entire classes of vulnerabilities. There have actually been examples of web browsers being more secure on Windows 10 than Windows 7 even though Windows 7 is still supported! See for example ...


9

Because the official list changes over time. Because enterprises have a legitimate need to include "Internal" CAs. Because enterprises have a legitimate interest in being able to Man-in-the-Middle for security, compliance, or HR purposes. Because developers and testers have a legitimate need to Man-in-the-Middle. Would you rather be trusting StartCom today? ...


9

As stated in other answers, each browser has its own script engine that is designed to sandbox JavaScript execution and each engine attempts to limit JavaScript functionality that could lead to malicious behavior. But as a rule JavaScript has never been safe within the browser. Malicious code developers are constantly finding ways to exploit how each ...


9

how does chrome/firefox make sure addons are safe? They inspect them before publishing, and ban those found abusing its rights. But this ban can take from days to weeks. how much access can addons have? Addons can make anything you can, and more. They can access any server, read any cookie, alter any data, even encrypted by HTTPS, and send any data ...


8

HTML 5 local storage check allows you to reliably detect private browsing mode now (2019). It works by attempting to write then read "Local Storage". see: https://gist.github.com/jherax/a81c8c132d09cc354a0e2cb911841ff1 or https://github.com/jLynx/PrivateWindowCheck with PoC ------ edit to add functional description ---- From the jherax link ...


8

Since nobody pointed this out yet: Anti virus software is way less useful than you think. In fact, if you ask security professionals, the main recommendation to stay safe will be to update all your software, above the recommendation to run an AntiVirus - so exactly what you're planning not to do. Why? All that anti virus software does is stop known, old ...


Only top voted, non community-wiki answers of a minimum length are eligible