New answers tagged

3

Is it possible? Yes, in theory, it is possible to define a checksum for the index page of a website. If browser vendors wanted to support such a thing, it could definitely be done. Similar mechanisms for SRI and CSP already exist. However... It doesn't make any sense. /index.html pages used to be integral parts of the web, back when it was mostly static. ...


4

Is this a sufficient check? No, your check is flawed. An attacker can bypass the validation via e.g.: https://attacker.example/?https://www.trusted.com/ This URL resolves to the origin attacker.example, but satisfies url.includes('https://www.trusted.com/'). If not, then how might I do it properly? E.g. use URL.origin. If url is the URL string, you ...


0

Based on OWASP REST Security Cheat Sheet https://owasp.org/www-project-cheat-sheets/cheatsheets/REST_Security_Cheat_Sheet In GET requests sensitive data should be transferred in an HTTP Header.


1

In my opinion, it's a problem that NoScript cannot solve. NoScript allows you to browse the internet while trying to enable as little JavaScript as possible. In most cases you will be able to read text without enabling anything. But in some cases you will need to trust the main website and enable virtually everything to be able to use their services. In ...


1

The Cloudfront URL is a unique identifier for namecheap' CDN. There is nothing to worry about these urls. Regarding your question why to use such URL: my guess is that they don't use Cloudfront for their entire website (maybe not AWS at all). So they only use Cloudfront for their assets. Although I don't see it your screenshot if the Cloudfront URL is used ...


-3

Clear SSL Certificate Cache: Press Windows + R type “inetcpl.cpl” and click ok. This will open Internet Properties. Switch to the Content tab, then click on Clear SSL state Now click Apply followed by OK. Reboot your PC to take effect the changes, Now open chrome browser and check there is no more errors. https://geeksadvice.com/fix-net-err-cert-date-...


0

Open up the developer tools on your browser next time you visit a site - even sites not deriving their income from targeted advertising will be accessing resources on public repositories, calling analytics and doing other thngs than just accessing the site you typed in the URL.


0

The problem is that cookies are browser-wide. So if some script sends a request to a website the session cookies get sent. If you want to sandbox the websites this would have to mean that cookies are now only for one sandbox and would require that the user explicitly selects a sandbox. Firefox actually has something similar now. It's called containers but ...


3

Brave developer here. We do not try to conceal whether you have used Tor or not -- that would be a little difficult. We do, however, avoid storing your private browsing history. If you find evidence of your private browsing history stored there, please let us know or file a bug. You appear to be using a slightly older version of Brave (1.0.0) from before ...


Top 50 recent answers are included