New answers tagged

5

On eu-store.wacom.com, some images from their Amazon CDN are requested over http instead of https Let me continue from that. Firefox says it's not 100% secure because it's loading unprotected content. I would say, naively... it's 95% secure Now, it doesn't mean the site wacom.com is not legitimate, but perhaps misconfigured. If you buy today from that site,...


8

My questions are, why is this inconsistency happening This is known as mixed-content,where the page is loaded with HTTPS,while some parts(images) are loaded via Insecure HTTP. how can I verify that the store page is indeed wacom's As long as your system has not been compromised then the only way is to use HTTPS everywhere and visit the correct URL or ...


15

On eu-store.wacom.com, some images from their Amazon CDN are requested over http instead of https. This can be solved by installing HTTPS Everywhere and turning on "Encrypt All Sites Eligible": The gray padlock means all resources are served securely. So the webstore is most likely not compromised. They are still using an outdated cipher based on CBC and ...


0

This is actually described in the HTML living spec: If the algorithm reaches this step, then a download was begun from a different origin than the resource being downloaded, and the origin did not mark the file as suitable for downloading, and the download was not initiated by the user. This could be because a download attribute was used to trigger the ...


-2

I can think of one potential security issue. If I create an HTML file and you open it on the web page, it operates under the same origin restrictions as everything else. If I can force you to download the HTML file, double clicking that file, or opening it from your browser, now has an origin of your local machine! Suddenly the potential for malice is ...


1

As others have said, as long as your rules really are coming only from trusted developers, there shouldn't be any security holes from using eval. However, eval has plenty of other disadvantages, in terms of complexity, maintainability, debuggability, etc. And using regular expressions plus eval could easily result in problems down the road, depending on how ...


0

To the best of my knowledge, there are 2 possible way browsers may detect phishing pages: DNS detection and Blacklist/White List detection. In blacklist method, if a page has been reported by several users as a phishing scam, it is saved in the blacklist database. So, when a new user will visit that link, it will show that the site is unsafe. In other way (...


0

A reason for this is that modern (and old) mostly professional phishing campaigns use images such as the example below, which make it harder to detect it. Also source-code obfuscation techniques are used to hide theirselves from the radar(such as encoding think like HEX, BASE64 or custom encoding, of certain places and values like urls or meta data). ...


2

Usually browsers don't actually detect the phishing page but rather use a blacklist of URL's provided by services such as PhishTank or OpenPhish. While some of the websites posted in these lists are provided by programmed detectors, most are reported by users. The Chrome browser will use Google's large phishing DB compiled from Gmail reporting and other ...


3

Front-end javascript itself is completely at the will of the client running the code. If you are depending on front-end javascript for security, you've already failed to secure your application. Forget eval. The client can replace your entire website with their own implementation if they desire. Thus, your server should validate everything that the ...


5

Appearances and expectations If something looks like a safe expression, people will probably treat it like one. If a field looks like any other data-field, people (even developers) will probably put untrusted data in there. If something is evaluated with full level application access, it should look and feel like code. Another problem are subtle bugs in ...


31

Today, everything is written by developers. Next month or next year, someone will say "hey, why not let the users write those themselves?" Bam. Also, even if the rules are written by the developers only, do they or will they include any user-originated data? Something like titles, names, categories, for instance? This could quickly lead to an XSS attack. ...


35

Using eval in this context doesn't create any vulnerability, as long as an attacker can't interfere with the arguments passed to matchCondition. If you find it easier to read / program it this way, and you're confident that no untrusted input will ever go into your expression compiler, then go for it. eval isn't evil, untrusted data is. Please note that ...


4

I assume you are asking if you (the user NH) should trust a browser's built-in password manager, or if you should install a third party plugin; and not whether or not Mozilla should develop another password manager. Before I get started, keep in mind that security isn't just about vulnerabilities or architecture or protocols or passwords; it's an overall ...


0

Assuming you want to mitigate a keylogger that only records keys, you have the following possibilities: Use password manager so you don't type the password (plain simple). That could even be a plain text file containing your password and you copy/paste then to the relevant browser field Type dumb stuff outside the password field during your password typing (...


0

The last time I dealt with keyloggers, and it's been many years, they were just that -- keyloggers, as in only keystrokes were captured. The general defense was to use a virtual keyboard, a graphical keyboard that was selected with the mouse rather than using the physical keyboard. Actually the keyloggers were scancode loggers. Keyboards don't send keys, ...


4

I'll confess to not having any practical experience with keyloggers, but I don't see why a keylogger would care about the title of a web page, or would monitor DNS or TCP traffic. What's the point? Filtering based on the title of a page is not terribly useful: sure, a keylogger would be more interested in a page that's called “login”, but on many sites login ...


2

It's a kind of X-Y-problem. If you let untrusted software run on your computer, you have lost. Especially if it runs with administrative privileges. How can you tell that there's no DNS redirection going on, if you have a process running with administrative privileges? Can you at that stage trust your operating system to tell you? No, you can't. The ...


1

Keyloggers tend to capture control sequences, like tabs and clicks. So the keylogger can dump anything longer than 30 chars without a control sequence, for instance, as not being interesting. But keyloggers also tend to be context-aware. Switching to new windows, for instance. They can look for entry into password fields, especially if you are talking about ...


0

Firefox uses a fairly weak hashing method: just one iteration of SHA-1. You could use a more secure password to compensate for this, but it's less secure than what something like something like LastPass would offer. Wladimir Palant (creator of Adblock Plus) wrote a post about this in March 2018: It is common knowledge that storing passwords there without ...


0

yes it is possible if only you could run the script on the same router page or with same url with some kind of local DNS rebinding to trick the browser that you are sending the request to the same site that the request is made from and both are the router page(address-ip) and redirecting only after you set the cookies manually ... or if some how you could ...


0

By default, XMLHttpRequest does not include cookies. Use withCredentials to send cookies along. As an alternative, you can create a HTML form and submit that with JavaScript. This sends cookies along by default.


Top 50 recent answers are included