Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

New answers tagged

51

Yes, DOM-based XSS is still a concern. While some issues cannot be exploited due to URL encoding, there a number of situations where URL encoding will not stand in the way of exploitation. The gist of the example is to form a hashbang query with injection That's one example, but DOM-based XSS encompasses all XSS issues that result from insecurely ...


3

Not very well. In theory, the system should work. In practice, it doesn't. The implementations intended to manage revocation - namely CRL and OCSP - both have problems. Most of this answer is based on this article by Alexey Samoshkin, as well as this article by Scott Helme. What about CRLs? A certificate revocation list is a remarkably simple way of ...


1

The standard clearly defines the syntax. In section 4.2 it contains the following: source-list = *WSP [ source-expression *( 1*WSP source-expression ) *WSP ] / *WSP "'none'" *WSP source-expression = scheme-source / host-source / keyword-source / nonce-source / hash-source ... host-source = [ scheme-part "://" ] host-part [ port-...


5

Once someone has access to your computer then can get absolutely everything you have access to. If this was not possible, then you would not be able to do those things either. The way to avoid this is to not give someone access to your computer or your logged in session on the computer. Log out and have them log into another user.


0

The university of Warwick in the UK made a great help page on this, it has lists of what devices will and will not work after removing TLS 1.0 and 1.1. Have a look: https://warwick.ac.uk/services/its/servicessupport/web/sign-on/help/tls1-eol/ They have sub pages at the top for each OS and what's supported. In most cases, running Firefox or Chrome will ...


1

The short answer is no. That error means that there is a problem on Openmailbox's end of things and changing how you connect to it will not resolve the problem on their server. You should contact their support, and let them know their SSL is not validating properly, then wait until they fix it before trying to connect to your inbox again.


2

It seems you may have some misunderstanding of Kerberos and/or Windows domains. First of all, the browser doesn't generate a Kerberos ticket; a domain controller does. At most, the browser will ask the local security authority (LSASS) to do it. To get Kerberos working, you need to understand how authentication and trusts work in an AD environment. The user ...


4

That sounds like a typical case of "security by misunderstood protocol", which you encounter in lots of places. Especially that they don't know by themselves why they're doing it points to some policy somewhere stating something which - Chinese Whispers style - turned into a search engines block list. There really isn't any serious security impact I can ...


1

This is essentially not domain fronting, domain fronting is when you use a legitimate domain like a public CDN to send messages, but they are afterwards redirected to you. If a website has the same origin policy set to allow everything you can use XMLHttpRequest from the victims browser to access those resources. You can't set things like Host headers and ...


9

If the enterprise considers search engines which aren't Google and Bing "untrustworthy" for some reason (e.g., because they believe they are more likely to intentionally or unintentionally disclose search history to third parties), it makes sense to block them. Your search history at work can reveal internal information about the company, two ways off the ...


42

In many jurisdictions, school districts are legally required to have web filtering in place. Google & Bing are two examples of companies who's "Safe Search" API has been around and stable for some time now. While DuckDuckGo does have Safe Search abilities, your client's web filtering vendor may not have had the time/motivation to add it into their ...


5

There's really no good reason to block them. Search engines only return content based on their algorithm. It could be that they are blocking on a predefined firewall vendor list by categories where DuckDuckGo is categorized differently. There have been attacks where using SEO a malicious actor has put his site above a legitimate one in the search results, ...


0

I'll add a post to technologies for which this could be a use case but which have not made it. Some of these look like they could have been very helpful. Foreign Fetch allowed a service worker to fetch pages on behalf of others. This experiment was removed from browsers in 2017. In 2014 University College, Google, Chalmers, and Mozilla Research developed a ...


1

I can see two options here. The first is to just delegate the crypto part to a server, and communicate with it via a HTTP API. This wouldn't involve the JS web crypto API, and perhaps it would violate some of your design criteria. Second option for communicating across origins is Window.postMessage(). It let's you send messages and receive responses ...


Top 50 recent answers are included