Browser Security

Question 1

HTTP Strict Transport Policy

Answer 1

• User Agent will convert URI to secure URI before dereferencing
• Helps against active and passive attackers, but not malware or phishing
• Countermeasure for SSL stripping attacks
• Can be set via HSTS response header during first website visit

Question 2

Cookie Protocol Problems

Answer 2

• Server is blind:
  -> Does not see cookie attributes
  -> Does not see which domain set the cookie
  -> Server processes cookies sent to it
• No encryption or integrity checks are included
  -> Must be implemented on web application or client side

Question 3

Private Browsing Mode

Answer 3

• Web pages opened and files downloaded will not be recorded in the browser/download history
• All new cookies are deleted after you close all incognito windows
• Changes made to bookmarks and general settings while in incognito mode are always saved
• Websites that you visit may still have records of your visit

Question 4

Tracking Countermeasures

Answer 4

• Cookie opt-out
• Do-not-Track header
• 3rd party cookie blocking/manually clearing browser data
• Add-ons