IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [html]

HTML (HyperText Markup Language) is a language used to create web pages using tags inline with the content to indicate to browsers how to display that content, using the tags to interpret formatting, images, scripts and other content.

The HTML tag should be used for questions referring to the security of the HTML language, or implementations based upon it.

HTML uses tags inline with the content to indicate to browsers how to display that content, using the tags to interpret formatting, images, scripts and other content.

From a security perspective, most vulnerabilities are down to the functionality allowed by scripts (e.g. JavaScript), embedded content (e.g. Flash) and other plugins.

331 questions
107
votes
5 answers

Should websites be allowed to disable autocomplete on forms or fields?

Currently, there is an HTML form/input attribute called autocomplete, which, when set to off, disables autocomplete/autofill for that form or element. Some banks seem to use this to prevent password managers from working. These days sites like Yahoo…
Manishearth
  • 8,237
  • 5
  • 34
  • 56
64
votes
2 answers

Are EU cookie consent forms safe?

Does the EU consent form system pose a new security risk? Today we have to click OK on about 20 cookie consent forms every week, where previously we could mostly dismiss internet forms as being invasive and risky. There are so many EU consent forms,…
LifeInTheTrees
  • 849
  • 1
  • 7
  • 13
61
votes
1 answer

"Allow __ to be fullscreen?"

I have been asking myself for a while what's the purpose of that popup showing up in pretty much all the modern browsers upon entering the full-screen mode of a video or website. It appears to be a security measure against some sort of potential…
Nicola Miotto
  • 682
  • 6
  • 10
60
votes
6 answers

Anonymous surveys that aren't so anonymous

In the past I have completed an 'anonymous' survey at work only to find that my employer was able to garner a lot of not-anonymous information from this survey. Location, name of manager, etc. None of this information was provided in the survey. …
iShaymus
  • 673
  • 5
  • 5
45
votes
8 answers

Is it ever safe to open a suspicious HTML file (e.g. email attachment)?

If I receive an email that has an attachment called something like safe-link.html would it ever be safe to open this file? Clearly, HTML files may have malicious scripts embedded that could run when opened with a browser. However, I'm wondering if…
Matthew
  • 551
  • 1
  • 4
  • 8
40
votes
4 answers

Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?

When I was reading a page on Wikipedia several months ago (December 2014) I saw what looked like a pop-up window from BT, but I soon realized that when I closed the page the pop-up disappeared. I then opened Firebug and inspected the box and saw…
Alexander Kalian
  • 553
  • 4
  • 10
40
votes
7 answers

Security risks of user generated HTML?

I am creating a website that allows people to upload HTML content. Currently these are the tags that are banned: