Hot answers tagged

48

This is actually legitimate behaviour. Some ISPs improperly respond to DNS queries to non-existent domains with an A record to a page that they control, usually with advertising, as a "did you mean?" kind of thing, instead of passing NXDOMAIN as the RFC requires. To combat this, Chrome makes several HEAD requests to domains which cannot exist to check how ...


15

What you see is now is not the "green address bar" you would expect with an EV certificate, but the following: The reason for that is the following announcement on the Google Online Security blog: The SHA-1 cryptographic hash algorithm has been known to be considerably weaker than it was designed to be since at least 2005 — 9 years ago. Collision ...


9

Very easy! Enable "Software Restriction Policy" in Group Policy - make sure you customize as needed if you have binaries in non-standard locations (Program Files, Windows dir etc is automatically included). Edit: For clarity to future readers, one point brought up in comments is that you should run Software Execution Policy in a whitelist mode. This means ...


9

This is because of Google's sunset plan for SHA-1. There is no immediate security concern. SHA-2 is the current recommended hashing algorithm for SSL. No breaches with certificates using SHA-1 have been reported. The display of degraded UI indicators on Chrome 39 and later is part of Google’s SHA-1 deprecation plan and will apply to all Certificate ...


5

It calls home. If it can't call home it will try for 7 minutes and then give up.


5

You need SHA2 certificate to make it disappear. More info about Gradually sunsetting SHA-1


5

If your page is in English, you could trying setting the HTML lang attribute as shown: <html lang="en"> <title>My Page</title> [rest of page] </html> Replace en with the ISO 639-1 code of your choice. Alternatively, if you want to go the Sledghammer route you can disable translation by using a Google specific meta tag: <meta ...


4

You wouldn't. You'd set up the network so everyone goes through a proxy server, then keep the logs to see what IP is hitting what sites. Depending on the implementation you can have people log in, or just track by machine IP, or invisibly log the user if the proxy integrated to understand Windows and AD. That removes the logging burden from the Windows ...


4

The command is pk12util -o certfile.p12 -d sql:$HOME/.pki/nssdb -n <certificate's name> The certificate's name is obtained running certutil -d sql:$HOME/.pki/nssdb -L


4

Chrome stores SSL certificate state per host in browser history. So just clear browser history (Ctrl+Shift+Del), at least the following parts: Cached images and files Hosted app data Content licenses


4

Many problems with SSL certificates can be solved by simply removing the file from the cache folder. In Chrome or Chromium, the file to be removed is cert9.db in the folder ~/.pki/nssdb. (In Firefox, you’d want to remove cert8.db.) Attention! After removing these files, you will need to re-register CAs in your browser. The steps for Windows users would be ...


4

As far as I know, certificates are not specific to Google Chrome (at least on Windows) but to the whole system. You’ve already deleted that cert through Chrome’s interface, so it should gone. Just to be certain, you could try. Start → Run → certmgr.msc Another tool to try is CCleaner. It should help with better cleaning of Chrome’s caches.


3

The solution is to use Firefox 3.5 or below (link to old Firefox downloads), since Firefox 3.6 or higher doesn't work with the VMware remote console plugin - since this is already not getting security updates, it's best to install it separately to the main Firefox, and use a new profile. To avoid messing up any Ubuntu version of firefox, just untar the ...


3

This behavior can be disabled by setting the policy value to 0. Additionally, NOGOOGLEUPDATEPING=1 can be passed to the installer to prevent the omaha ping. See http://crbug.com/80567 and http://crbug.com/96243 for details.


3

For future reference: Policy templates are available at http://support.google.com/a/bin/answer.py?hl=en&answer=187945 Lots of useful tips at http://www.chromium.org/administrators Feel free to file bugs/feature requests at the chromium bug tracker using the Enterprise Issue template


2

Your are most probably dealing with XSS attacks. In that case, two steps : Scan the DB, looking for "scripts" tags, and get rid of them. Hire a guy who knows PHP to fix the holes in your data input and set some efficient sanitizing policy.


2

My Cygwin is at home and I'm at the office, but you should make sure that the spaces in your directory names are properly escaped with a backslash when using the double-quotes for the wildcard.


2

In working with Microsoft regarding this issue and how IE9 behaves, we have found information from Verizon in how to opt out of this service. They call it "DNS Assistance". In working with another user on this issue who has BrightHouse ISP in FL,they have the same thing going on. But, they too, provide information on how to opt out of this service. I ...


2

Chrome 23 supports Click-to-Play through the DefaultPluginsSetting policy. The details at http://www.chromium.org/administrators/policy-list-3#DefaultPluginsSetting haven't been updated yet, but that policy can use value 3 to enforce click to play for plugins.


2

Your certificate is only valid for sh149.surpasshosting.com and www.sh149.surpasshosting.com, however your domain is www.frostjedi.com. This mismatch in domains is causing the browser's verification of the certificate to fail. You will need to re-key the existing certificate, or get a new certificate for www.frostjedi.com. If you can post your cert provider,...


2

Comparing client capabilities I have noted that Chrome 42 only supports the following elliptic curves: Elliptic curves: secp256r1, secp384r1 (It appears that secp521r1 used to be supported in earlier versions, there is a bug report for this.) While for instance Firefox 37 supports: Elliptic curves secp256r1, secp384r1, secp521r1 Looking ...


1

Roaming Chrome: Get the Chrome ADMX files from Google. Then you can use the set user data directory. We have it set to ${roaming_app_data}\Google\Chrome\User Data and that gets their settings into the roaming profile. Edit: Can't add comments to reply, but we've been running this for years and never had anyone lose their data when chrome updated.


1

It sounds like you forgot to install the intermediate certificate bundle on your web server. Visit the certificate vendor's web site to download the intermediate bundle. For nginx, this must be concatenated with your certificate and placed in the ssl_certificate directive, for instance: # cat company.sv.crt ca_bundle.crt > company.sv.chained.crt And ...


1

You may need to create a different Chrome profile for each machine. Look here for instructions on how to start Chrome with a different user data directory: http://www.chromium.org/user-experience/user-data-directory. You can then set each profile to sync with the same Google Account to sync your bookmarks, etc.


1

Two ways to set this up on Chrome: Set MCX preferences using the Workgroup Manager to configure the RestoreOnStartupURLs policy. See http://www.chromium.org/administrators/policy-list-3#RestoreOnStartup. Set a master preferences file with the desired homepage/startup URLs, and it will be automatically imported for new chrome profiles. More details on ...


1

Use of the ' quote means that the * won't be used for expansion. Try rsync -e "ssh -i new.key" -r --verbose -tz --stats --progress --delete "/cygdrive/c/Users/jay/AppData/Local/Google/Chrome/User Data/Default/*Session" user@host:"/chrome\ sessions/"


1

There's one here. Chrome ADM


1

The version of PHP-Fusion that's running on the site appears to be v6.01.3, which looks to be a pretty old version, so it would probably be a good idea to upgrade that. There seems to have been quite a few security advisories for PHP-Fusion, including a number of SQL injections issues. Full list of advisories for PHP-Fusion here: http://secunia.com/...



Only top voted, non community-wiki answers of a minimum length are eligible