Safe Internet Browsing Flashcards

What is DNS-over-HTTPS (DoH) and how does it improve browsing privacy?

Answer: A protocol that encrypts DNS queries within HTTPS traffic, preventing ISPs and network observers from seeing which websites you visit

DNS-over-HTTPS encrypts DNS lookups within HTTPS connections, preventing ISPs, network administrators, and attackers from monitoring which domain names you are resolving.

What is clickjacking and how does it trick users?

Answer: An attack that overlays invisible or disguised elements on a webpage so users unknowingly click on something different from what they see

Clickjacking uses transparent iframes or overlays to place hidden clickable elements on top of a legitimate webpage, tricking users into clicking something they did not intend—such as liking a page, sharing content, or changing account settings.

What security risk does URL shortening services pose?

Answer: Shortened URLs obscure the actual destination, making it impossible to verify where the link leads before clicking

URL shorteners hide the true destination of a link, preventing users from assessing whether it leads to a legitimate website or a malicious one before clicking.

What is content security policy (CSP) and how does it protect web users?

Answer: A browser security mechanism that allows website owners to specify which sources of content are trusted, preventing injection of malicious scripts

Content Security Policy is an HTTP header that allows website operators to declare which sources of content (scripts, styles, images) are legitimate, enabling the browser to block any injected malicious content from unauthorized sources.

What is a watering hole attack?

Answer: Compromising a website frequently visited by a specific target group to infect visitors with malware

A watering hole attack compromises a website that is known to be frequented by the intended target group, infecting visitors with malware when they visit—similar to a predator waiting near a water source.

Why should you be cautious about browser auto-fill for sensitive information?

Answer: Hidden form fields on malicious websites can trick auto-fill into revealing more personal data than you intend to share

Malicious websites can include hidden form fields that browser auto-fill automatically populates with stored personal data—such as your address, phone number, or credit card—without your knowledge or visible indication.