C2PA Specifications :: C2PA Specifications
The Coalition for Content Provenance and Authenticity (C2PA) addresses the prevalence of misleading information online through the development of technical standards for certifying the source and history (or provenance) of media content. C2PA is a Joint Development Foundation project. This site contains the various specifications and documents produced by the C2PA.
HPKE ã¨ã¯ä½•ã‹ | blog.jxck.io
Intro HPKE (Hybrid Public Key Encryption) ㌠RFC 9180 ã¨ã—ã¦å…¬é–‹ã•ã‚ŒãŸã€‚ RFC 9180: Hybrid Public Key Encryption https://www.rfc-editor.org/rfc/rfc9180.html HPKE ã¯ã€å…¬é–‹éµæš—å·æ–¹å¼ã¨å…±é€šéµæš—å·æ–¹å¼ã‚’組ã¿åˆã‚ã›ã¦(ãƒã‚¤ãƒ–リッド)ä»»æ„ã®å¹³æ–‡ã‚’æš—å·åŒ–ã™ã‚‹ãŸã‚ã®ã€æ±Žç”¨çš„ãªæž 組ã¿ã¨ã—ã¦æ¨™æº–化ã•ã‚Œã¦ã„る。 ã“ã®ä»•æ§˜ã¯ã€å¤šãã®ãƒ¦ãƒ¼ã‚¹ã‚±ãƒ¼ã‚¹ãŒæƒ³å®šã•ã‚Œã¦ãŠã‚Šã€ RFC ã«ãªã‚‹å‰ã‹ã‚‰ ECH (Encrypted Client Hello), MLS (Message Layer Security), OHTTP (Oblivious HTTP) ãªã©ã€ã•ã¾ã–ã¾ãªä»•æ§˜ã‹ã‚‰æŽ¡ç”¨ã‚’検討ã•ã‚Œã¦ã„る。 本サイトã§æ›¸ã予定ã®ä»–ã®è¨˜äº‹ã§ã‚‚ HPKE ã¯é »å‡ºã™ã‚‹äºˆå®šã§ã‚ã‚Šã€ä»Šå¾Œã‚ˆã‚Šå¤šã
Fetch Metadata Request Headers
Fetch Metadata Request Headers W3C Working Draft, 31 October 2023 More details about this document This version: https://www.w3.org/TR/2023/WD-fetch-metadata-20231031/ Latest published version: https://www.w3.org/TR/fetch-metadata/ Editor's Draft: https://w3c.github.io/webappsec-fetch-metadata/ Previous Versions: https://www.w3.org/TR/2021/WD-fetch-metadata-20210720/ https://www.w3.org/TR/2021/WD-
次世代èªè¨¼ãƒ—ãƒãƒˆã‚³ãƒ«FIDOã®å‹•å‘
ãƒ¤ãƒ•ãƒ¼æ ªå¼ä¼šç¤¾ã¯ã€2023å¹´10月1æ—¥ã«LINEãƒ¤ãƒ•ãƒ¼æ ªå¼ä¼šç¤¾ã«ãªã‚Šã¾ã—ãŸã€‚LINEãƒ¤ãƒ•ãƒ¼æ ªå¼ä¼šç¤¾ã®æ–°ã—ã„ブãƒã‚°ã¯ã“ã¡ã‚‰ã§ã™ã€‚LINEヤフー Tech Blog ã¯ã˜ã‚ã« ã“ã‚“ã«ã¡ã¯ã€è¿‘藤裕介ã¨ç”³ã—ã¾ã™ã€‚ ã¿ãªã•ã¾ã€Yahoo! JAPANã«ãƒã‚°ã‚¤ãƒ³ã—ã¦ã‚µãƒ¼ãƒ“ス利用ã—ã¦ã„ã¾ã™ã§ã—ょã†ã‹ï¼Ÿ Yahoo! JAPANã«é™ã‚‰ãšãƒã‚°ã‚¤ãƒ³ãŒå¿…è¦ãªã‚¦ã‚§ãƒ–サービスやアプリケーションを利用ã—ã¦ã€ãƒ˜ãƒ“ーユーザーã«ãªã£ã¦ãã‚‹ã¨ä»–人ã«è¦‹ã‚‰ã‚ŒãŸããªã„データãŒå¢—ãˆãŸã‚Šãªã‚Šã™ã¾ã—ã•ã‚Œã¦å›°ã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã™ã‚ˆã。ãã†ãªã‚‰ãªã„ãŸã‚ã®å¯¾ç–ã¨ã—ã¦ãƒ‘スワードを長ã難ã—ãã—ãŸã‚Šã€2è¦ç´ èªè¨¼ã‚’è¨å®šã—ãŸã‚Šã™ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ãŒåˆ©ä¾¿æ€§ãŒä¸‹ãŒã£ã¦ã—ã¾ã„ã¾ã™ã€‚ ãã‚“ãªãƒ‘スワードã«ã¾ã¤ã‚る課題を解決ã™ã‚‹ã€FIDOアライアンスã®ç–定ã—ã¦ã„ã‚‹èªè¨¼ãƒ—ãƒãƒˆã‚³ãƒ«ã§ã‚ã‚‹U2Fã¨UAFã®ä»•æ§˜ãŒæ˜¨å¹´12月ã«æ£å¼å…¬é–‹ã•ã‚Œã€2015å¹´ã«ã¯ã„ãã¤ã‚‚ã®ã‚µãƒ¼ãƒ“スã§æŽ¡ç”¨ã•
XSSã‚„CSRFリスクを軽減ã™ã‚‹ã€Entry Point Regulationã¨ã¯ - ASnoKaze blog
Entry Point Regulation ã¨ã¯ åå°„åž‹XSS・XSSI・CSRFã®ãƒªã‚¹ã‚¯ã‚’軽減ã™ã‚‹ãƒ¦ãƒ¼ã‚¶ã‚¨ãƒ¼ã‚¸ã‚§ãƒ³ãƒˆä¸Šã®ä»•çµ„ã¿ã¨ã—ã¦ã€W3Cã§Entry Point Regulationã¨ã„ã†ä»•æ§˜ãŒç–定ä¸ã§ã™ã€‚ Webアプリケーションã®å£(Entry Point)ã«å¹¾ã¤ã‹ã®åˆ¶é™ã‚’ã‹ã‘ã‚‹ã“ã¨ãŒå‡ºæ¥ã¾ã™ã€‚別オリジンã‹ã‚‰ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã®æ™‚ã«ã€ã‚¯ã‚¨ãƒªãƒ‘ラメータやHTTPリクエストボディ(POSTメソッド)ãŒä»˜ã„ã¦ã„ã‚Œã°ãƒ–ãƒãƒƒã‚¯ã™ã‚‹ã€ã¨è¨€ã£ãŸäº‹ãŒãƒžãƒ‹ãƒ•ã‚§ã‚¹ãƒˆã§æŒ‡ç¤ºã§ãるよã†ã«ãªã‚Šãã†ã§ã™ã€‚ EPRã«ãŠã‘るリクエストカテゴリ å„エンドãƒã‚¤ãƒ³ãƒˆ(URL)ã¯ã©ã®ã‚ˆã†ãªãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’å—ã‘付ã‘ã‚‹ã“ã¨ãŒå¯èƒ½ã‹æŒ‡å®šã§ãã¾ã™ã€‚ãã®æ™‚ã«æŒ‡å®šã™ã‚‹ãƒªã‚¯ã‚¨ã‚¹ãƒˆã¯ä»¥ä¸‹ã«åˆ†é¡žã•ã‚Œã¾ã™ navigational request：context frame typeã¯"top-level", "auxiliary", "neste
Requirements for Powerful Features (Editor's Draft)
This specification defines "secure contexts", thereby allowing user agent implementers and specification authors to enable certain features only when certain minimum standards of authentication and confidentiality are met. This is a public copy of the editors’ draft. It is provided for discussion only and may change at any moment. Its publication here does not imply endorsement of its contents by
Launching ServiceWorker without breaking the web
Update: Thanks to everyone who read and commented, you influenced the direction of the API. We're going for B, the path-based method, but allowing a header to relax these rules so you can put your worker script wherever you want. Many thanks! With ServiceWorkers you can control requests to any page on your origin, and any of the subresource requests made by those pages. You can completely change w
Subresource Integrity
Subresource Integrity W3C Recommendation 23 June 2016 This version: http://www.w3.org/TR/2016/REC-SRI-20160623/ Latest published version: http://www.w3.org/TR/SRI/ Latest editor's draft: https://w3c.github.io/webappsec-subresource-integrity/ Implementation report: https://github.com/w3c/webappsec-subresource-integrity/wiki/Links Previous version: http://www.w3.org/TR/2016/PR-SRI-20160510/ Editors:
1
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
HTTP and Web Application Firewalls:
GitHub - antosart/policy-container-explained: Policy container explained
Cross-site loads of signed packages should be done stateless and with no personalization · Issue #423 · WICG/webpackage
GitHub - privacycg/private-click-measurement: Private Click Measurement
Describe when features should be limited to secure contexts. by dbaron · Pull Request #75 · w3ctag/design-principles
Reducing the precision of the DOMHighResTimeStamp resolution · Issue #56 · w3c/hr-time
Self-Review Questionnaire: Security and Privacy
GitHub - WICG/origin-policy: [On hold for now] A mechanism for origins to set their origin-wide configuration in a central location![GitHub - WICG/origin-policy: [On hold for now] A mechanism for origins to set their origin-wide configuration in a central location](https://cdn-ak-scissors.b.st-hatena.com/image/square/de3ab1b97294d24c49815209d946d38501366e42/height=288;version=1;width=512/https%3A%2F%2Fopengraph.githubassets.com%2Ff69f3dc777ad22588ad465465aef8b723cb465b8937853b4c315b15b243efb83%2FWICG%2Forigin-policy)
GitHub - facebookarchive/DelegatedRecoverySpecification: Allows an application to delegate the capability to recover an account to an account controlled by the same user or entity at a third party service provider.
{{#tags}}- {{label}}
{{/tags}}