Building a more private web: A path towards making third party cookies obsolete
$200K 1 10th birthday 4 abusive ads 1 abusive notifications 2 accessibility 3 ad blockers 1 ad blocking 2 advanced capabilities 1 android 2 anti abuse 1 anti-deception 1 background periodic sync 1 badging 1 benchmarks 1 beta 83 better ads standards 1 billing 1 birthday 4 blink 2 browser 2 browser interoperability 1 bundles 1 capabilities 6 capable web 1 cds 1 cds18 2 cds2018 1 chrome 35 chrome 81
CSRF is (really) dead
Scott Helme Security researcher, entrepreneur and international speaker who specialises in web technologies. More posts by Scott Helme. A little while back I wrote a blog post about how "CSRF is dead". It focused on SameSite cookies, a powerful yet simple feature to protect your website against CSRF attacks. As powerful as it was, and as much as it will kill CSRF, you had to enable it on your site
Chrome 70ã‹ã‚‰ã€WebAuthnã§Macã®TouchIDã¨Androidã®æŒ‡ç´‹èªè¨¼ãŒãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§åˆ©ç”¨å¯èƒ½ã«ã€‚Webサイトã¸ã®ãƒã‚°ã‚¤ãƒ³ã‚‚タッãƒã§
Chrome 70ã‹ã‚‰ã€WebAuthnã§Macã®TouchIDã¨Androidã®æŒ‡ç´‹èªè¨¼ãŒãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§åˆ©ç”¨å¯èƒ½ã«ã€‚Webサイトã¸ã®ãƒã‚°ã‚¤ãƒ³ã‚‚タッãƒã§ パスワードを使ã‚ãšãƒ‡ãƒã‚¤ã‚¹å´ã§ã®æŒ‡ç´‹èªè¨¼ã‚„PINコードãªã©ã«ã‚ˆã‚‹èªè¨¼ã«ã‚ˆã‚ŠWebサイトã¸ãƒã‚°ã‚¤ãƒ³ã§ãã‚‹WebAuthnã¯ã€2018å¹´4月ã«W3Cã®å‹§å‘Šå€™è£œã«ãªã‚Šã€Chromeã€Firefoxã€Microsoft Edgeã¸ã®å®Ÿè£…ãŒé€²ã‚られã¦ã„ã¾ã™ã€‚ å‚考：パスワードã«ä¾å˜ã—ãªã„èªè¨¼ã€ŒWebAuthnã€ã‚’Chrome/Firefox/EdgeãŒå®Ÿè£…開始ã€W3CãŒæ¨™æº–化。Webã¯ãƒ‘スワードã«ä¾å˜ã—ãªã„より安全ã§ä¾¿åˆ©ãªã‚‚ã®ã¸ Googleã¯5月ã«ãƒªãƒªãƒ¼ã‚¹ã—ãŸChrome 67ã§WebAuthnã¸ã®å¯¾å¿œã‚’è¡Œã„ã¾ã—ãŸãŒã€10月ã«ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã‚‹Chrome 70ã§ã¯å®Ÿè£…を進化ã•ã›ã€ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§Macã®TouchIDã¨Androidã®æŒ‡ç´‹èªè¨¼ã«å¯¾å¿œã™ã‚‹ã“
ã‚»ã‚ュリティ専門家ã®ã¯ã›ãŒã‚ã•ã‚“㌠MS ブラウザ Edge ã«ã¤ã„ã¦ã€Œlocation.href="calculator:"; ã§Edgeã‹ã‚‰é›»å“ãŸã¡ã‚ãŒã‚‹ã€ã‚’発見
「location.href="calculator:"; ã§Edgeã‹ã‚‰é›»å“ãŸã¡ã‚ãŒã‚‹ã€ã®ã¯ã€è‰²ã€…使ãˆãã†ãªã®ã§å‚™å¿˜éŒ²çš„ã«
更新：Internet Explorer ã®è„†å¼±æ€§å¯¾ç–ã«ã¤ã„ã¦(CVE-2014-1776)：IPA 独立行政法人 æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹
Microsoft 社㮠Internet Explorer ã«ã€æ‚ªæ„ã®ã‚ã‚‹ç´°å·¥ãŒã•ã‚ŒãŸã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚’é–‹ãã“ã¨ã§ä»»æ„ã®ã‚³ãƒ¼ãƒ‰ãŒå®Ÿè¡Œã•ã‚Œã‚‹è„†å¼±æ€§ãŒå˜åœ¨ã—ã¾ã™ã€‚ ã“ã®è„†å¼±æ€§ãŒæ‚ªç”¨ã•ã‚ŒãŸå ´åˆã€ã‚¢ãƒ—リケーションプãƒã‚°ãƒ©ãƒ ãŒç•°å¸¸çµ‚了ã—ãŸã‚Šã€æ”»æ’ƒè€…ã«ã‚ˆã£ã¦ãƒ‘ソコンを制御ã•ã‚Œã€æ§˜ã€…ãªè¢«å®³ãŒç™ºç”Ÿã™ã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ Microsoft 社ã¯ã€Œè„†å¼±æ€§ã‚’悪用ã—よã†ã¨ã™ã‚‹é™å®šçš„ãªæ¨™çš„型攻撃を確èªã—ã¦ã„ã¾ã™ã€‚ã€ã¨å…¬è¡¨ã—ã¦ãŠã‚Šã€ä»Šå¾Œè¢«å®³ãŒæ‹¡å¤§ã™ã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ãŸã‚ã€è‡³æ€¥ã€ä¿®æ£ãƒ—ãƒã‚°ãƒ©ãƒ (MS14-021)ã‚’é©ç”¨ã—ã¦ä¸‹ã•ã„。 Microsoft 社ã¯ã€5 月 2 日よりã€Windows Update ã§æœ¬è„†å¼±æ€§ã«å¯¾ã™ã‚‹ä¿®æ£ãƒ—ãƒã‚°ãƒ©ãƒ ã®é…信を開始ã—ã¾ã—ãŸã€‚ 以下㮠Microsoft 製å“ãŒå¯¾è±¡ã§ã™ã€‚ Internet Explorer 6 Internet Explorer 7 Internet Explorer 8
å°æ‚ªé”女å大生ã®ã‚µãƒ¼ãƒã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢æ—¥è¨˜ » Blog Archive » Baseline Requirementã¨ã¯ï¼Ÿ
09.05.12 / 未分類 / Author: aico 2011å¹´ã«å½é€ 証明書ãŒç™ºè¡Œã•ã‚Œã‚‹ã¨ã„ã†äº‹ä»¶ãŒã‚ã‚Šã¾ã—ãŸã€‚ 発行ã•ã‚Œã¦ã—ã¾ã£ãŸã®ã¯Comodo社ã¨DigiNotar社ã®å½é€ 証明書。 Comodo社ã®ã‚±ãƒ¼ã‚¹ã§ã¯Gmailã‚„skypeãªã©ã®å½é€ 証明書ãŒã€ DigiNotar社ã®ã‚±ãƒ¼ã‚¹ã§ã¯ãªã‚“ã¨531件ã®å½é€ 証明書ãŒç™ºè¡Œã•ã‚Œã¦ã—ã¾ã„〠DigiNotar社ã¯äº‹æ¥ç¶™ç¶šãŒå›°é›£ã«ãªã‚Šå€’産ã«è¿½ã„è¾¼ã¾ã‚Œã¦ã—ã¾ã„ã¾ã—ãŸã€‚ ã©ã†ã—ã¦ãã®ã‚ˆã†ãªäº‹ä»¶ãŒèµ·ãã¦ã—ã¾ã£ãŸã®ã§ã—ょã†ï¼Ÿ ã¾ãšComodo社ã®ã‚±ãƒ¼ã‚¹ã‹ã‚‰è¦‹ã¦ã¿ã¾ã—ょã†ã€‚ èªè¨¼å±€(CA)ã¯ã€ 申請者ã®æƒ…å ±ã‚’ç¢ºèªã—発行ã™ã‚‹å‰ã®å¯©æŸ»ã‚’è¡Œã†ç™»éŒ²å±€(RA)㨠審査ã®çµæžœã‚’å—ã‘ã¦è¨¼æ˜Žæ›¸ç™ºè¡Œã®ã¿è¡Œã†ç™ºè¡Œå±€(IA)ã«åˆ†ã‹ã‚Œã¾ã™ã€‚ 1ã¤ã®èªè¨¼å±€ãŒä¸¡æ–¹ã‚’è¡Œã†å ´åˆã‚‚ã‚ã‚Šã¾ã™ãŒã€ Comodo社ã§ã¯äº‹ä»¶ã®èµ·ããŸ2011年時点ã§ã¯ç™»éŒ²å±€ã®æ¥å‹™ã‚’外部ã«å§”託ã—ã¦ãŠã‚Šã€ Com
JSONã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã‚’ã©ã“ã¾ã§ã‚„ã‚‹ã‹å•é¡Œ - 葉ã£ã±æ—¥è¨˜
Ajaxãªã‚¢ãƒ—リケーションã«ãŠã„ã¦ã€ã‚µãƒ¼ãƒã‹ã‚‰JSONã‚’è¿”ã™å ´åˆã«ã€JSON自体ã¯validã§ã‚ã‚‹ã«ã‚‚é–¢ã‚らãšã€(IEã®éƒ½åˆã§)エスケープãŒä¸è¶³ã—ã¦ã„ã¦è„†å¼±æ€§ã«ã¤ãªãŒã£ã¦ã‚‹å ´åˆãŒã‚ã‚‹ã®ã§ã€æ›¸ã„ã¦ãŠãã¾ã™ã€‚ 発生ã™ã‚‹ã‹ã‚‚ã—ã‚Œãªã„脆弱性 JSONã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ãŒä¸è¶³ã—ã¦ã„ã‚‹å ´åˆã«ç™ºç”Ÿã™ã‚‹å¯èƒ½æ€§ã®ã‚る脆弱性ã¯ä»¥ä¸‹ã®é€šã‚Šã§ã™ã€‚ JSON内ã«å«ã¾ã‚Œã‚‹æ©Ÿå¯†æƒ…å ±ã®æ¼ãˆã„ XSS ãã‚Œãžã‚Œã®è©³ç´°ã«ã¤ã„ã¦ã¯å¾Œè¿°ã—ã¾ã™ã€‚ 開発å´ã§ã‚„ã‚‹ã¹ãã“㨠文å—列ä¸ã®Unicodeæ–‡å—㯠"\uXXXX" ãªå½¢å¼ã«ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹ã¨ã¨ã‚‚ã«ã€ASCIIãªç¯„囲ã§ã‚ã£ã¦ã‚‚「/ã€ã€Œ<ã€ã€Œ>ã€ã€Œ+ã€ã‚‚åŒæ§˜ã«ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã™ã‚‹ã“ã¨ã«ã‚ˆã‚Šã€å‰è¿°ã®è„†å¼±æ€§ã‚’防ãã“ã¨ãŒã§ãã¾ã™ã€‚ Perlã§ã‚ã‚Œã°ã€ä»¥ä¸‹ã®ã‚ˆã†ãªæ„Ÿã˜ã«ãªã‚Šã¾ã™ã€‚JSON->ascii(1) ã«ç¶šã‘ã¦ã€JSONæ–‡å—列をæ£è¦è¡¨ç¾ã§ç½®æ›ã—ã¦ã„ã‚‹ã‚ãŸã‚ŠãŒã‚モã«ãªã‚Šã¾ã™ã€‚ use utf8; u
ã“ã¦ã•ãAjax:WebSocketãŒãƒ‡ãƒ•ã‚©ãƒ«ãƒˆdisableã¨ãªã£ãŸä»¶ - livedoor Blog（ブãƒã‚°ï¼‰
拙著（「徹底解説 HTML5 APIガイドブック コミュニケーション系APIç·¨ã€ï¼‰ã®è£œè¶³ãƒ»ä¿®æ£POSTã§ã™ã€‚ p.24ã«WebSocketをサãƒãƒ¼ãƒˆã—ã¦ã„るブラウザãŒè¨˜è¼‰ã•ã‚Œã¦ã„ã¾ã™ãŒã€å‘¨çŸ¥ã®é€šã‚Šã€ä»¥ä¸‹ã®ãƒ–ラウザã§ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆdisableã«ãªã‚Šã¾ã—ãŸã€‚ FireFox4 Opera11 ã¡ãªã¿ã«ã€åŸ·ç†ä»¥é™ã‚µãƒãƒ¼ãƒˆã‚’開始ã—㟠iOS4.2.1ã®safari ã¯ã€ç¾çŠ¶ä½¿ãˆã‚‹çŠ¶æ…‹ã§ã™ã€‚ disableã¨ãªã£ãŸç†ç”±ã¯ã€ç¾çŠ¶å®Ÿè£…ã•ã‚Œã¦ã„ã‚‹ãƒãƒ¼ã‚¸ãƒ§ãƒ³ï¼ˆDraft76）ã«ã‚»ã‚ュリティ上ã®è„†å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸãŸã‚。脆弱性ãŒFixã•ã‚ŒãŸä»•æ§˜ãŒIETFã§å›ºã¾ã‚Œã°ã€ãƒžã‚¤ãƒŠãƒ¼ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ã‚ã£ã¦ã‚‚å†ã³å¯¾å¿œã™ã‚‹ã¨ã®ã“ã¨ã€‚ http://hacks.mozilla.org/2010/12/websockets-disabled-in-firefox-4/ 脆弱性ã®è©³ç´°ã¯ã€Adamã•ã‚“ã®ãƒ¬ãƒãƒ¼ãƒˆã§è¿°ã¹ã‚‰ã‚Œã¦ã„ã¾ã™ã€‚ ãŸã ã—
Samy Kamkar - evercookie - virtually irrevocable persistent cookies
October 11, 2010: Reported on the front page of the New York Times Find the latest details, code, and implementations on github @ https://github.com/samyk/evercookie DESCRIPTION evercookie is a javascript API available that produces extremely persistent cookies in a browser. Its goal is to identify a client even after they've removed standard cookies, Flash cookies (Local Shared Objects or LSOs),
Javascriptã®Math.random()ã§ãƒ¦ãƒ¼ã‚¶ãƒ¼ãƒˆãƒ©ãƒƒã‚ングãŒã§ãã‚‹ã¨ã„ã†è©± - kogelab::memo
表題ã®ä»¶ã«ã¤ã„ã¦ã€‚ 地味ãªè©±ã§ã™ãŒã€javascript（ã¨ã„ã†ã‹ECMAã®ä»•æ§˜ï¼‰ã«ã‚ã‚‹Math.random()ã«ã¯ã€ä¹±æ•°ã®ã‚·ãƒ¼ãƒ‰ã‚’与ãˆã‚‹æ–¹æ³•ãŒç„¡ã„よã†ã§ã™ã€‚ ãã‚“ãªã‚ã‘ã§ã€ã‚ã‚Œã‚れ一般市民ã¯å„ブラウザãŒç‹¬è‡ªã«å®Ÿè£…ã—ã¦ã„ã‚‹ã€è¬Žã®ã‚·ãƒ¼ãƒ‰ã§åˆæœŸåŒ–ã•ã‚ŒãŸè¬Žã®ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã§ä½œã‚‰ã‚ŒãŸä¹±æ•°ã‚’通常使ã†ã‚ã‘ã§ã™ãŒã€‚ Mozillaã‹ã‚‰ã“ã‚“ãªã®å‡ºã¦ãŸã€‚ æ›°ãã€Math.random()ã®ã‚·ãƒ¼ãƒ‰ã«ã‚ˆã‚‹åˆæœŸåŒ–ã¯ã€ãƒ–ラウジングセッションã”ã¨ã«1度ã—ã‹è¡Œã‚ã‚Œãªã„ã¨ã€‚ ã§ã€ã‚·ãƒ¼ãƒ‰ã¯ã¾ã‚ã€ã‹ã¶ã‚‹çŽ‡ãã‚“ãªã«é«˜ããªã•ãã†ãªã®ã§ã€ãã®ã‚·ãƒ¼ãƒ‰ã‚’USERã®ï¼ˆæ“¬ä¼¼çš„ãªï¼‰ID代ã‚ã‚Šã«ã—ã¦ã—ã¾ãˆã°ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒˆãƒ©ãƒƒã‚ングãŒã§ãるよーんã€ã¨ã®ã“ã¨ã€‚ ã¯ã˜ã‚èªã‚“ã ã¨ãã€ã€ŒãŠãŠãƒ¼ã€ã‹ã£ã‘ーï¼ã€ã¨æ€ã£ãŸã‚“ã§ã™ãŒã€ã¡ã‚‡ã£ã¨å¾…ã¦ã€‚ シードã£ã¦å¤–ã‹ã‚‰å–れんã®ã‹ã€‚ ã¨ã„ã†ã‚ã‘ã§ã€è‰²ã€…調ã¹ãŸã¨ã“ã‚ã€å„ブラウザã¯ï¼ˆå¤šåˆ†IEも）線形åˆåŒæ³•ã«ã‚ˆã‚‹æ“¬ä¼¼ä¹±æ•°ã‚’
1分ã§ã‚ã‹ã‚‹ã€ŒX-ナントカã€HTTPレスãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ - 葉ã£ã±æ—¥è¨˜
最近ã®ãƒ¢ãƒ€ãƒ³ãªWebブラウザãŒã‚µãƒãƒ¼ãƒˆã—ã¦ã„ã‚‹ã€ã‚»ã‚ュリティã«é–¢é€£ã—ãã†ãª X- ãªHTTPレスãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ã‚’ã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚ãれ以外ã«ã‚‚ã‚ã£ãŸã‚‰æ•™ãˆã¦ãã ã•ã„。 X-XSS-Protection 0:XSSフィルタを無効ã«ã™ã‚‹ã€‚ 1:XSSフィルタを有効ã«ã™ã‚‹ã€‚ XSSフィルタを有効ã«ã™ã‚‹ã“ã¨ã§ã‚¨ãƒ³ãƒ‰ãƒ¦ãƒ¼ã‚¶ãŒXSSã®è¢«å®³ã«ã‚ã†å¯èƒ½æ€§ãŒä½Žæ¸›ã™ã‚‹ãŒã€ã¾ã‚Œã«èª¤æ¤œçŸ¥ã™ã‚‹ã“ã¨ã§ç”»é¢ã®è¡¨ç¤ºãŒä¹±ã‚Œã‚‹ã“ã¨ã‚‚ã‚る。IE8+ã€Safariã€Chrome(多分) ã§æœ‰åŠ¹ã€‚IEã§ã¯ã€ŒX-XSS-Protection: 1; mode=blockã€ã¨ã„ã†æŒ‡å®šã‚‚å¯èƒ½ã€‚ 2008/7/2 - IE8 Security Part IV: The XSS FilterBug 27312 – [XSSAuditor] Add support for header X-XSS-Protection X-Content-Ty
How to Recover Your Firefox Master Password
If you're using Firefox's built-in password management, you should also be using its master password feature to protect your saved passwords from prying eyes. But what happens if you lose your master password? Since the master password prevents anyone from accessing your saved passwords, you're out of luck if you lose your master password—that is, you can't access any of your saved credentials wit
1
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
GoogleãŒWebã§ã®SHA-1ã®åˆ©ç”¨åœæ¢ã‚’急ãç†ç”± | POSTD
Content Security Policy (CSP) - HTTP | MDN
IEã«ä¾å˜ã—㟠Webアプリケーション ã‚»ã‚ュリティ
{{#tags}}- {{label}}
{{/tags}}