[B! browser][security] TokyoIncidentsã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

TokyoIncidents id:TokyoIncidents

browserã¨securityã«é–¢ã™ã‚‹TokyoIncidentsã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (13)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Spectre ã®è„…å¨ã¨ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆãŒè¨å®šã™ã¹ããƒ˜ãƒƒãƒ€ãƒ¼ã«ã¤ã„ã¦
é•·ã„è¨˜äº‹ãªã®ã§å…ˆã«çµè«–ã‚’æ›¸ãã¾ã™ã€‚ Spectre ã®ç™»å ´ã§ã€ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã«å¿…è¦ã¨ã•ã‚Œã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è¦ä»¶ã¯å¢—ãˆã¾ã—ãŸã€‚å…·ä½“çš„ã«å¿…è¦ãªå¯¾ç–ã¯ä¸‹è¨˜ã®é€šã‚Šã§ã™ã€‚ ã™ã¹ã¦ã®ãƒªã‚½ãƒ¼ã‚¹ã¯ Cross-Origin-Resource-Policy ãƒ˜ãƒƒãƒ€ãƒ¼ã‚’ä½¿ã£ã¦ cross-origin ãªãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã¸ã®èªã¿è¾¼ã¿ã‚’åˆ¶å¾¡ã™ã‚‹ã€‚ HTML ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã«ã¯ X-Frame-Options ãƒ˜ãƒƒãƒ€ãƒ¼ã‚‚ã—ãã¯ Content-Security-Policy (CSP) ãƒ˜ãƒƒãƒ€ãƒ¼ã® frame-ancestors ãƒ‡ã‚£ãƒ¬ã‚¯ãƒ†ã‚£ãƒ–ã‚’è¿½åŠ ã—ã¦ã€cross-origin ãªãƒšãƒ¼ã‚¸ã¸ã® iframe ã«ã‚ˆã‚‹åŸ‹ã‚è¾¼ã¿ã‚’åˆ¶å¾¡ã™ã‚‹ã€‚ HTML ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã«ã¯ Cross-Origin-Opener-Policy ãƒ˜ãƒƒãƒ€ãƒ¼ã‚’è¿½åŠ ã—ã¦ popup ã‚¦ã‚£ãƒ³ãƒ‰ã‚¦ã¨ã—ã¦é–‹ã‹ã‚ŒãŸå ´åˆã® cross-origin ãªãƒšãƒ¼ã‚¸ã¨ã®ã‚³ãƒŸãƒ¥ãƒ‹
TokyoIncidents 2021/11/04
web

browser

security
ãƒªãƒ³ã‚¯
Smoozã‚µãƒ¼ãƒ“ã‚¹çµ‚äº†ã«å¯„ã›ã¦
202012_smooz.md Smoozã‚µãƒ¼ãƒ“ã‚¹çµ‚äº†ã«å¯„ã›ã¦ å‰ç½®ã ã“ã®æ–‡ç« ã¨ã€ãã‚Œã«å«ã¾ã‚Œã‚‹è€ƒå¯Ÿã‚„å„ã‚µãƒ¼ãƒ“ã‚¹ã¸ã®è„†å¼±æ€§å ±å‘Šãªã©ã¯malaå€‹äººã®æ´»å‹•ã§ã‚ã‚Šã€æ‰€å±žã—ã¦ã„ã‚‹ä¼æ¥ã¨ã¯é–¢ä¿‚ã‚ã‚Šã¾ã›ã‚“ã€‚ ä¸€æ–¹ã§ç§ã¯ã€ä¼æ¥ãŒé–²è¦§å±¥æ´ã‚’åŽé›†ã—ã¦ä½•ã‚’ã—ãŸã„ã®ã‹ã€æ‰€å±žã—ã¦ã‚‹ä¼æ¥ã‚„ä»–ç¤¾äº‹ä¾‹ã«ã¤ã„ã¦ã€ã‚ã‚‹ç¨‹åº¦è©³ã—ã„å½“äº‹è€…ã§ã‚‚ã‚ã‚Šã¾ã™ã€‚ ä¸€èˆ¬è«–ã¨ã—ã¦æ›¸ã‘ã‚‹ã“ã¨ã¯æ›¸ã‘ã‚‹ãŒã€(æ¥å‹™ä¸ŠçŸ¥ã‚Šå¾—ãŸçŸ¥è˜ã§é–‹ç¤ºã•ã‚Œã¦ãªã„ã‚‚ã®ãªã©)å€‹åˆ¥å…·ä½“çš„ãªã“ã¨ã¯æ›¸ã‘ãªã„ã“ã¨ã‚‚ã‚ã‚Šã€ã¾ãŸè¦³æ¸¬ç¯„å›²ã«åã‚ŠãŒã‚ã‚‹å¯èƒ½æ€§ã‚‚ã‚ã‚Šã¾ã™ã€‚ Smoozã«å ±å‘Šã—ãŸè„†å¼±æ€§2ä»¶ æœ€è¿‘ã€Smoozã¨ã„ã†ã‚¹ãƒžãƒ›å‘ã‘ã®ãƒ–ãƒ©ã‚¦ã‚¶ã‚¢ãƒ—ãƒªã«2ä»¶è„†å¼±æ€§ã®å ±å‘Šã‚’ã—ãŸã€‚ ã“ã®è¨˜äº‹ã‚’æ›¸ã„ã¦ã„ã‚‹æ™‚ç‚¹ã§ã€Smoozã®é…å¸ƒãŒåœæ¢ã•ã‚Œã¦ã„ã¦ã€ä¿®æ£ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã®å…¥æ‰‹ãŒå‡ºæ¥ãªã„ã€‚ 2ä»¶ç›®ã«ã¤ã„ã¦ã¯ã¾ã è¿”äº‹ãŒæ¥ã¦ã„ãªã„ã€‚ è„†å¼±æ€§æƒ…å ±ã®é–‹ç¤ºã«ã‚ãŸã£ã¦ç‰¹æ®µã®è¨±å¯ã¯å¾—ã¦ã„ãªã„ãŒã€é–‹ç™ºå…ƒã‹ã‚‰ã‚‚åˆ©ç”¨åœæ¢ã™
TokyoIncidents 2020/12/23
browser

web

security
ãƒªãƒ³ã‚¯
æœ€æ–°ã®ãƒ–ãƒ©ã‚¦ã‚¶ã§å¤‰ã‚ã‚‹Cookieã®å–ã‚Šæ‰±ã„ã‚„Privacyã®è€ƒãˆæ–¹
2020/02/13 DevSumi ç™ºè¡¨è³‡æ–™
TokyoIncidents 2020/02/13
browser

JavaScript

security
ãƒªãƒ³ã‚¯
ãƒ–ãƒ©ã‚¦ã‚¶ã®è„†å¼±æ€§ã¨ãã®ã‚¤ãƒ³ãƒ‘ã‚¯ãƒˆ
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ»ã‚ãƒ£ãƒ³ãƒ—å…¨å›½å¤§ä¼š2017ã®è¬›ç¾©è³‡æ–™ã§ã™ï¼ˆMasato Kinugawaã•ã‚“ã¨ã®å…±åŒåˆ¶ä½œã§ã™ï¼‰ã€‚
TokyoIncidents 2017/08/15
security

browser
ãƒªãƒ³ã‚¯
Archived MSDN and TechNet Blogs
If you were looking for MSDN or Tech Net blogs, please know that MSDN and Tech Net blog sites have been retired, and blog content has been migrated and archived here. How to use this site Archived blogs are grouped alphabetically by the initial letter of the blog name. Select the initial letter from the TOC to see the full list of the blogs. You can also type the name of the blog or the title of the
TokyoIncidents 2017/02/01
browser

security
ãƒªãƒ³ã‚¯
Template:ã‚¦ã‚§ãƒ–ãƒ–ãƒ©ã‚¦ã‚¶ã«ãŠã‘ã‚‹TLS/SSLã®å¯¾å¿œçŠ¶æ³ã®å¤‰åŒ– - Wikipedia
ã‚¦ã‚§ãƒ–ãƒ–ãƒ©ã‚¦ã‚¶ã«ãŠã‘ã‚‹TLS/SSLã®å¯¾å¿œçŠ¶æ³ã®å¤‰åŒ– ã‚¦ã‚§ãƒ–ãƒ–ãƒ©ã‚¦ã‚¶ ãƒãƒ¼ã‚¸ãƒ§ãƒ³ ãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ SSLãƒ—ãƒãƒˆã‚³ãƒ« TLSãƒ—ãƒãƒˆã‚³ãƒ« è¨¼æ˜Žæ›¸ã®ã‚µãƒãƒ¼ãƒˆ è„†å¼±æ€§ã¸ã®å¯¾å¿œ[æ³¨ 1] ãƒ—ãƒãƒˆã‚³ãƒ«é¸æŠž[æ³¨ 2] SSL 2.0 (å®‰å…¨ã§ã¯ãªã„) SSL 3.0 (å®‰å…¨ã§ã¯ãªã„) TLS 1.0 TLS 1.1 TLS 1.2 TLS 1.3 EV[æ³¨ 3][1] SHA-2[2] ECDSA[3] BEAST [æ³¨ 4] CRIME [æ³¨ 5] POODLE (SSLv3) [æ³¨ 6] RC4 [æ³¨ 7] FREAK [4][5] Logjam Google Chrome (Chrome for Android) [æ³¨ 8] [æ³¨ 9]
TokyoIncidents 2017/01/12
browser

security

TLS
ãƒªãƒ³ã‚¯
CSP Cheat Sheet
CSP Cheat Sheet Need a hand with Content Security Policy? This page is a concise overview of all supported features and directives in Content Security Policy. It can be used as a quick reference guide to identify valid and invalid directives and values, contains example policies and guidance on how to use CSP effectively. Quick Links Source List - how to define sources for loading content. Hosts |
TokyoIncidents 2016/09/27
browser

security
ãƒªãƒ³ã‚¯
CSP Evaluator
CSP Evaluator allows developers and security experts to check if a Content Security Policy (CSP) serves as a strong mitigation against cross-site scripting attacks. It assists with the process of reviewing CSP policies, which is usually a manual task, and helps identify subtle CSP bypasses which undermine the value of a policy. CSP Evaluator checks are based on a large-scale study and are aimed to
TokyoIncidents 2016/09/27
browser

security
ãƒªãƒ³ã‚¯
GitHub - cure53/HTTPLeaks: HTTPLeaks - All possible ways, a website can leak HTTP requests
You can use this to test your browser for CSP leaks, your web-mailer for HTTP leaks and everything else that is not supposed to send HTTP requests to where the sun won't shine. With "HTTP Leak", we are essentially referring to a situation, where a certain combination of HTML elements and attributes cause a request to an external resource to be fired - when it should not. Think, for example, of the
TokyoIncidents 2016/05/17
browser

security
ãƒªãƒ³ã‚¯
ãƒ–ãƒ©ã‚¦ã‚¶ãƒãƒƒã‚¯ | ç¿”æ³³ç¤¾
æœ¬æ›¸ã¯ã€æ¯Žæ—¥ä½¿ã£ã¦ã„ã‚‹Webãƒ–ãƒ©ã‚¦ã‚¶ã‚’ãƒãƒƒã‚ãƒ³ã‚°ã—ã€ã•ã‚‰ãªã‚‹æ”»æ’ƒã®è¶³ãŒã‹ã‚Šã¨ã—ã¦åˆ©ç”¨ã™ã‚‹æ–¹æ³•ã«ã¤ã„ã¦ã€å®Ÿç”¨çš„ãªçŸ¥è˜ã‚’è§£èª¬ã—ã¾ã™ã€‚ Webãƒ–ãƒ©ã‚¦ã‚¶ã«å¯¾ã™ã‚‹æ”»æ’ƒã¯ã€åºƒãæ™®åŠã—ã¦ã„ã‚‹ãƒ–ãƒ©ã‚¦ã‚¶ã‚’æ¨™çš„ã«ã™ã‚‹ã®ãŒä¸€èˆ¬çš„ã§ã™ãŒã€ã‚ã¾ã‚Šæ™®åŠã—ã¦ã„ãªã„ã‹ã‚‰ã¨ã„ã£ã¦æ¨™çš„ã«ãªã‚‰ãªã„ã‚ã‘ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚æœ¬æ›¸ã§ã¯ã€Firefoxã€Chromeã€Internet Explorerã‚’ä¸»ã«å–ã‚Šä¸Šã’ã¦ã„ã¾ã™ãŒã€ä¸€éƒ¨æœ€æ–°ãƒ¢ãƒã‚¤ãƒ«ãƒ–ãƒ©ã‚¦ã‚¶ã«ã‚‚è¸ã¿è¾¼ã‚“ã§ã„ã¾ã™ã€‚ãƒ¢ãƒã‚¤ãƒ«ãƒ–ãƒ©ã‚¦ã‚¶ã¯ã¾ã å¤§ããªæ³¨ç›®ã‚’é›†ã‚ã¦ã„ã¾ã›ã‚“ãŒã€ã“ã‚Œã‚’æ¨™çš„ã¨ã™ã‚‹æ”»æ’ƒã‚‚å¢—ãˆã¦ã„ã¾ã™ã€‚ Webãƒ–ãƒ©ã‚¦ã‚¶ã®æ™®åŠåº¦ã‚’è€ƒãˆã‚Œã°ã€ãã®æ•°ã«æ¯”ä¾‹ã—ã¦ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®å•é¡Œã‚„ã‚¨ã‚¯ã‚¹ãƒ—ãƒã‚¤ãƒˆã®å±é™ºæ€§ãŒé«˜ã¾ã‚‹ã®ã¯å½“ç„¶ã§ã™ã€‚æœ¬æ›¸ã§ã¯ã€ä»Šã‚’æ™‚ã‚ãæœ€æ–°ã®ãƒ–ãƒ©ã‚¦ã‚¶ã‚’ãƒãƒƒã‚ãƒ³ã‚°ã™ã‚‹æ–¹æ³•ã‚’ãƒãƒƒã‚«ãƒ¼ã®ç«‹å ´ã‹ã‚‰èª¬æ˜Žã—ã€ãã“ã‹ã‚‰æ”»æ’ƒã«å¯¾ã™ã‚‹é˜²å¾¡æ–¹æ³•ã‚’è€ƒãˆã¾ã™ã€‚ ç¬¬1ç« ã€€Webãƒ–ãƒ©ã‚¦ã‚¶ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ ç¬¬2ç« ã€€
TokyoIncidents 2016/03/30
browser

security

books
ãƒªãƒ³ã‚¯
ãã‚ãã‚CSP Lv.2 nonceã‚„ã‚ã† - teppeis blog
tl;dr CSP Lv.2ã®nonceã‚’ä½¿ã†ã¨æ„å¤–ã¨ç°¡å˜ã«CSPã®æ©æµã‚’å—ã‘ã‚Œã‚‹ã‚ˆ Firefoxã¯unsafe-inlineã¨ã®æŒ™å‹•ãŒãŠã‹ã—ã„ã®ã§æ³¨æ„ ã‚µãƒ³ãƒ—ãƒ«å®Ÿè£…ã¨ã—ã¦Expressã§ç°¡å˜ã«nonceå¯¾å¿œã§ãã‚‹connectãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã‚’æ›¸ã„ãŸï¼ˆãƒ‡ãƒ¢ã‚ã‚Šï¼‰ Violation Reportã‚‚ãƒ–ãƒ©ã‚¦ã‚¶ã«ã‚ˆã£ã¦ç´°ã‹ã„æŒ™å‹•ã®å·®ç•°ãŒã‚ã‚‹ã‚ˆ CSP Lv.2 nonceã®ç™»å ´ã¨èƒŒæ™¯ CSPã®ç‰¹ã«unsafe-inlineã¯XSSã«å¯¾ã—ã¦æœ€çµ‚é˜²è¡›ç·šçš„ã«å¼·åŠ›ãªåŠ¹æžœãŒã‚ã‚‹ã€‚ ã—ã‹ã—ç‰¹ã«ã‚µãƒ¼ãƒãƒ¼ã‹ã‚‰ã®å€¤ã®å—ã‘æ¸¡ã—éƒ¨åˆ†ãªã©ã§ã©ã†ã—ã¦ã‚‚inline scriptã‚’ä½¿ã„ãŸããªã‚‹ã¨ã“ã‚ãŒã‚ã‚Šã€unsafe-inlineã‚’ç¦æ¢ã™ã‚‹ã¨DOM dataç‰ã‚’ä½¿ã‚ã–ã‚‹ã‚’å¾—ãšã€ã¤ã‚‰ã„æ„Ÿã˜ã ã£ãŸã€‚ @kazuho ã§ã™ãã€‚ã‹ã¨ã„ã£ã¦DOM dataã‹ãƒ¼ã€ã€ã¨ã„ã†æ„Ÿã˜ã§ã¯ã‚ã‚‹ã‚“ã§ã™ãŒã€CSPã§inline scriptç¦æ¢ã—ã¡
TokyoIncidents 2014/11/12
browser

security
ãƒªãƒ³ã‚¯
ãƒ–ãƒ©ã‚¦ã‚¶ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ä¿å˜ã¨è‡ªå‹•ãƒ•ã‚£ãƒ«ã‚¤ãƒ³ - Cybozu Inside Out | ã‚µã‚¤ãƒœã‚¦ã‚ºã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ãƒ–ãƒã‚°
ã“ã‚“ã«ã¡ã¯ã€é–‹ç™ºéƒ¨ã®æ¸¡è¾ºã§ã™ã€‚ ã€Œæœ€è¿‘ã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚¤ãƒ³ãƒ—ãƒƒãƒˆã®autocompleteå±žæ€§å‘¨ã‚ŠãŒç››ã‚Šä¸ŠãŒã£ã¦ã‚‹ã‚ˆã€ã¡ã‚‡ã£ã¨èª¿ã¹ã¦ã‚ˆã€ã¨ã„ã†è©±ã‚’é ‚ã„ãŸã®ã§ã€ç¾æ™‚ç‚¹ã§ã®å„ãƒ–ãƒ©ã‚¦ã‚¶ã®æŒ™å‹•ã‚’ã•ã£ãã‚Šã¨èª¿ã¹ã¦çµæžœã‚’è¨˜ã—ã¾ã™ã€‚ èƒŒæ™¯ 6æœˆã«ãƒªãƒªãƒ¼ã‚¹ã•ã‚ŒãŸFirefox 30ã®å¯¾å¿œã«ã‚ˆã£ã¦ã€ã»ã¨ã‚“ã©ã®ãƒ¢ãƒ€ãƒ³ãƒ–ãƒ©ã‚¦ã‚¶ã§ã¯autocomplete=offã«ã—ã¦ã‚‚ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãƒžãƒãƒ¼ã‚¸ãƒ£ã¸ã®ä¿å˜ã‚’ç¦æ¢ã™ã‚‹ã“ã¨ã¯ã§ããªããªã‚Šã¾ã—ãŸ1ã€‚ ã—ã‹ã—ã€ä¿å˜ã•ã‚ŒãŸãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒã‚¤ãƒ³ãƒ—ãƒƒãƒˆã«ãƒ•ã‚£ãƒ«ã‚¤ãƒ³ã•ã‚Œã‚‹æŒ™å‹•ã¯ãƒ–ãƒ©ã‚¦ã‚¶ã”ã¨ã«å¾®å¦™ã«ç•°ãªã‚Šã¾ã™ã€‚ã™ã§ã«å¹¾ã¤ã‹ã®è¨˜äº‹2ã§è¨€åŠã•ã‚Œã¦ã„ã‚‹å†…å®¹ã§ã¯ã‚ã‚Šã¾ã™ãŒï¼ˆäºŒç•ªç…Žã˜æ„Ÿã«æº¢ã‚Œã¦ã¦ã”ã‚ã‚“ãªã•ã„ï¼‰ã€è¤‡æ•°ã®ãƒ–ãƒ©ã‚¦ã‚¶ã§å‹•ä½œã‚’ç¢ºèªã™ã‚‹ä¸ã§ã€æ§˜ã€…ãªæ¡ä»¶ãŒã‚ã£ãŸã®ã§ã€ãã‚Œã‚‰ã‚’ã¾ã¨ã‚ã¦ã¿ã‚ˆã†ã¨æ€ã„ã¾ã™ã€‚ èª¿æŸ»å†…å®¹ ä»Šå›žèª¿ã¹ã‚‹å…·ä½“çš„ãªå†…å®¹ã¯ã€ã€Œãƒ–ãƒ©ã‚¦ã‚¶ã«ä¿å˜ã•ã‚ŒãŸãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒè‡ªå‹•ãƒ•ã‚£ãƒ«ã‚¤ãƒ³ã•ã‚Œã‚‹æ¡ä»¶ã€ã§ã™ã€‚
TokyoIncidents 2014/07/16
browser

security

cybozu
ãƒªãƒ³ã‚¯
Google Safe Browsing ã¨åŸ‹ã‚è¾¼ã¿ãƒªã‚½ãƒ¼ã‚¹ã®é–¢ä¿‚
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
TokyoIncidents 2013/03/07
security

browser
ãƒªãƒ³ã‚¯
1