iOS Security Tutorial — Part 1
On March 25th 2019, Apple announced its new consumer U.S. credit card issued by Goldman Sachs “Apple Cardâ€. They pointed out that for every Apple Card, there’s a unique per device card number that is created and stored safely in the device’s secure element & that every purchase is authenticated with Touch ID or Face ID. The purpose of this tutorial is to further elaborate what is the iOS device’s
Certificate pinning technique on iOS
Hi, folks! Today we are going to talk about security. To completely comprehend these concepts presented here I need to provide some background knowledge about how SSL/TLS works and other stuff. Of course, it is not a deep dive, it is just a simple explanation before starting the main subject, if you already know it, it is ok, just step out this part and go to next section. At the final we are goin
SSL/TLSãƒã‚´ã‚·ã‚¨ãƒ¼ã‚·ãƒ§ãƒ³
◆　SSL/TLSセッションã®ãƒãƒ³ãƒ‰ã‚·ã‚§ã‚¤ã‚¯ SSLクライアントã¨SSLサーãƒã¨ã§ã‚„ã‚Šã¨ã‚Šã•ã‚Œã‚‹ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã®ãªã‹ã§ã€ä»¥ä¸‹ã®ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã«ã¤ã„ã¦ã¯ ã‚„ã‚Šã¨ã‚Šã‚’çœç•¥ã—ãŸé€šä¿¡ãŒè¡Œã‚ã‚Œã‚‹å ´åˆã‚‚ã‚ã‚Šã¾ã™ã€‚ ・　Server Certificate ・　Server Key Exchange ・　Certificate Request ・　Client Certificate ・　Certificate Verify 例ãˆã°ã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆè¨¼æ˜Žæ›¸ã‚’使用ã—ãªã„SSL通信ã§ã‚ã‚Œã°ã€ŒClient Certificateã¨Certificate Verifyã€ãŒçœç•¥ã€‚ ◆　SSL/TLSã®ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ ・　Client Hello SSLã®é€šä¿¡é–‹å§‹ã‚’クライアントã‹ã‚‰ã‚µãƒ¼ãƒã«é€šçŸ¥ã™ã‚‹ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã€‚メッセージã«å«ã¾ã‚Œã¦ã„る内容ã¯ä»¥ä¸‹ã§ã™ã€‚ ⇒　SSL/TLSã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã€ä¹±æ•°ã€ã‚»ãƒƒã‚·ãƒ§ãƒ³IDã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãŒåˆ©ç”¨ã§ãã‚‹æš—å·
Content Security Policy | é…’ã¨æ¶™ã¨Rubyã¨Railsã¨
HTTPヘッダã«Content Security Policy(CSP)を組ã¿è¾¼ã‚€ã“ã¨ã§æ¬¡ã®ã“ã¨ãŒã§ãã¾ã™ã€‚ CSPã§ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã®æ供元ã®ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚„å–得方法(HTTPSãªã©)を制é™ã§ãã¾ã™ XSSやデータインジェクションãªã©ã®æ”»æ’ƒã‚’検出ã§ãã¾ã™ レãƒãƒ¼ãƒˆãƒ¢ãƒ¼ãƒ‰ã‚’使ã£ã¦ã€Mixed Contentã®æ—©æœŸç™ºè¦‹ã§ãã¾ã™ 🎃 利用例特定ã®URLã‹ã‚‰ã ã‘スクリプトをå–得次ã®HTTPヘッダをè¨å®šã™ã‚‹ã¨ã€è‡ªåˆ†è‡ªèº«ã¨apis.google.com以外ã‹ã‚‰ã®ã‚¹ã‚¯ãƒªãƒ—トã®èªã¿è¾¼ã¿ã§ã‚¨ãƒ©ãƒ¼ã‚’è¿”ã—ã¾ã™ã€‚
Ruby on Rails - OWASP Cheat Sheet Series
Ruby on Rails Cheat Sheet¶ Introduction¶ This Cheatsheet intends to provide quick basic Ruby on Rails security tips for developers. It complements, augments or emphasizes points brought up in the Rails security guide from rails core. The Rails framework abstracts developers from quite a bit of tedious work and provides the means to accomplish complex tasks quickly and with ease. New developers, th
Mozilla Observatory
📣︎ Heads up! New security scoring standards apply - Your website grade may have changed. MDN Observatory will launch soon. Learn More. The Mozilla Observatory has helped over 240,000 websites by teaching developers, system administrators, and security professionals how to configure their sites safely and securely.
Rails ã‚»ã‚ュリティガイド | Rails ガイド
ã“ã®ãƒžãƒ‹ãƒ¥ã‚¢ãƒ«ã§ã¯ã€Webアプリケーション全般ã«ãŠã‘ã‚‹ã‚»ã‚ュリティã®å•é¡Œã¨ã€Railsã§ãれらã®å•é¡Œã‚’回é¿ã™ã‚‹æ–¹æ³•ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ ã“ã®ã‚¬ã‚¤ãƒ‰ã®å†…容: 本ガイドã§å–り上ã’られã¦ã„ã‚‹å•é¡Œã«å¯¾ã™ã‚‹ã‚ã‚‰ã‚†ã‚‹å¯¾ç– Railsã«ãŠã‘るセッションã®æ¦‚念ã€ã‚»ãƒƒã‚·ãƒ§ãƒ³ã«å«ã‚ã‚‹ã¹ãé …ç›®ã€æœ‰åãªã‚»ãƒƒã‚·ãƒ§ãƒ³æ”»æ’ƒ Webサイトを開ãã ã‘ã§ï¼ˆCSRFã«ã‚ˆã‚‹ï¼‰ã‚»ã‚ュリティå•é¡ŒãŒç™ºç”Ÿã™ã‚‹ã—ã㿠ファイルã®å–扱ã„上ã®æ³¨æ„ã€ç®¡ç†ã‚¤ãƒ³ã‚¿ãƒ¼ãƒ•ã‚§ã‚¤ã‚¹ã‚’æä¾›ã™ã‚‹éš›ã®æ³¨æ„äº‹é … ユーザーをæ£ã—ã管ç†ã™ã‚‹ï¼ˆãƒã‚°ã‚¤ãƒ³ãƒ»ãƒã‚°ã‚¢ã‚¦ãƒˆã®ã—ãã¿ã€ã‚らゆるレイヤã«ãŠã‘る攻撃方法） 最も有åãªã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³æ”»æ’ƒæ–¹æ³•ã®è§£èª¬ 1 ã¯ã˜ã‚ã« Webアプリケーションフレームワークã¯ã€Webアプリケーションã®é–‹ç™ºã‚’支æ´ã™ã‚‹ãŸã‚ã«ä½œã‚‰ã‚Œã¾ã—ãŸã€‚フレームワークã®ä¸ã«ã¯ã‚»ã‚ュリティを比較的高ã‚ã‚„ã™ã„ã‚‚ã®ã‚‚ã‚ã‚Šã¾ã™ã€‚実際ã®ã¨ã“ã‚ã€ã‚るフレームワークã¯ä»–ã®ã‚ˆã‚Šã‚‚安
ã“ã‚Œã ã‘ã§ã‚¤ã‚¤ã€Rails5ã§APIサーãƒã‚’作るã¨ãã®CORSè¨å®š - Qiita
Railsã§APIサーãƒã‚’作るã¨ãã«ãƒ•ãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰ãƒ»ã‚¢ãƒ—リケーションã¨ã®é€£æºã§å‡ºã¦ããŒã¡ãªCORSã®è¨å®šã€‚ 毎回調ã¹ã‚‹ã®ãŒã‚ã‚“ã©ãã•ã„ã®ã§ã€ã‚»ã‚ュリティè¦ä»¶çš„ã«ã‚‚テã‚トウã«ã™ã‚‹ã‚ã‘ã«ã¯ã„ã‹ãªã„ã“ã®CORSã®ã€Œã¨ã‚Šã‚ãˆãšã“ã‚Œã ã‘ã‚„ã£ã¦ãŠã‘ã°OKã€ãªè¨å®šã‚’Railsã¨JavaScriptã®å®Ÿè£…ã¨ä¸€ç·’ã«èª¬æ˜Žã—ã¾ã™ã€‚ CORSã¨ã¯ï¼Ÿ CORSã¯æ—¥æœ¬èªžã§ã¯HTTPアクセス制御ã®ã“ã¨ã§ã€ç°¡å˜ã«è¨€ã†ã¨è¨±å¯ã•ã‚Œã¦ã„ãªã„ウェブサイトã‹ã‚‰ã®ã‚¢ã‚¯ã‚»ã‚¹ã‚’ブãƒãƒƒã‚¯ã™ã‚‹ã“ã¨ã§æ‚ªæ„ã®ã‚るアクセスを防ããŸã‚ã®æ©Ÿæ§‹ã§ã™ã€‚ rack-corsã‚’å°Žå…¥ ã“ã®è¨˜äº‹ã§ã¯ã€ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§Railsã®ã‚¢ãƒ—リケーションã®ä¸ã«ç”Ÿæˆã•ã‚Œã‚‹config/initializers/cors.rbã¨ã„ã†ãƒ•ã‚¡ã‚¤ãƒ«ã«å¾“ã£ã¦ã€rack-corsを使ã„ã¾ã™ã€‚ ã¾ãšã¯Gemfileã«ä»¥ä¸‹ã‚’追記ã—ã¦ã€rack-corsをインストール
Railsã®CSRF対ç–ã®ä»•çµ„ã¿ã«ã¤ã„㦠- （2015å¹´ã¾ã§ã®ï¼‰odaillyjp blog
先日ã€Rails ã§é–‹ç™ºã—ã¦ã„ã‚‹ã¨ãã«æ„図ã—ãªã„ InvalidAuthenticityToken エラーãŒç™ºç”Ÿã—ã¦ã€ã™ã”ããƒãƒžã£ã¦ã—ã¾ã„ã¾ã—ãŸã€‚ãã®ã¨ãã« Rails ã®CSRF対ç–ã®ä»•çµ„ã¿ã«ã¤ã„ã¦èª¿ã¹ã¦ã¿ã¾ã—ãŸã®ã§ã€ãƒ–ãƒã‚°ã«æ®‹ã—ã¦ãŠãã¾ã™ã€‚ Rails ã®CSRFå¯¾ç– Rails ãŒç”Ÿæˆã—㟠ApplicationController ã«ã¯ä»¥ä¸‹ã®è¨˜è¿°ãŒã‚ã‚Šã¾ã™ã€‚ class ApplicationController < ActionController::Base # Prevent CSRF attacks by raising an exception. # For APIs, you may want to use :null_session instead. protect_from_forgery with: :exception end protect_from_forg
What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?
I am responsible for maintaining two Debian servers. Every time I have to do anything with security certificates, I Google for tutorials and beat away until it finally works. However, in my searches I often come across different file formats (.key, .csr, .pem) but I've never been able to find a good explanation of what each file format's purpose is. I was wondering if the good folks here at Server
Same-Origin Policy ã¨ã¯ä½•ãªã®ã‹ã€‚ - 葉ã£ã±æ—¥è¨˜
ã¡ã‚‡ã£ã¨å‡ã£ãŸWebアプリケーションを作æˆã—ã¦ã„ãŸã‚Šã€ã‚ã‚‹ã„ã¯Webã®ã‚»ã‚ュリティã«é–¢ã‚ã£ã¦ã„る人ãªã‚‰ã°ã€ŒSame-Origin Policyã€(SOP)ã¨ã„ã†è¨€è‘‰ã‚’一度ã¯èžã„ãŸã“ã¨ãŒã‚ã‚‹ã¨æ€ã„ã¾ã™ã€‚日本語ã§ã¯ã€ŒåŒä¸€ç”Ÿæˆå…ƒãƒãƒªã‚·ãƒ¼ã€ã‚ã‚‹ã„ã¯ã€ŒåŒä¸€ç”Ÿæˆæºãƒãƒªã‚·ãƒ¼ã€ãªã©ã¨è¨³ã•ã‚Œã‚‹ã“ã¨ã‚‚ã‚ã‚Šã¾ã™ãŒã€å€‹äººçš„ã«ã¯ã€Œã‚ªãƒªã‚¸ãƒ³ã€ã¯å›ºæœ‰ã®æ¦‚念を表ã™èªžãªã®ã§ä¸‹æ‰‹ã«è¨³ã•ãšã€ŒåŒä¸€ã‚ªãƒªã‚¸ãƒ³ãƒãƒªã‚·ãƒ¼ã€ã¨æ›¸ã„ã¦ãŠãã®ãŒå¥½ãã§ã™ã€‚ ã•ã¦ã€ã“ã®ã€Œã‚ªãƒªã‚¸ãƒ³ã€ã¨ã¯ä½•ãªã®ã‹ã¨ã„ã†è©±ã§ã™ãŒã€ã“ã‚Œã¯ã€ŒRFC 6454 - The Web Origin Conceptã€ã§å®šã‚られã¦ãŠã‚Šã€ç«¯çš„ã«è¨€ã†ã¨ã€Œã‚¹ã‚ームã€ãƒ›ã‚¹ãƒˆã€ãƒãƒ¼ãƒˆã€ã®çµ„ã¿åˆã‚ã›ã‚’オリジンã¨å®šã‚ã€ãれらãŒåŒã˜ã‚‚ã®ã¯åŒä¸€ã®ã‚ªãƒªã‚¸ãƒ³ã¨ã—ã¦åŒã˜ä¿è·ç¯„囲ã®ãƒªã‚½ãƒ¼ã‚¹ã¨ã—ã¦å–り扱ã†ã¨ã„ã†ã“ã¨ã§ã™ã€‚ 例ãˆã°ã€http://example.jp/fooã¨http://example.jp:
æƒ…å ±å€«ç†ã¨ã‚»ã‚ュリティã®ãŸã‚ã®ã‚¯ã‚¤ãƒƒã‚¯ã‚¬ã‚¤ãƒ‰
一目ã§åˆ†ã‹ã‚‹æ³¨æ„点をã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚æƒ…å ±å€«ç†ã¨ã‚»ã‚ュリティã«é–¢ã—ã¦ã‚ˆã‚Šè©³ã—ã„内容ã¯ã€æœ¬ç¯‡ã‚’èªã‚€ã‚ˆã†ã«ã—ã¦ä¸‹ã•ã„。分ã‹ã‚Šã‚„ã™ã„Q&Aã‚‚ã¾ã¨ã‚ã¦ã‚ã‚Šã¾ã™ã€‚
公開éµæš—å·ã«ã¤ã„ã¦ç†è§£ãŒè¶³ã‚Šã¦ã„ãªã‹ã£ãŸã®ã§ãƒ¡ãƒ¢ - ã‹ã›ã„ã•ã‚“ã¨ã“
ã“ã‚Œã¯ä½•? github ã«ã‚³ãƒŸãƒƒãƒˆã™ã‚‹æ™‚ã¨ã‹ã€heroku ã«ãƒ‡ãƒ—ãƒã‚¤ã™ã‚‹æ™‚ã¨ã‹ã€ èªè¨¼ã«å…¬é–‹éµä½¿ã†ã‘ã©ã€ã„ã¾ã„ã¡ã¡ã‚ƒã‚“ã¨ç†è§£ã—ã¦ã„ãªã„ã®ã§ã¾ã¨ã‚㟠目次 æš—å·åŒ–ã®æ–¹æ³• 共通éµæš—å· å…¬é–‹éµæš—å· HTTPS TLS/SSL 公開éµè¨¼æ˜Žæ›¸ SSH 公開éµèªè¨¼ 具体的ãªæ‰‹é † æš—å·åŒ–ã®æ–¹æ³• 共通éµæš—å· é€ä¿¡è€…ã¨å—信者ãŒå…±é€šã®ç§˜å¯†éµã‚’æŒã£ã¦ã€æš—å·åŒ–ã¨è¤‡åˆã‚’行ㆠãŸã¨ãˆã°ã“ã‚“ãªæ„Ÿã˜ 平文 : 1234 ç§˜å¯†éµ : 5678 æš—å·åŒ– : 1234 x 5678 æš—å·æ–‡ : 7006652 復å·åŒ– : 7006652 / 5678 é€ä¿¡è€…å´ã¯ã€å¹³æ–‡ã‚’ã€ç§˜å¯†éµã§æš—å·åŒ–ã—ã¦ã€æš—å·æ–‡ã‚’å—信者ã«é€ã‚‹ å—信者ã¯ã€æš—å·æ–‡ã‚’ã€ç§˜å¯†éµã§å¾©å·åŒ–ã—ã¦ã€å¹³æ–‡ã‚’å¾—ã‚‹ 共通éµæš—å·ã®å¼±ç‚¹ 最åˆã«éµã‚’å—信者ã«æ¸¡ã™å¿…è¦ãŒã‚ã‚‹ãŒã€ãã®æ™‚ã«ç›—è´ã•ã‚Œã‚‹ãƒªã‚¹ã‚¯ãŒã‚ã‚‹ 渡ã™æ™‚æš—å·åŒ–ã™ã‚Œã°è‰¯ã„ã‘ã©ã€ãã®æš—å·åŒ–ã®éµã‚’... ã¨ãªã‚‹ 多人数ã§ç§˜å¯†ã®é€š
IPA ã‚»ã‚ュア・プãƒã‚°ãƒ©ãƒŸãƒ³ã‚°è¬›åº§
IPA　独立行政法人 æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ ã‚»ã‚ュリティセンターã«ã‚ˆã‚‹ã‚»ã‚ュア・プãƒã‚°ãƒ©ãƒŸãƒ³ã‚°è¬›åº§ï¼šWebアプリケーション編 & C / C++言語編
Masato Kinugawa Security Blog: Googleã®metaリダイレクトã«å˜åœ¨ã—ãŸå•é¡Œ
Googleã«å˜åœ¨ã—ãŸãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’窃å–ã§ããŸå•é¡Œã«ã¤ã„ã¦æ›¸ãã¾ã™ã€‚ã“ã‚Œã¯2011å¹´1月30æ—¥ã«å ±å‘Šã—ã€å ±å‘Šå¾Œæ•°æ—¥ä»¥å†…ã«ä¿®æ£ã•ã‚ŒãŸå•é¡Œã§ã™ã€‚ ã“ã‚“ãªãƒšãƒ¼ã‚¸ãŒã‚ã‚Šã¾ã—ãŸã€‚ http://example.google.com/redirect?continue=http://example.google.com/xyz <meta http-equiv="refresh" content="0;url='http://example.google.com/xyz'"> <script> location.replace("http://example.google.com/xyz") </script> continueã¨ã„ã†ãƒ‘ラメータã«æŒ‡å®šã•ã‚ŒãŸURLã‚’metaã‚¿ã‚°ã¨location.replace()ã«ãã‚Œãžã‚Œå…¥ã‚Œã¦ã€JavaScriptã®æœ‰åŠ¹/無効ã®è¨å®šã«é–¢ã‚らãšãƒªãƒ€ã‚¤
スマートフォンアプリケーションã§SSLを使ã‚ãªã„ã®ã¯è„†å¼±æ€§ã‹
ã“ã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯ã€ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã‚¢ãƒ—リケーションã®é€šä¿¡æš—å·åŒ–ã®å¿…è¦æ€§ã«ã¤ã„ã¦è°è«–ã—ã¾ã™ã€‚ ã¯ã˜ã‚㫠先日ã€ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã‚¢ãƒ—リケーションã®ã‚»ã‚ュリティã«é–¢ã™ã‚‹ã‚»ãƒŸãƒŠãƒ¼ã‚’è´è¬›ã—ã¾ã—ãŸï¼ˆ2月8日追記。講演者ã‹ã‚‰ã®ä¾é ¼ã«ã‚ˆã‚Šã‚»ãƒŸãƒŠãƒ¼ã®ã‚µã‚¤ãƒˆã¸ã®ãƒªãƒ³ã‚¯ã‚’ã‚‚ã†ã‘ã¾ã—ãŸï¼‰ã€‚ã“ã®éš›ã«ã€ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã‚¢ãƒ—リケーションã®è„…å¨ã«å¯¾ã™ã‚‹å…±é€šèªè˜ãŒã¾ã ãªã„ã¨ã„ã†èª²é¡Œã‚’改ã‚ã¦æ„Ÿã˜ã¾ã—ãŸã€‚ãã®èª²é¡Œã‚’痛感ã§ããŸã¨ã„ã†ç‚¹ã§ã€ã‚»ãƒŸãƒŠãƒ¼ã¯ç§ã«ã¨ã£ã¦ã¯æœ‰ç›Šã§ã—ãŸã€‚ ã“ã®ãŸã‚ã€å½“ブãƒã‚°ã§ã¯ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã‚¢ãƒ—リケーションã®è©±é¡Œã‚’ã‚ã¾ã‚Šå–り上ã’ã¦ã„ã¾ã›ã‚“ã§ã—ãŸãŒã€ä»Šå¾Œã¯ã€ã¨ã‚Šã‚ã’よã†ã¨æ€ã„ã¾ã™ã€‚ã¾ãšã¯ã€ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã‚¢ãƒ—リケーションã§ã¯æš—å·åŒ–ã‚’å¿…é ˆã¨ã™ã‚‹ã¹ãã‹ã¨ã„ã†è©±é¡Œã§ã™ã€‚ã“ã®è©±é¡Œã¯ã€å‰è¨˜ã‚»ãƒŸãƒŠãƒ¼ã§ã‚‚ã¨ã‚Šã‚ã’られã¦ã„ã¾ã—ãŸã€‚ æš—å·åŒ–ã®ç›®çš„ã¯ä½•ã‹ ã¾ãšã€æš—å·åŒ–ã®å¿…è¦æ€§ã‚’è«–ã˜ã‚‹ãŸã‚ã«ã¯ã€æš—å·åŒ–ã®ç›®çš„を明確ã«ã™ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚å‰è¨˜ã‚»ãƒŸ
ランã‚ング
ランã‚ング
ランã‚ング
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
Hide Sensitive Information in the iOS App Switcher Snapshot Image
What is a TLS/SSL certificate and how does it work? | Proton
SECCON2013 slide
HTML5 Security Cheatsheet
{{#tags}}- {{label}}
{{/tags}}