ä¸æ£ãªSSLè¨¼æ˜Žæ›¸ã‚’è¦‹ç ´ã‚‹Public Key Pinningを試㙠- ã¼ã¡ã¼ã¡æ—¥è¨˜å…ˆæ—¥ã®ã‚¨ãƒ³ãƒˆãƒªãƒ¼ 「TLSã¨SPDYã®é–“ã§Google ChromeãŒãƒãƒžã£ãŸè„†å¼±æ€§(CVE-2014-3166ã®è§£èª¬)ã€ã§äºˆå‘Šã—ãŸé€šã‚Šã€ä»Šå›žä¸æ£ãªSSLè¨¼æ˜Žæ›¸ã‚’è¦‹ç ´ã‚‹ Public Key Pinningã®æ©Ÿèƒ½ã«ã¤ã„ã¦è§£èª¬ã—ã¾ã™ã€‚ Public Key Pinning ã¯2種類ã®æ–¹æ³•ãŒã‚ã‚Šã¾ã™ã€‚ã‚らã‹ã˜ã‚ブラウザーã®ã‚½ãƒ¼ã‚¹ã‚³ãƒ¼ãƒ‰ã«å…¬é–‹éµæƒ…å ±ã‚’åŸ‹ã‚込む Pre-loaded public key pinning ã¨ã€ã‚µãƒ¼ãƒã‹ã‚‰HTTPヘッダã§ãƒ–ラウザã«å…¬é–‹éµæƒ…å ±ã‚’é€šçŸ¥ã™ã‚‹HTTP-based public key pinning (HPKP)ã®ï¼’ã¤ã§ã™ã€‚ Chromeã¯æ—¢ã«ä¸¡è€…ã®æ©Ÿèƒ½ã‚’実装済ã§ã™ãŒã€ã¡ã‚‡ã†ã©è¿‘日リリースã•ã‚Œã‚‹ Firefox 32 ã® Stable ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‹ã‚‰ Pre-loaded public key pinning ãŒå®Ÿè£…ã•ã‚Œã¾ã—ãŸã€‚Firefox32リリース記念ã¨
è‡ªå •è½ãªæŠ€è¡“者ã®æ—¥è¨˜ : JRE 1.4-1.6ã‚„Androidã®APIを使ã£ãŸHTTPS接続ã®CipherSuitesãŒRC4-MD5を優先ã—ã¦ã„ã‚‹ã‹ãªã‚Šãƒ¤ãƒã„話 - livedoor Blog（ブãƒã‚°ï¼‰
{{#tags}}- {{label}}
{{/tags}}