[B! security] manji0112ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

manji0112 id:manji0112

securityã«é–¢ã™ã‚‹manji0112ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (18)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

HTTPS ã§ã‚‚ Full URL ãŒæ¼ã‚Œã‚‹ï¼ŸOAuth ã® code ã‚‚æ¼ã‚Œã‚‹ã‚“ã˜ã‚ƒãï¼Ÿï¼Ÿ - OAuth.jp
ãªã‚“ã§ã™ã‹ã“ã‚Œã¯ï¼ New attack bypasses HTTPS protection on Macs, Windows, and Linux DHCP ã«ã¤ãªãã¨ PAC ãƒ•ã‚¡ã‚¤ãƒ«ãŒãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã•ã‚Œã¦ HTTPS ã§ã‚ã‚ã†ã¨ã‚¢ã‚¯ã‚»ã‚¹å…ˆã® Full URL ã¯æ¼ã‚Œã‚‹ã§ã™ã£ã¦ï¼Ÿ Web Proxy Autodiscovery ã§ã™ã£ã¦ï¼Ÿ ãƒãƒ§ãƒƒãƒˆãƒ‹ãƒ›ãƒ³ã‚´ãƒ‡ã‚ªãƒã‚¬ã‚¤ã‚·ãƒžã‚¹ ã£ã¦ã“ã¨ã§ã€ã¾ãã“ã‚ŒãŒå®Ÿéš›ã©ã‚Œãã‚‰ã„ç°¡å˜ã«å®Ÿç¾ã§ãã‚‹æ”»æ’ƒãƒ‘ã‚¿ãƒ¼ãƒ³ãªã®ã‹ã¯ä»–ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ¥ç•Œã®æ–¹ã€…ã«å¾Œã§èžãã¨ã—ã¦ã€ã“ã®è¨˜äº‹ã§ã‚‚è§¦ã‚Œã‚‰ã‚Œã¦ã‚‹ OpenID Connect ã¨ã‹ OAuth2 ã¸ã®å½±éŸ¿ã«ã¤ã„ã¦ã€ã¡ã‚‡ã£ã¨ã¾ã¨ã‚ã¦ãŠãã¾ã—ã‚‡ã†ã‹ã€‚ Authorization Request & Response ãŒæ¼ã‚Œã‚‹ response_mode=form_post ãªã‚“ã¦ã„ã†ã®ã‚‚ä¸€éƒ¨ã‚ã‚Šã¾ã™ãŒã€åŸºæœ¬ OAuth2 /
manji0112 2016/07/28
security

oauth

openid
ãƒªãƒ³ã‚¯
RESTFulãªAPIã¨CSRFã¨ãã®å¯¾ç– - ã‚·ã‚¢ãƒˆãƒ«ç”Ÿæ´»ã¯ã˜ã‚ã¾ã—ãŸ
Cross-Site Request Forgeryï¼ˆã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ã‚¸ã‚§ãƒªãƒ¼ï¼‰ã£ã¦ä½•ï¼Ÿ é æ–‡å—ã‚’ã¨ã£ã¦ã€ŒCSRFã€ã§ã™ãŒã€å‡ºæ¥ã‚‹ã ã‘å¹³ãŸãèª¬æ˜Žã™ã‚‹ã¨ ã€Œæ‚ªã„ãƒ¤ãƒ„ãŒä½œã£ãŸã‚µã‚¤ãƒˆã‹ã‚‰èªã¿è¾¼ã‚“ã HTMLã‚„ã‚‰ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒã€å‹æ‰‹ã«åˆ¥ã®ã‚µã‚¤ãƒˆã«HTTP POSTã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’é€ä¿¡ã—ã¦ã€çŸ¥ã‚‰ãªã„é–“ã«ãã®ã‚µã‚¤ãƒˆã«ã‚ã‚‹è‡ªåˆ†ã®ãƒ‡ãƒ¼ã‚¿ãªã©ã‚’å¤‰æ›´ã•ã‚Œã‚‹ã€ ã¨ã„ã£ãŸæ„Ÿã˜ã«ãªã‚‹ã‹ãªã€‚ ãƒ‡ãƒ¼ã‚¿ã®ä¸ã«ã¯é‡è¦ãªãƒ‡ãƒ¼ã‚¿ã‚‚ã‚ã‚‹ã§ã—ã‚‡ã†ã€‚Amazonã§æ¬²ã—ã„ç‰©ãƒªã‚¹ãƒˆãŒã‚ã£ãŸã¨ã—ã¦ã€ãã‚ŒãŒå…¨éƒ¨å‹æ‰‹ã«ã€Œè³¼å…¥ã€ã•ã‚ŒãŸã‚‰å›°ã‚Šã¾ã™ã‚ˆãã€‚éŠ€è¡Œã®å£åº§ã‹ã‚‰åˆ¥ã®å£åº§ã«ãŠé‡‘ãŒå…¥é‡‘ã•ã‚Œã¦ã‚‚å›°ã‚Šã¾ã™ã€‚ï¼ˆã‚‚ã¡ã‚ã‚“ã€Amazonã‚„éŠ€è¡Œã®ã‚µã‚¤ãƒˆãªã©ã§ã¯CSRFå¯¾ç–ãŒã—ã£ã‹ã‚Šã¨æ–½ã•ã‚Œã¦ã„ã‚‹ã§ã—ã‚‡ã†ã‹ã‚‰ã€å¤§ä¸ˆå¤«ï¼ãƒ»ãƒ»ã£ã§ã‚ã‚‹ã“ã¨ã‚’ç¥ˆã‚‹ï¼‰ Cross-site ã¨ã¯äºŒã¤ã®ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã‚’è·¨ã„ã§ã‚‹ã“ã¨ã€‚ã‚µã‚¤ãƒˆã®ã²ã¨ã¤ã¯å½“ç„¶ã€Œæ‚ªã„ãƒ¤ãƒ„ã®ã‚µã‚¤ãƒˆã€ã§ã‚‚ã†ã²ã¨ã¤ã¯
manji0112 2016/07/01
RESTFul

API

security
ãƒªãƒ³ã‚¯
OAuth 2.0 Implicit Flowã‚’ãƒ¦ãƒ¼ã‚¶ãƒ¼èªè¨¼ã«åˆ©ç”¨ã™ã‚‹éš›ã®ãƒªã‚¹ã‚¯ã¨å¯¾ç–æ–¹æ³•ã«ã¤ã„ã¦ #idcon - r-weblife
ãŠã¯ã‚ˆã†ã”ã–ã„ã¾ã™ã€ritouã§ã™ã€‚ ä»Šå›žã¯ã€ä¸€éƒ¨ã§å…ˆé€±è©±é¡Œãªã‚Šã¾ã—ãŸOAuth 2.0ã®Implicit Flowã«ã¤ã„ã¦ã®ã‚¨ãƒ³ãƒˆãƒªã«ãªã‚Šã¾ã™ã€‚ (2012/2/7 ã„ã‚ã„ã‚ã¨ä¿®æ£ã—ã¾ã—ãŸã€‚) å˜ãªã‚‹ OAuth 2.0 ã‚’èªè¨¼ã«ä½¿ã†ã¨ã€è»ŠãŒé€šã‚Œã‚‹ã»ã©ã®ã©ã§ã‹ã„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼ãƒ»ãƒ›ãƒ¼ãƒ«ãŒã§ãã‚‹ | @_Nat Zone Thread Safe: The probl em with OAuth for Authentication. ä»Šå›žã¯ä»¥ä¸‹ã®å†…å®¹ã«ã¤ã„ã¦æ•´ç†ã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ OAuth 2.0ã®ã©ã®æ©Ÿèƒ½ã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«ãŒã‚ã‚‹ã®ã‹ èª°ãŒæ”»æ’ƒè€…ã«ãªã‚Œã‚‹ã®ã‹ å¯¾ç– OAuth 2.0 Implicit Flowã¨ã¯ OAuth 2.0ã§ã¯ã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£ãƒ¼ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãŒä¿è·ãƒªã‚½ãƒ¼ã‚¹ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹æ¨©é™ã‚’å¾—ã‚‹ãŸã‚ã®ã„ãã¤ã‹ã®ãƒ•ãƒãƒ¼ãŒå®šç¾©ã•ã‚Œã¦ã„ã¾ã™ã€‚ (ä»•æ§˜ä¸ã§ã¯Flowã‚„Grant Type
manji0112 2015/11/29
OAuth 2.0

security
ãƒªãƒ³ã‚¯
HTTPSè¨å®šãƒ•ã‚¡ã‚¤ãƒ«ç”Ÿæˆãƒ„ãƒ¼ãƒ«0.3(ãƒ™ãƒ¼ã‚¿ç‰ˆ)
HTTPSè¨å®šãƒ•ã‚¡ã‚¤ãƒ«ç”Ÿæˆãƒ„ãƒ¼ãƒ«0.2(ãƒ™ãƒ¼ã‚¿ç‰ˆ) å„ç¨®ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã«å¿œã˜ãŸApacheã‚„nginxãªã©ä¸»è¦ãªã‚µãƒ¼ãƒãƒ¼ã®HTTPSè¨å®šã‚’è‡ªå‹•ç”Ÿæˆã—ã¾ã™ TOP |
manji0112 2015/11/14
security

SSL

ãƒ„ãƒ¼ãƒ«

https
ãƒªãƒ³ã‚¯
TLSæš—å·è¨å®šã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ å®‰å…¨ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®ãŸã‚ã«ï¼ˆæš—å·è¨å®šå¯¾ç–ç·¨ï¼‰ | æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ | IPA ç‹¬ç«‹è¡Œæ”¿æ³•äºº æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹
ã€ŒTLSæš—å·è¨å®šã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã€ã¯ã€TLSã‚µãƒ¼ãƒã®æ§‹ç¯‰è€…ã‚„é‹å–¶è€…ãŒé©åˆ‡ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’è€ƒæ…®ã—ãŸæš—å·è¨å®šãŒã§ãã‚‹ã‚ˆã†ã«ã™ã‚‹ãŸã‚ã®ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã§ã™ã€‚ã€Œæ§˜ã€…ãªåˆ©ç”¨ä¸Šã®åˆ¤æ–ææ–™ã‚‚åŠ å‘³ã—ãŸåˆç†çš„ãªæ ¹æ‹ ã€ã‚’é‡è¦–ã—ã¦ã€TLSé€šä¿¡ã§ã®å®Ÿç¾ã™ã¹ãå®‰å…¨æ€§ã¨å¿…è¦ã¨ãªã‚‹ç›¸äº’æŽ¥ç¶šæ€§ã¨ã®ãƒˆãƒ¬ãƒ¼ãƒ‰ã‚ªãƒ•ã‚’è€ƒæ…®ã—ãŸ3ã¤ã®è¨å®šåŸºæº–ï¼ˆã€Œé«˜ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£åž‹ã€ã€ŒæŽ¨å¥¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£åž‹ã€ã€Œã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¾‹å¤–åž‹ã€ï¼‰ã‚’è¨ã‘ã¦ãŠã‚Šã€å„ã€…ã®è¨å®šåŸºæº–ã«å¯¾å¿œã—ã¦ã€TLSã‚µãƒ¼ãƒã§è¨å®šã™ã¹ãå…·ä½“çš„ãªè¦æ±‚è¨å®šï¼ˆã€Œéµå®ˆé …ç›®ã€ã¨ã€ŒæŽ¨å¥¨é …ç›®ã€ï¼‰ã‚’æ±ºã‚ã¦ãŠã‚Šã¾ã™ã€‚ æœ¬ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã¯å®‰å…¨ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®ä½œã‚Šæ–¹ã¨ã¨ã‚‚ã«é©åˆ‡ãªæš—å·è¨å®šã‚’ã™ã‚‹è³‡æ–™ã®ä¸€ã¤ã¨ã—ã¦ãŠä½¿ã„ã„ãŸã ã‘ã¾ã™ã€‚ ãªãŠã€æœ¬ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã¯ã€æš—å·æŠ€è¡“è©•ä¾¡ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆCRYPTRECã§ä½œæˆã•ã‚Œã¾ã—ãŸã€‚ ã€ŒTLSæš—å·è¨å®šã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã€ã®å†…å®¹ 1ç« ã¨2ç« ã¯ã€æœ¬ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã®ç›®çš„ã‚„SSL/TLSã«ã¤ã„ã¦ã®æŠ€è¡“çš„ãªåŸºç¤ŽçŸ¥è˜ã‚’
manji0112 2015/11/14
SSL

TLS

ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³

security
ãƒªãƒ³ã‚¯
SSL Server Test (Powered by Qualys SSL Labs)
This free online service performs a deep analysis of the configuration of any SSL web server on the public Internet. Please note that the information you submit here is used only to provide you the service. We don't use the domain names or the test results, and we never will.
manji0112 2015/09/24
SSL

test

security
ãƒªãƒ³ã‚¯
ã€ç¿»è¨³ã€‘JSON Web Tokenãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®å±æ©Ÿçš„ãªè„†å¼±æ€§
ã€ç¿»è¨³ã€‘JSON Web Tokenãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®å±æ©Ÿçš„ãªè„†å¼±æ€§ Written on Sep 14, 2015. Posted in Web Techno logies ä»¥ä¸‹ã®å†…å®¹ã¯ã€JSON Web Tokenã‚’æ‰±ã†ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®è„†å¼±æ€§ã«é–¢ã™ã‚‹å ±å‘Šå†…å®¹ã‚’å’Œè¨³ã—ãŸã‚‚ã®ã§ã™ã€‚ https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/ JSON Web Tokenãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®å±æ©Ÿçš„ãªè„†å¼±æ€§ æœ€è¿‘ã€ã„ãã¤ã‹ã®JSON Web Tokenå®Ÿè£…ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦ãƒ¬ãƒ“ãƒ¥ãƒ¼ã—ã¦ã„ãŸé–“ã«ã€ç§ã¯æ¤œè¨¼å‡¦ç†ã‚’ãƒã‚¤ãƒ‘ã‚¹ã™ã‚‹æ”»æ’ƒãŒå¯èƒ½ãªå±æ©Ÿçš„ãªè„†å¼±æ€§ã‚’æŒã¤å¤šãã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã‚’ç™ºè¦‹ã—ã¾ã—ãŸã€‚å¤šãã®å®Ÿè£…ã‚„è¨€èªžã‚’æ¨ªæ–ã—ã¦ã€åŒã˜2ã¤ã®æ¬ é™¥ãŒè¦‹ã¤ã‹ã‚Šã¾ã—ãŸã€‚ãã—ã¦ã€å•é¡ŒãŒèµ·ã“ã‚‹å ´æ‰€ã‚’æ›¸ãä¸Šã’ã‚‹ã“ã¨ãŒåŠ©ã‘ã«ãªã‚‹ã¨
manji0112 2015/09/21
JWT

security
ãƒªãƒ³ã‚¯
Resources - Palo Alto Networks
manji0112 2015/09/12
*ã‚ã¨ã§èªã‚€

security
ãƒªãƒ³ã‚¯
Deprecating Non-Secure HTTP â€“ Mozilla Security Blog
Today we are announcing our intent to phase out non-secure HTTP. Thereâ€™s pretty broad agreement that HTTPS is the way forward for the web. Â In recent months, there have been statements from IETF, IAB (even the other IAB), W3C, and the US Government calling for universal use of encryption by Internet applications, which in the case of the web means HTTPS. After a robust discussion on our community
manji0112 2015/05/01
security

Mozilla

browser
ãƒªãƒ³ã‚¯
æ–‡å—åˆ—ã‹ã‚‰HTMLã‚’çµ„ã¿ç«‹ã¦ã‚‹è©± Shibuya.XSS techtalk #5
manji0112 2015/02/18
xss

javascript

security

HTML
ãƒªãƒ³ã‚¯
Security/Projects/Minion - MozillaWiki
Minion Overview Minion is an open source Security Automation platform. The 0.3 release of Minion allows Development, QA, and Security team members to perform automated web security scans with a set of tools, and re-execute those scans as needed. The 0.3 release incorporates significant changes, including a migration away from Django and Bootstrap to a Flask and Angular.js based application. It als
manji0112 2015/01/31
security

web
ãƒªãƒ³ã‚¯
Paste number 143864: Not a bash bug
I would argue that the bash security concern is not a bug. It is clearly a feature. Admittedly, a misguided and misimplemented feature, but still a feature. The probl em is that it was designed 25 years ago. Apache didn't exist yet for five years! Granted, the internet already existed, but it was still a more confidential club. Security in internet software and protocols were often just not conside
manji0112 2015/01/11
security

unix

software
ãƒªãƒ³ã‚¯
Masato Kinugawa Security Blog: ãƒ–ãƒ©ã‚¦ã‚¶ã®XSSä¿è·æ©Ÿèƒ½ã‚’ãƒã‚¤ãƒ‘ã‚¹ã™ã‚‹
Chromeã‚„Safariã«ã¯XSS Auditorã€IE 8ä»¥ä¸Šã«ã¯XSSãƒ•ã‚£ãƒ«ã‚¿ãƒ¼ã¨ã„ã†ã€XSSã‚’æ¤œçŸ¥ã—ã¦ãƒ–ãƒãƒƒã‚¯ã™ã‚‹æ©Ÿèƒ½ãŒãã‚Œãžã‚Œã‚ã‚Šã¾ã™ã€‚ ä»Šå›žã¯ã€ã“ã‚Œã‚’å›žé¿ã—ã¦ã¿ãŸè¨˜éŒ²ã§ã™ã€‚ ãƒ»Chromeã§ãƒã‚¤ãƒ‘ã‚¹ ã¯ã„ï¼ã¤ã„ãŠã¨ã¨ã„å ±å‘Šã—ãŸã‚„ã¤ã§ã™ï¼ XSS Auditor bypass with U+2028/2029 https://bugs.webkit.org/show_bug.cgi?id=78732 ãªãœã‹Safariã§ã¯ãƒ–ãƒãƒƒã‚¯ã•ã‚Œã‚‹(ä¸ã®äººã‚‚ç†ç”±ãŒã‚ã‹ã‚‰ãªã„ã¨è¨€ã£ã¦ã„ãŸ)ã‚“ã ã‘ã©ã€Chromeã§ã¯å‹•ãã¾ã™ã€‚ä»¥ä¸‹ã§è©¦ã—ã¦ã¿ã¦ãã ã•ã„ã€‚ http://vulnerabledoma.in/char_test?charset=utf-8&xss=1&body=%3Cscript%3E//%E2%80%A8alert(1)%3C/script%3E http://vulnerabled
manji0112 2014/12/31
security

xss

browser
ãƒªãƒ³ã‚¯
ã€ŽAndroidã‚¢ãƒ—ãƒªã®ã‚»ã‚ãƒ¥ã‚¢è¨è¨ˆãƒ»ã‚»ã‚ãƒ¥ã‚¢ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚¬ã‚¤ãƒ‰ã€ã€2013å¹´4æœˆ1æ—¥ç‰ˆã€‘ã‚’å…¬é–‹ã—ã¾ã—ãŸã€‚ - JSSEC | ä¸€èˆ¬ç¤¾å›£æ³•äººæ—¥æœ¬ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å”ä¼š
2022å¹´8æœˆ29æ—¥ ã€ŽAndroidã‚¢ãƒ—ãƒªã®ã‚»ã‚ãƒ¥ã‚¢è¨è¨ˆãƒ»ã‚»ã‚ãƒ¥ã‚¢ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚¬ã‚¤ãƒ‰ã€ã€2022å¹´8æœˆ29æ—¥ç‰ˆã€‘ã‚’å…¬é–‹ã—ã¾ã—ãŸã€‚ ãƒ»ã€ŽAndroid ã‚¢ãƒ—ãƒªã®ã‚»ã‚ãƒ¥ã‚¢è¨è¨ˆãƒ»ã‚»ã‚ãƒ¥ã‚¢ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚¬ã‚¤ãƒ‰ã€ã€2022å¹´8æœˆ29æ—¥ç‰ˆã€‘ ãƒ»ã€Œã‚µãƒ³ãƒ—ãƒ«ã‚³ãƒ¼ãƒ‰ä¸€å¼ã€ã€€ã€2022å¹´8æœˆ29æ—¥ç‰ˆã€‘ å ±é“é–¢ä¿‚å„ä½ JSSECã€ã€ŽAndroidã‚¢ãƒ—ãƒªã®ã‚»ã‚ãƒ¥ã‚¢è¨è¨ˆãƒ»ã‚»ã‚ãƒ¥ã‚¢ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚¬ã‚¤ãƒ‰ã€2022å¹´8æœˆ29æ—¥ç‰ˆã‚’å…¬é–‹ ä¸€èˆ¬ç¤¾å›£æ³•äººæ—¥æœ¬ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å”ä¼š ä¸€èˆ¬ç¤¾å›£æ³•äººæ—¥æœ¬ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å”ä¼šï¼ˆJSSECï¼šä¼šé•· ä½ã€…æœ¨ è‰¯ä¸€ï¼‰ã®æŠ€è¡“éƒ¨ä¼š ã‚»ã‚ãƒ¥ã‚¢ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°WGï¼ˆãƒªãƒ¼ãƒ€ãƒ¼ å®®å´Ž åŠ›ï¼‰ã¯ã€2012å¹´6æœˆã«å…¬é–‹ã—ãŸã€ŽAndroid ã‚¢ãƒ—ãƒªã®ã‚»ã‚ãƒ¥ã‚¢è¨è¨ˆãƒ»ã‚»ã‚ãƒ¥ã‚¢ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã‚¬ã‚¤ãƒ‰ã€ï¼ˆä»¥ä¸‹ æœ¬ã‚¬ã‚¤ãƒ‰ï¼‰ã®14ç‰ˆç›®ã®æ”¹å®šç‰ˆã§ã‚ã‚‹2022å¹´8æœˆ29æ—¥ç‰ˆã‚’å…¬é–‹ã—ã¾ã—ãŸã€‚ â– 2022å¹´8æœˆ29æ—¥ç‰ˆã®æ”¹è¨‚
manji0112 2014/12/21
android

security
ãƒªãƒ³ã‚¯
å¼Šç¤¾ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸æ”¹ã–ã‚“ã«é–¢ã™ã‚‹ãŠè©«ã³ã¨ã”å ±å‘Š | gihyo.jp
å¼Šç¤¾ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ã«ãŠã„ã¦ã€2014å¹´12æœˆ6æ—¥11æ™‚ï½ž14æ™‚ã®ã‚ã„ã ã€ç¬¬ä¸‰è€…ã‹ã‚‰ã®ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã«ã‚ˆã‚Šã‚µã‚¤ãƒˆãŒæ”¹ã–ã‚“ã•ã‚Œã¦ã„ãŸäº‹ãŒåˆ¤æ˜Žã„ãŸã—ã¾ã—ãŸã€‚ã”åˆ©ç”¨é ‚ã„ã¦ãŠã‚Šã¾ã™ãƒ¦ãƒ¼ã‚¶ã®çš†ã•ã¾ã«ãŠã‹ã‚Œã¾ã—ã¦ã¯ã”è¿·æƒ‘ã‚’ãŠæŽ›ã‘ã„ãŸã—ã¾ã—ã¦ã€æ·±ããŠè©«ã³ç”³ã—ä¸Šã’ã¾ã™ã€‚ ãªãŠã€ç¾åœ¨ã¯è¢«å®³ã‚’å—ã‘ãŸã‚µãƒ¼ãƒã¯å¾©æ—§ä½œæ¥ã‚’å®Ÿæ–½æ¸ˆã¿ã§ã™ã€‚ã”åˆ©ç”¨ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®çš†ã•ã¾ã®å€‹äººæƒ…å ±æµå‡ºç‰ã¯ã€ç¾åœ¨ã®ã¨ã“ã‚ç¢ºèªã•ã‚Œã¦ãŠã‚Šã¾ã›ã‚“ã€‚ è¢«å®³å¯¾è±¡ã‚µã‚¤ãƒˆï¼ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ URLï¼šhttp://gihyo.jp æ”¹ã–ã‚“å†…å®¹ã¨ãã®å½±éŸ¿ ã‚µãƒ¼ãƒã®ä¸èº«ã‚’å…¥ã‚Œæ›¿ãˆã‚‰ã‚Œã€å¤–éƒ¨ã®ã‚µã‚¤ãƒˆã«ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã•ã‚Œã‚‹ã‚ˆã†ã«è¨å®šã•ã‚Œã¦ã„ãŸã€‚ ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã•ã‚Œã¦ã„ãŸã‚µã‚¤ãƒˆï¼ˆã‚¢ã‚¯ã‚»ã‚¹ã—ãªã„ã‚ˆã†ã”æ³¨æ„ãã ã•ã„â ï¼‰â www.koushin-lawfirm.net live.livelistingreport.com ç¾åœ¨æŠŠæ¡ã—ã¦ã„ã‚‹æ”¹ã–ã‚“ã•ã‚Œã¦ã„ãŸå¯èƒ½æ€§ãŒã‚ã‚‹æœŸé–“ 2014å¹´12æœˆ6æ—¥
manji0112 2014/12/09
Security
ãƒªãƒ³ã‚¯
Certificate and Public Key Pinning | ã‚°ãƒãƒ¼ãƒãƒ«ã‚µã‚¤ãƒ³ãƒ–ãƒã‚°
Chromeã§ã¯google.comã«ç™ºè¡Œã™ã‚‹æ£è¦ãªèªè¨¼å±€ã‚’Pinningã—ã¦ã„ã¾ã™ã€‚ãŸã¨ãˆã€ä¿¡é ¼ã•ã‚ŒãŸãƒ«ãƒ¼ãƒˆè¨¼æ˜Žæ©Ÿé–¢ã‚¹ãƒˆã‚¢ã«å«ã¾ã‚ŒãŸèªè¨¼å±€ã‹ã‚‰google.comã®è¨¼æ˜Žæ›¸ãŒç™ºè¡Œã•ã‚ŒãŸã¨ã—ã¦ã‚‚ã€Pinning ã®ãƒªã‚¹ãƒˆã«ãªã„å ´åˆã¯è¦å‘Šè¡¨ç¤ºãŒè¡Œã‚ã‚Œã¾ã™ã€‚ã»ã¨ã‚“ã©ã®äººã¯ã“ã®ä»¶ãŒèµ·ãã‚‹ã¾ã§ã€ã“ã®æŠ€è¡“ãŒChromeã«å®Ÿè£…ã•ã‚Œã¦ã„ã‚‹ã“ã¨ã‚’çŸ¥ã‚Šã¾ã›ã‚“ã§ã—ãŸã€‚ ã“ã®ä»¶ãŒãã£ã‹ã‘ã§Pinningã®æœ‰åŠ¹æ€§ã¯ååˆ†ã«èªçŸ¥ã•ã‚Œã€Pinningã‚’ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³å´ã«å®Ÿè£…ã™ã‚‹ã“ã¨ã§CAå´ã«ã‚ˆã‚‹å±æ®†åŒ–ã«ã‚ˆã‚‹ä¸æ£ãªç™ºè¡Œã€ã¾ãŸã¯èª¤ç™ºè¡Œã«ã‚ˆã‚‹ãƒˆãƒ©ãƒ–ãƒ«ã®æ‹¡å¤§ã‚’é˜²ã’ã‚‹ã“ã¨ã¯å®Ÿè¨¼ã•ã‚Œã¾ã—ãŸã€‚ä»Šå¾Œã¯Pinningã®ãƒªã‚¹ãƒˆã‚’æ‹¡å¤§ã—ã¦ã„ãã“ã¨ãŒèª²é¡Œã‹ã¨æ€ã„ã¾ã™ãŒã€IETFã®ãƒ‰ãƒ©ãƒ•ãƒˆã«ãŠã„ã¦ã‚‚æ‹¡å¤§ã«ã¯å•é¡ŒãŒã‚ã‚‹ã¨æç¤ºã•ã‚Œã¦ã„ã¾ã™ã€‚ ä»Šå¾Œã®å‹•ã Pinningã‚’ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚¨ãƒ¼ã‚¸ã‚§ãƒ³ãƒˆæä¾›å´ã«ã¦ãƒãƒ¼ãƒ‰ã‚³ãƒ¼ãƒ‰åŒ–ã—ã€å±•é–‹ã—ã¦ã„ãã«ã¯æ…Žé‡ãªå¯¾å¿œãŒè¦æ±‚
manji0112 2014/07/16
SSL

CA

security
ãƒªãƒ³ã‚¯
https://www.cryptrec.go.jp/exreport/cryptrec-ex-2205-2012.pdf
manji0112 2013/09/06
æš—å·

security

RC4
ãƒªãƒ³ã‚¯
http://www.isg.rhul.ac.uk/tls/TLStiming.pdf
manji0112 2013/09/06
protocol

security
ãƒªãƒ³ã‚¯
1