HN discussi0n
安全 Digest:
- Rails coders, I remind you the very last time :) Run 命令（する） Find ".to_json" agains your 'app/見解（をとる）s' and please sanitize it, I つまずく upon 事例／患者 2 from my Rails & 安全 talk really often.
- Use JSONP only with unique 記念品 per 使用者. Don't give out 私的な data 経由で static URL.
- It goes without 説 but.. 本気で, Regexp /^http://www.場所／位置.com/ is not enough to mitigate CSRFs (Yeah, also if you are rubyist you should use \A instead of ^! Rails has 思い出の品 now https://github.com/rails/rails/pull/6671) Why? Because http://www.場所／位置.com.hacker.com and http://www.場所／位置.com@hacker.com both are legit domains too. Do 追加する "\/" in the end of your Regexp. Anyway, don't rely on Referer.
- X-でっちあげる，人を罪に陥れる-選択s (XFO) （犯罪，病気などの）発見 from Javascript
- I 設立する out that 'autofocus onfocus=注入する' is a really nice vector and 作品 広大な／多数の／重要な. Thanks .mario's html5sec.org, some of 事例／患者s over there are really 価値（がある） getting 演説（する）／住所d.
- This is new section, please 減少（する） me a line homakov@gmail.com if you have any epic thing about 安全 :3
現在の status:
On the left - Me, pointing さまざまな problems, 餓死するing to get feedback and 提案するing some 直す／買収する，八百長をするing in a painless way.
On the 権利 - browsers, ruby, community, whatever's 返答 :)
On the left - Me, pointing さまざまな problems, 餓死するing to get feedback and 提案するing some 直す／買収する，八百長をするing in a painless way.
On the 権利 - browsers, ruby, community, whatever's 返答 :)
 |
Look, web 安全 is all about philosophy and 概念. Root of plenty of the problems is a poor problem 解答/design or irresponsible 追加するing of new features.
When browsers 器具／実施する a new feature they should also care how it'll work along with 存在するing websites, ーに関して／ーの点でs of 安全 too.
Cross POST 明白に breaks Web.
I used words and 活動／戦闘s to 証明する my point that POST CSRF is just a really poor part of Web but barely got 後継する.
Yeah, I was always talking only about POST, CSRF GET is 承認する. Some guys answer "Browser should not 扱う requests, there is no difference between GET and POST or whatever for him".
There is difference, they just work in the different ways and are supposed to do the different things. Dear browser, please care about that.
There is difference, they just work in the different ways and are supposed to do the different things. Dear browser, please care about that.
This time (I hope last time because I'm tired to get 支援する to the 支配する over and over) I 引用する wikipedia.
Per RFC 2616, the POST method should be used for any 状況 in which a request is 非，不，無-idempotent: that is, it 原因（となる）s a change in server 明言する／公表する each time it is 成し遂げるd, such as submitting a comment to a blog 地位，任命する or 投票（する）ing in an online 投票.Site1 原因（となる）s "a change in server 明言する／公表する" on Site2. Read again, it's vanilla English: "such as submitting a comment to a blog 地位，任命する or 投票（する）ing in an online 投票". It's 明確に not supposed that Site1 will 投票（する） for you (hi putin).
How to explain an obvious thing? I'm exhausted. Just 否定する cross POST, make it 接近-支配（する）／統制する-許す-Origin based (同様に as XHR2 作品), in 新規加入 developers should 取って代わる it with cross GET when possible (all analytics work that way). And it will be over. The worst web vulnerability (の中で "fixable" vulns, XSS and SQL 注入する are not fixable that 平易な) would be 直す／買収する，八百長をするd 即時に.
でっちあげる，人を罪に陥れるs and Clickjacking. In 2012?
Do you want to find pictures of you on the first page of some stupid magazine w/o your 是認? I don't. Nobody does.
In the Internet it happens: Site1 含むs Site2 or Site3 or them all in でっちあげる，人を罪に陥れるs and this is an 絶対 silly allowance ーに関して／ーの点でs of 安全. Neither Site2 nor site3 want to be shown on Site1. They really don't want it BY DEFAULT 明白に.
I know only one "good" usage of cross でっちあげる，人を罪に陥れるs - google images. It 負担s page with 初めの page in the background 層. Silly 解答: the 場所／位置 thinks you are visiting it + it will not work with framekillers or X-でっちあげる，人を罪に陥れる-選択s + GET CSRF attack is possible not by 目的 etc + you don't interact with the website anyhow = much better to use Screenshots instead of the 'trick'.
現実に google already has screenshots of all pages - please, use them, 承認する?
Clickjacking and cross でっちあげる，人を罪に陥れるing (which is 簡単に senseless 'feature') are getting worse:
sandbox せいにする
This せいにする turns JS in the でっちあげる，人を罪に陥れる off. Framekillers (only whitelist-based helps) just don't work. But without JS clickjacking is not working.
Wait! Most of Web2.0 websites use unobtrusive JS - even w/o JS they work 井戸／弁護士席. So just 供給する sandbox='許す-forms' to make <form> submissions work and enjoy clickjacking!
seamless
This せいにする 目的（とする）s to 除去する all 国境s - to make でっちあげる，人を罪に陥れる look as native as possible. It does a 広大な／多数の／重要な 好意 for phishing websites. I have seen it in 活動／戦闘 (smth like g00gle.com.co.co.com used my profile picture) and this is wonderful - any square on any website can be embedded in your 場所／位置.
"seamless - making UI 是正するing clickjacking good looking since HTML5". WTF?
Below is seamless でっちあげる，人を罪に陥れる for m.vk.com with turned off JS. でっちあげる，人を罪に陥れる looks pretty native and trustful.
Content Type 匂いをかぐing Problem.
Don't you remember 'breaking news' a few years ago: "JSON Arrays 漏れる!". I hope you do, read the 地位，任命する from John Resig if you don't. Now I wonder: Why they patched it by changing Javascript interpreter instead of 直す／買収する，八百長をするing the real problem - browsers 匂いをかぐ content-type?
Web 開発 is not for idiots. But why browsers assume that developer is lame idiot? Why browsers are trying to 解釈する／通訳する text/html, text/plain, 使用／適用/json, images and whatever?
We 始める，決める proper Content-Type to 明確に tell you what 肉親，親類d of content is inside. And if this is 使用／適用/json I think it is 明白に not JS (使用／適用/javascript), isn't it?
Yet another 安全 header has been introduced to "直す／買収する，八百長をする" this 問題／発行する in IE - X-Content-Type-選択s:nosniff which 現実に is useless and doesn't work in chrome. text/html is 遂行する／発効させるd assuming it's JS.
Proof of 概念 - some server 答える／応じるs with plain data (not in JSON/XML) thus it likely will not raise Syntax error. Google Wallet 返答 is text/html '承認する' which is also valid JS. Login （犯罪，病気などの）発見:
window.
文書.
Anti-XSS 保護 or Yet Another Nice 道具 for Defacing & 偉業／利用するing
Some info about X-XSS-保護 header.
X-XSS-保護 is ーするつもりであるd to be a header to 支配（する）／統制する XSS Auditor in Chrome and IE - it just checks does the 返答 含む／封じ込める some param from request and if attack is （悪事，秘密などを）発見するd all URLs are 取って代わるd with 'about:blank' and XSS <script></script> tags are 除去するd.
Let's 逆転する it - you can easily get rid of ANY script/inline event(onclick,onmouseover)/link with 'javascript:' just passing a few lines of that code in request params. Browser thinks that XSS is happening and 除去するs those "XSSed" parts, which are just native parts of the website.
We can easily run some page w/o jQuery library, without validators.js or onclick=誘発する('are you sure?') 簡単にするing clickjacking. It's up to you how to get 利益（をあげる） from the 'feature'.
Getting rid of Google Adsense:
http://www.SITE.com/?ads_go_away=%3Cscript%20type%3D%22text%2Fjavascript%22%20src%3D%22http%3A%2F%2Fpagead2.googlesyndication.com%2Fpagead%2Fshow_ads.js%22%3E
I also don't like framekillers. I got to switch JS off with 'sandbox'. But websites are often broken without JS... 解答!
Let's 単に 除去する the annoying framekiller and leave JS alone! Showcase — 動きやすい 見解／翻訳／版 of vk.com (russian facebook) — m.vk.com
<form method=地位，任命する 活動／戦闘="http://m.vk.com" 的=ifr><textarea 指名する="get_rid_of_framekiller"></textarea></form><iframe 指名する=ifr></iframe>
Paste in textarea and 服従させる／提出する. Enjoy clickjacking with working JS and 封鎖するd framekiller.
<script type="text/javascript">parent&&parent!==window&&(文書.getElementsByTagName('団体／死体')[0].innerHTML='');
There was popular phishing through <img src=basicauth> a while ago. Now that's 直す／買収する，八百長をするd in Chrome but it still 作品 when you click any link.
Recap:
- Cross POST. Make it work as XHR2 POST 作品 (Origin — based).
Backwards incompatibility: 無 (there are no "good" websites relying on cross POST). But sadly I feel it will never be done. - 始める，決める default X-でっちあげる，人を罪に陥れる-選択s to SAMEORIGIN. 妨げるs ALL 肉親，親類d of clickjacking/でっちあげる，人を罪に陥れる busters 破産した／（警察が）手入れするing: UI 是正するing, transparent 層, drag and 減少（する） (direct and 逆転するd), XSS 偉業／利用する 経由で でっちあげる，人を罪に陥れる src etc..
Backwards incompatibility: 活動／戦闘s must be taken carefully - We should 要求する all pages those want to be appeared to send X-でっちあげる，人を罪に陥れる-選択s: ALLOWALL and some day (probably in a year) 否定する cross でっちあげる，人を罪に陥れるs if X-でっちあげる，人を罪に陥れる-選択s is not ALLOWALL. It must be 演説（する）／住所d because of incredible prevalence of "攻撃を受けやすい" 場所／位置s. Very tiny パーセント of 場所／位置s uses X-でっちあげる，人を罪に陥れる-選択s. The web will be saved and safer. - XSS Auditors are 現実に helpful — I have seen it 'in 活動／戦闘' and was impressed! But it's also harmful for now. We need to make them better by making 2 simple things:
1. default to '1; 方式=封鎖する' instead of 現在の '方式=除去する 注入するd scripts'. I see no sense to show 妥協d page to 使用者.
2. we should 警告する 使用者s as we 警告する them about insecure SSL cert. Redirect to about:blank is bad 使用者 experience.
Backwards incompatibility: 無. - sandbox せいにする. Why do we need it at all? It is useless but harmful. Site1 switches off JS for site2. Try to be in site2's shoes, it's like 存在 naked :)
Backwards incompatibility: approx. 無. It's HTML5 せいにする, not 器具／実施するd everywhere thus not used. - browsers should be more strict with Content-Type. HTML and JSON Hashes raise syntax error when 含むd in <script>. But who knows what doesn't raise and which data can 漏れる in the 未来?
Backwards incompatibility: Low
Finally — we see '安全 is optional' 態度 too often.
Don't forget to 始める，決める X-でっちあげる，人を罪に陥れる-選択s='SAMEORIGIN', X-Content-Type-選択s='nosniff' and also X-XSS-保護='1;方式=封鎖する' which 現実に must be default for 99% of 場所／位置s.
Don't forget to 妨げる cross POST 立証するing 記念品s, make sure all your links point to 的=_blank.
除去する framekillers — they are broken and useless now.
It seems browsers don't want to do this for us. Let's ask them?
Any feedback is welcome (grammar 関係のある either), we must leave SaferWeb for our kids and for this kitten's sake.
Looks epic, dude.
Reply削除するI told that he must 令状:
Reply削除するIN SOVIET RUSSIA
@
ANTI-XSS PROTECTION ATTACKS YOU
but he answered "Im too busy, bro. Needto 料金d my 耐える with vodka"
@anon
Reply削除するI 料金d beer with vodka. Cocktail beer+vodka=ERSH
Миру станет лучше, если это же самое появится на хорошей 安全-конференции в еще более обобщенной форме.
Reply削除するX-でっちあげる，人を罪に陥れる-選択s='SAMEORIGIN' ? Its better to use DENY than SAMEORIGIN, unless さもなければ explicitly needed.
Reply削除する@i Sciurus hmm I hardly can visit some conf 権利 away
Reply削除する@Nafeez: yes, to SAMEORIGIN. DENY will definitely BREAK lots of でっちあげる，人を罪に陥れる-based websites. But SAMEORIGIN is perfect 選択
@Egor: What do you think about this? http://www.skeletonscribe.逮捕する/2012/06/x-でっちあげる，人を罪に陥れる-選択s-sameorigin-警告.html
Reply削除する@Nafeez I don't think it's an 問題／発行する. never seen it in real life
Reply削除する