Your API Shouldn't Redirect HTTP to HTTPS
TL;DR: Instead of redirecting API calls from HTTP to HTTPS, make the failure visible. Either disable the HTTP interface altogether, or return a clear HTTP error response and revoke API keys sent over the unencrypted connection. Unfortunately, many well-known API providers don't currently do so. Updated 2024-05-24: Added the Google Bug Hunter Team response to the report that the VirusTotal API resp
Let's Encryptのルート証明書切替周り(完結編) | おそらくはそれさえも平凡な日々
tl;dr 驚くべきハックにより旧Androidも引き続き証明書エラーなくサイトを閲覧できそうです いよいよ5/4に標準の証明書チェーンが切り替わります 前回までのおさらい Android7.1以前でLet's Encrypt証明書のサイトが見られなくなる Let's Encryptの証明書切替周りその後 Let's Encryptはルート証明書を自身(ISRG)の認証局のルート証明書(ISRG Root X1)に切り替えようとしています。現在は、IdenTrustのルート証明書(DST Root CA X3)が使われています。 正確に言うと、ISRGは新しい認証局なのでそのルート証明書の普及率も当然低く、中間証明書はIdenTrustのルート証明書でクロスサインされており、それが標準で使われています。標準がDSTになっているだけで、ISRGのルート証明書のチェーンの証明書も指定すれば今で
How HTTPS Works
How HTTPS works ...in a comic! 🌈 🎉 🍕 Have you ever wondered why a lock icon appears on your browser URL bar? And why is it important? We did too, and this comic is for you! Follow the adventures of Certificat, Browserbird, and Compugter as they explain why HTTPS is crucial for the future of the web and how it all works together. Don't let the bad crabs get you (you'll know what we mean in the c
Troy Hunt: Here's Why Your Static Website Needs HTTPS
It was Jan last year that I suggested HTTPS adoption had passed the "tipping point", that is, it had passed the moment of critical mass and as I said at the time, "will very shortly become the norm". Since that time, the percentage of web pages loaded over a secure connection has rocketed from 52% to 71% whilst the proportion of the world's top 1 million websites redirecting people to HTTPS has go
The Website Migration Guide: SEO Strategy, Process, & Checklist
What is a site migration? A site migration is a term broadly used by SEO professionals to describe any event whereby a website undergoes substantial changes in areas that can significantly affect search engine visibility — typically changes to the site’s location, platform, structure, content, design, or UX. Google’s documentation on-site migrations doesn’t cover them in great depth and downplays
Add HTTPS support to Github Pages including custom domains · Issue #156 · isaacs/github
NOTE to anyone stumbling on this thread - there are many people subscribed, so please do not comment here unless you have something new to add that is not already discussed above in this long, detailed (and I hope helpful!) discussion thread. Update: GitHub announced official support of HTTPS for *.github.io domains, which is awesome, and a clear first step. They clearly intend to move GitHub Page
今なぜHTTPS化なのか？インターネットの信頼性のために、技術者が知っておきたいTLSの歴史と技術背景
【変更履歴 2018年2月15日】当初の記事タイトルは「いまなぜHTTPS化なのか？ 技術者が知っておきたいSEOよりずっと大切なこと ― TLSの歴史と技術背景」でしたが、現行のものに変更しました。現在GoogleではWebサイトのHTTPS対応と検索結果の関係を強調しておらず、本記事の趣旨の一つにも本来は独立した問題であるSEOとHTTPS化を関連付けるという根強い誤解を解くことがありますが、当初のタイトルではかえってSEOとHTTPSを関連付けて読まれるおそれがあり、また同様の指摘もいただいたことから変更いたしました。 HTTPとHTTPSは、共にTCP通信上で動作します。したがって、いずれもTCPハンドシェイクで通信を開始します。 HTTP通信の場合には、このTCPハンドシェイク直後に、HTTPリクエストとレスポンスのやり取りが始まります。このHTTPのやり取りは平文通信であり、途
HTTPS通信の疎通確認に覚えておきたい３つのコマンド - Qiita
$ curl -s -v --sslv3 https://example.com 1> /dev/null * Rebuilt URL to: https://example.com/ * Trying 93.184.216.34... * Connected to example.com (93.184.216.34) port 443 (#0) * SSL peer handshake failed, the server most likely requires a client certificate to connect * Closing connection 0 おっと、SSLハンドシェイクで通信に失敗したようですね。SSL3.0はPOODLE脆弱性問題があります。ちゃんとexample.comでは無効にしているようですね。以下のようにTLS1.2ではきちんとできました。Di
HTTPS Checker | Migrate to HTTPS & Fix Mixed Content.
Tools to find HTTPS Mixed Content Issues Check your website for common HTTPS migration issues. Find insecure HTTP content loaded over HTTPS, to keep data private, unmodified and trusted by visitors. Desktop HTTPS Checker Online HTTPS Reporter How does it work? Over 100,000 scans run by 20,000+ users to help migrate their sites to HTTPS worldwide, including:
Do the ChaCha: better mobile performance with cryptography
Do the ChaCha: better mobile performance with cryptography02/23/2015 CC BY-ND 2.0 image image by Clinton Steeds CloudFlare is always trying to improve customer experience by adopting the latest and best web technologies so that our customers (and their visitors) have a fast and a secure web browsing experience. More and more web sites are now using HTTPS by default. This sea change has been spearh
Man-in-the-middle attack on mobile version of Facebook possible due to lack of HSTS header
Bartek Nowotarski TL;DR It was possible to eavesdrop a single request data, including cookies and fb_dtsg (CSRF token), during installation of any app in mobile version of Facebook App Center despite the fact that the user had "Secure Browsing" mode enabled in their Facebook settings. The bug is now fixed but the lack of HTTP Strict Transport Security header on Mobile Facebook makes it possible t
HTTPS Everywhere | Electronic Frontier Foundation
You no longer need HTTPS Everywhere to set HTTPS by default! Major browsers now offer native support for an HTTPS only mode. Learn how to turn it on. Read more about the sunset of HTTPS Everywhere. Since we started offering HTTPS Everywhere, the battle to encrypt the web has made leaps and bounds. Now HTTPS is truly just about everywhere, and the web has largely switched from non-secure HTTP to th
Tor and HTTPS | Electronic Frontier Foundation
Click the "Tor" button to see what data is visible to eavesdroppers when you're using Tor. The button will turn green to indicate that Tor is on. Click the "HTTPS" button to see what data is visible to eavesdroppers when you're using HTTPS. The button will turn green to indicate that HTTPS is on. When both buttons are green, you see the data that is visible to eavesdroppers when you are using both
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Let’s encrypt Certs with Terraform
http://www.https.com/
No More Mixed Messages About HTTPS
GitHub - trimstray/htrace.sh: My simple Swiss Army knife for http/https troubleshooting and profiling.
How migrating to HTTPS can slow down your site
みずほ銀行