GitHub - WICG/dbsc
Device Bound Session Credentials (DBSC) aims to reduce account hijacking caused by cookie theft. It does so by introducing a protocol and browser infrastructure to maintain and prove possession of a cryptographic key. The main challenge with cookies as an authentication mechanism is that they only lend themselves to bearer-token schemes. On desktop operating systems, application isolation is lacki
Pre-RFC: Sandboxed, deterministic, reproducible, efficient Wasm compilation of proc macros
Feature Name: proc_macro_sandbox Start Date: 2023-08-20 Summary Procedural macro crates can opt-in to precompilation to WebAssembly as part of the publish process. The crate compiles locally (as already done by cargo publish) and then is securely verified by a crates.io-managed service, conceptually similar to docs.rs, which enforces that sources in the crate exactly reproduce the Wasm artifact be
デフォルトでCookieをオリジンに紐づける、ChromeのOrigin-Bound Cookies - ASnoKaze blog
Blinkの開発者メーリングリストで「Intent to Prototype: Origin-Bound Cookies」という議論が行われています。 Cookieをより安全にするために、デフォルトでCookieをオリジンに紐づけるようにする提案です。Cookieをset-cookieしたオリジン以外からは、そのCookieにアクセスできないようになります。 詳しい背景や仕組みについては次のページから確認できます。 github.com かんたんに、Origin-Bound Cookiesの動作をみていきましょう。 例 オリジンは、スキーム、ホスト名、ポートの組です。それらのうち一つでも異なれば、オリジンが異なることになります。 例えば、次のようになります。 http://example.comによってセットされたcookieは、http://example.comにのみ送信されます。ht
GitHub - mikewest/coop-by-default: Wouldn't it be nice if `Cross-Origin-Opener-Policy` was applied by default?
When a web application opens another origin in a window, it obtains a JavaScript reference to that context that it can reach through to poke at various things. The opened context likewise receives a reference to its opener which provides similar access. This communication channel between the two windows enables attacks both at the web API level (postMessage vulnerabilities, navigation trickery, an
GitHub - mikewest/deprecating-document-domain: `document.domain` intentionally weakens the only security boundary we have. Perhaps we can dump it?
The primary security boundary of the World Wide Web is the origin. The same-origin policy guarantees that one web page cannot access (modify, or extract data from) another page, unless those pages are hosted on the same origin. Several pages within an origin can fully cooperate as a single website, but pages from different origins are isolated and cannot interfere with each other. The same origin
GitHub - samuelgoto/WebID: A privacy preserving federated identity Web API
Over the last decade, identity federation has unquestionably played a central role in raising the bar for authentication on the web, in terms of ease-of-use (e.g. passwordless single sign-on), security (e.g. improved resistance to phishing and credential stuffing attacks) and trustworthiness compared to its preceding pattern: per-site usernames and passwords. The standards that define how identity
GitHub - Agoric/realms-shim: Spec-compliant shim for Realms TC39 Proposal
This repository contains a legacy shim implementation of an outdated Realm API Proposal. The Realms proposal has been superceded by the ShadowRealm Proposal. This shim does not implement ShadowRealm, which (as of this writing) is a proposal at Stage 3 of the TC39 standardization process, so common JS engines should have support soon. We do not recommend the use of this shim or the original Realms
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
GitHub - arichiv/opener-storage-partitioning: Explainer: Opener Storage Partitioning
GitHub - antifraudcg/proposals: Proposals for the Anti-Fraud Community Group.
[RRFC] Security: audit lockfiles for injection · Issue #539 · npm/rfcs
fenced-frame/explainer at master · WICG/fenced-frame
GitHub - WICG/anonymous-iframe: Give developers the ability to embed third party HTML documents inside a new and ephemeral context. In return, COEP embedding rules can be relaxed. Thanks to anonymous iframe, developers using COEP can now embed third party
GitHub - annevk/orb: Opaque Response Blocking (CORB++)
credentiallessness/explainer.md at main · WICG/credentiallessness
GitHub - mikewest/embedding-requires-opt-in: Embedding a document (via `<iframe>`, etc) should require explicit opt-in from the embedee.
Bounce Tracking Protection · Issue #6 · privacycg/proposals
agendas/2020/02_talk_Splitting-SES.pdf at main · tc39/agendas
GitHub - mikewest/strict-navigation-security: What if HSTS only applied to top-level navigations?
GitHub - Agoric/SES: MOVED to @agoric/ses-shim. SES (Secure EcmaScript) is a secure runtime for running third-party code safely
https://agoric.com/realms-shim-security-updates/