|
Lukas Weichselbaum
@
we1x
|
|
Staff Information Security Engineer @Google. Passionate about Web Security. Opinions are my own.
|
|
|
520
Tweetovi
|
406
Pratim
|
1.498
Osobe koje vas prate
|
| Tweetovi |
|
|
Lukas Weichselbaum
@we1x
|
1. velj |
|
Wozu? Vielleicht sollten Sie lieber an Ihrer Rechtschreibung/Grammatik arbeiten bevor Sie sich ueber Umlaute beschweren 🤦♂️
"auch in Englichen Tastaturlayout"
|
||
|
||
|
|
Lukas Weichselbaum
@we1x
|
1. velj |
|
Sehr empathisch.. ich verwende beruflich auch eine Tastatur mit einem englischen Tastaturlayout.
|
||
|
|
||
| Lukas Weichselbaum proslijedio/la je tweet | ||
|
Google Vulnerability Reward Program (VRP)
@GoogleVRP
|
30. sij |
|
2019 has been a record-breaking year on lots of fronts - thanks to you all! Keep up your awesome discoveries.
security.googleblog.com/2020/01/vulner…
|
||
|
|
||
|
|
Lukas Weichselbaum
@we1x
|
30. sij |
|
Yes, I'd say so.
|
||
|
|
||
|
|
Lukas Weichselbaum
@we1x
|
30. sij |
|
Huge +1, really looking forward to working with you!!
|
||
|
|
||
|
|
Lukas Weichselbaum
@we1x
|
30. sij |
|
Most common are browser extensions. But malware could also patch your browser or other places. Not sure what Kaspersky is doing.
|
||
|
|
||
|
|
Lukas Weichselbaum
@we1x
|
29. sij |
|
we also see a lot of these... Really not great, if an AV lowers the security of a site by messing with its CSP :/
|
||
|
|
||
|
|
Lukas Weichselbaum
@we1x
|
28. sij |
|
Congrats to postmates.com! twitter.com/randomdross/st…
|
||
|
|
||
| Lukas Weichselbaum proslijedio/la je tweet | ||
|
Rowan Merewood
@rowan_m
|
27. sij |
|
More #samesite 🍪 cookie news:
0️⃣ Intent to **prototype**
1️⃣ tl;dr you can't share 🍪 across HTTP / HTTPS
2️⃣ 3P 🍪 need to be Secure anyway ➡️ unaffected
3️⃣ Consider HTTPS by default (again)
4️⃣ HTTP➡️HTTPS may mean transferring 🍪
👋 Happy to discuss! twitter.com/intenttoship/s…
|
||
|
|
||
| Lukas Weichselbaum proslijedio/la je tweet | ||
|
Jasvir Nagra
@jasvir
|
27. sij |
|
|
||
|
|
Lukas Weichselbaum
@we1x
|
27. sij |
|
There are also other fallbacks. E.g. in presence of 'strict-dynamic' all host allowlist entries like https:, foo.bar.com, etc are ignored.
Doesn't make CSP easier to understand, but is necessary to not break users of incompatible browsers (like Safari).
|
||
|
|
||
|
|
Lukas Weichselbaum
@we1x
|
27. sij |
|
We tried to summarize some of this at csp.withgoogle.com/docs/strict-cs…
Happy to answer any questions 🙂
|
||
|
|
||
|
|
Lukas Weichselbaum
@we1x
|
24. sij |
|
Our research on Safari's Intelligent Tracking Prevention (ITP) is now available on research.google/pubs/pub48871/
cc @arturjanc @kkotowicz @empijei pic.twitter.com/JvbLIhGDXd
|
||
|
|
||
|
|
Lukas Weichselbaum
@we1x
|
24. sij |
|
You're absolutely right! I'm really happy about more and more people getting interested in this space and that you provide a dedicated platform for them! Also big +1 for unsolicited feedback. Please also feel free to chime in on the many GitHub issues and spec drafts.
|
||
|
|
||
|
|
Lukas Weichselbaum
@we1x
|
24. sij |
|
Will consider that! Usually we send our crazy ideas directly to @mikewest 😅
|
||
|
|
||
|
|
Lukas Weichselbaum
@we1x
|
24. sij |
|
I wish the web would have an easier way to deprecate old/insecure patterns and APIs. Till then we'll have to work with opt-ins (like CSP, COOP, TrustedTypes, ...) for reducing dangerous patterns.
Origin-(policy-)manifest[1] should make this easier :)
[1] wicg.github.io/origin-policy/
|
||
|
|
||
|
|
Lukas Weichselbaum
@we1x
|
23. sij |
|
fixed
|
||
|
|
||
|
|
Lukas Weichselbaum
@we1x
|
23. sij |
|
Good idea ;)
|
||
|
|
||
|
|
Lukas Weichselbaum
@we1x
|
22. sij |
|
Three possible explanations:
a) koto was in the same meeting
b) you got compromised
c) hash collision in universe simulation
|
||
|
|
||
|
|
Lukas Weichselbaum
@we1x
|
22. sij |
|
|
||