Recent Comments
Archives
- September 2016 (78)
- August 2016 (69)
- July 2016 (19)
- June 2016 (42)
- May 2016 (61)
- April 2016 (51)
- March 2016 (74)
- February 2016 (87)
- January 2016 (31)
- December 2015 (36)
- November 2015 (61)
- October 2015 (72)
- September 2015 (53)
- August 2015 (42)
- July 2015 (38)
- June 2015 (30)
- May 2015 (18)
- April 2015 (57)
- March 2015 (41)
- February 2015 (50)
- January 2015 (35)
- December 2014 (50)
- November 2014 (56)
- October 2014 (41)
- September 2014 (37)
- August 2014 (37)
- July 2014 (28)
- June 2014 (50)
- May 2014 (32)
- April 2014 (46)
- March 2014 (38)
- February 2014 (29)
- January 2014 (52)
- December 2013 (50)
- November 2013 (45)
- October 2013 (40)
- September 2013 (48)
- August 2013 (22)
- July 2013 (25)
- June 2013 (13)
- May 2013 (16)
- April 2013 (28)
- March 2013 (37)
- February 2013 (36)
- January 2013 (57)
- December 2012 (44)
- November 2012 (10)
- October 2012 (12)
- September 2012 (21)
- August 2012 (21)
- July 2012 (25)
- June 2012 (8)
- May 2012 (10)
- April 2012 (11)
- March 2012 (10)
- February 2012 (11)
- January 2012 (5)
- December 2011 (13)
- November 2011 (12)
- October 2011 (10)
- September 2011 (7)
- August 2011 (5)
- July 2011 (11)
- June 2011 (21)
- May 2011 (22)
- April 2011 (36)
- March 2011 (43)
- February 2011 (23)
- January 2011 (24)
- December 2010 (34)
- November 2010 (19)
- October 2010 (16)
- September 2010 (15)
- August 2010 (10)
- July 2010 (12)
- June 2010 (3)
- May 2010 (3)
- April 2010 (4)
- March 2010 (8)
- February 2010 (14)
- January 2010 (13)
- December 2009 (16)
- November 2009 (28)
- October 2009 (24)
- September 2009 (12)
- August 2009 (7)
- July 2009 (10)
- June 2009 (11)
- May 2009 (22)
- April 2009 (21)
- March 2009 (18)
- February 2009 (7)
- January 2009 (32)
- December 2008 (19)
- November 2008 (12)
- October 2008 (15)
- September 2008 (14)
- August 2008 (15)
- July 2008 (18)
- June 2008 (20)
- May 2008 (19)
- April 2008 (27)
- March 2008 (22)
- February 2008 (21)
- January 2008 (15)
- December 2007 (22)
- November 2007 (17)
- October 2007 (29)
- September 2007 (31)
- August 2007 (34)
- July 2007 (31)
- June 2007 (36)
- May 2007 (23)
- April 2007 (22)
- March 2007 (30)
- February 2007 (50)
- January 2007 (75)
- December 2006 (48)
- November 2006 (59)
- October 2006 (89)
- September 2006 (29)
- August 2006 (48)
- July 2006 (14)
- June 2006 (35)
- May 2006 (62)
- April 2006 (63)
- March 2006 (72)
- February 2006 (83)
- January 2006 (56)
- December 2005 (46)
- November 2005 (60)
- October 2005 (27)
- September 2005 (54)
- August 2005 (83)
Tags
Categories
- Anime (28)
- AWS (312)
- BBS (22)
- Blog (244)
- Book (30)
- Bridge (1)
- Browser (488)
- CDN (164)
- Cloud (432)
- CMS (57)
- Comic (19)
- Computer (4,011)
- Computer and Network Center (33)
- CSS (62)
- Database (355)
- DNS (115)
- Editor (22)
- Financial (81)
- Firefox (218)
- Food (14)
- FreeBSD (137)
- FTP (2)
- Game (54)
- GoogleChrome (145)
- Hardware (337)
- IE (92)
- Joke (158)
- Lab (3)
- Linux (156)
- MacOS (25)
- Mail (112)
- MariaDB (17)
- Movie (28)
- Murmuring (4,138)
- Music (47)
- MySQL (254)
- NCTU (64)
- NetBSD (7)
- Network (2,926)
- OpenBSD (7)
- Opera (26)
- OS (359)
- P2P (125)
- Photo (68)
- Political (117)
- PostgreSQL (36)
- Programming (670)
- Recreation (509)
- RSS (78)
- Safari (36)
- Science (84)
- Search Engine (173)
- Security (909)
- SMS (9)
- Social (188)
- Software (2,109)
- Spam (100)
- Sport (9)
- Telephone (109)
- Television (54)
- Usenet (14)
- Vim (13)
- VPN (16)
- Wiki (47)
- Windows (68)
- WWW (1,511)
Blogroll
Meta
Tag Archives: everywhere
CloudFlare 把 HTTPS Everywhere 的清單拿到 CDN 上用所推出的產品...
這個產品就如同標題所說的方式而已，做起來不難，只是一直沒人做就是了：「How we brought HTTPS Everywhere to the cloud (part 1)」。 傳統的作法是直接硬幹下去換掉，或是用 header 讓瀏覽器主動轉過去： A naive way to do this would be to just rewrite http:// links to https:// or let browsers do that with Upgrade-Insecure-Requests directive. 但這有必須有兩個假設成立才可以： Each single HTTP … Continue reading
Google 的 www.google.com 要上 HSTS 了
Google 宣佈 www.google.com 要上 HSTS 了：「Bringing HSTS to www.google.com」。 雖然都已經使用 EFF 的 HTTPS Everywhere 在跑確保 HTTPS，但這個進展還是很重要，可以讓一般使用者受到保護... Google 的切換計畫是會逐步增加 HSTS 的 max-age，確保中間出問題時造成的衝擊。一開始只會設一天，然後會逐步增加，最後增加到一年： In the immediate term, we’re focused on increasing the duration that the header is active (‘max-age’). We've initially set … Continue reading
利用 HSTS 資訊得知網站紀錄的 sniffly
看到「sniffly」這個工具，可以利用 HSTS 資訊檢測逛過哪些網站，程式碼在「diracdeltas/sniffly」這邊可以找到： Sniffly is an attack that abuses HTTP Strict Transport Security and Content Security Policy to allow arbitrary websites to sniff a user's browsing history. It has been tested in Firefox and Chrome. 測試網站則可以在這邊看到，作者拿 Alexa 上的資料網站來掃，所以熱門網站應該都會被放進去... 主要是利用 HSTS … Continue reading
Wikimedia (包括維基百科) 推出 HSTS (強制使用 HTTPS)
Wikimeda 宣佈所有旗下的網站都會啟用 HTTPS 與 HSTS：「Securing access to Wikimedia sites with HTTPS」。 在這之前，使用者可以用 EFF 的 HTTPS Everywhere 強制使用 HTTPS (在 Firefox 與 Google Chrome 都有上架)，而這次則是全面強制使用了。 愈來愈多人使用 HTTPS 來保護隱私後 (而不僅僅是保護機密資料)，接下來的問題就是要想辦法在 DNS 上保護了。也就是可以利用 DNS query pattern 知道你在看哪種 (或是哪一個) 頁面。