Google Online Security Blog: октомври 2014

Learning statistics with privacy, aided by the flip of a coin

30 октомври 2014 г.

Cross-posted on the Research Blog and the Chromium Blog
protect our users' security and privacyrandomized responsedifferential privacystrongest form of privacyintense research in academiaon the Internet, nobody should know you’re a dogunwanted softwarehijackingopen-source projectreportACM Conference on Computer and Communications Securityfeedbackrappor-discuss@googlegroups.comPosted by Úlfar Erlingsson, Tech Lead Manager, Security Research

Strengthening 2-Step Verification with Security Key

21 октомври 2014 г.

2-Step VerificationSecurity Key

Security Key and Chrome incorporate the open Universal 2nd Factor (U2F) protocol from the FIDO Alliance, so other websites with account login systems can get FIDO U2F working in Chrome today. It’s our hope that other browsers will add FIDO U2F support, too. As more sites and browsers come onboard, security-sensitive users can carry a single Security Key that works everywhere FIDO U2F is supported.learn morePosted by Nishit Shah, Product Manager, Google Security

This POODLE bites: exploiting the SSL 3.0 fallback

14 октомври 2014 г.

detailsTLS_FALLBACK_SCSVPosted by Bodo Möller, Google Security Team
[Updated Oct 15 to note that SSL 3.0 is nearly 18 years old, not nearly 15 years old.]

News from the land of patch rewards

9 октомври 2014 г.

launchedPatch Reward
We started with a modest scope and reward amounts, but have gradually expanded the program over the past few months. We’ve seen some great work so far—and to help guide future submissions, we wanted to share some of our favorites:

Incorporation of a variety of web security checks directly into Django to help users develop safer web applications.

A support for seccomp-bpf sandboxing in BIND to minimize the impact of remote code execution bugs.

Addition of Curve25519 and several other primitives in OpenSSH to strengthen its cryptographic foundations and improve performance.

A set of patches to reduce the likelihood of ASLR info leaks in Linux to make certain types of memory corruption bugs more difficult to exploit.

And, of course, the recent attack-surface-reducing function prefix patch in bash that helped mitigate a flurry of “Shellshock”-related bugs.

We hope that this list inspires even more contributions in the year to come. Of course, before participating, be sure to read the rules page. When done, simply send your nominations to security-patches@google.com. And keep up the great work!
Posted by Michal Zalewski, Google Security Team

An update to SafeSearch options for network administrators

2 октомври 2014 г.

strong SSL encryption
For some time, we’ve offered network administrators the ability to require the use of SafeSearch by their users, which filters out explicit content from search results; this is especially important for schools. However, using this functionality has meant that searches were sent over an unencrypted connection to Google. Unfortunately, this has been the target of abuse by other groups looking to snoop on people’s searches, so we will be removing it as of early December.
Going forward, organizations can require SafeSearch on their networks while at the same time ensuring that their users’ connections to Google remain encrypted. (This is in addition to existing functionality that allows SafeSearch to be set on individual browsers and to be enabled by policy on managed devices like Chromebooks.) Network administrators can read more about how to enable this new feature here.
Posted by Brian Fitzpatrick, Engineering Director

Security Blog

Learning statistics with privacy, aided by the flip of a coin

Strengthening 2-Step Verification with Security Key

This POODLE bites: exploiting the SSL 3.0 fallback

News from the land of patch rewards

An update to SafeSearch options for network administrators

Етикети

Archive

Feed