Google Online Security Blog: diciembre 2014

Security Blog

The latest news and insights from Google on security and safety on the Internet

An Update to End-To-End

16 de diciembre de 2014

Posted by Stephan Somogyi, Product Manager, Security and Privacyannounced and launched End-To-End

We’re migrating End-To-End to GitHub. We’ve always believed strongly that End-To-End must be an open source project, and we think that using GitHub will allow us to work together even better with the community.

We’ve included several contributions from Yahoo Inc. Alex Stamos, Yahoo’s Chief Security Officer, announced at BlackHat 2014 in August that his team would be participating in our End-To-End project; we’re very happy to release the first fruits of this collaboration.

We’ve added more documentation. The project wiki now contains additional information about End-To-End, both for developers as well as security researchers interested in understanding better how we think about End-To-End’s security model.

Vulnerability Rewards Program

Google

Reject the Unexpected - Content Security Policy in Gmail

16 de diciembre de 2014

Posted by Danesh Irani, Software Engineer, Gmail Security(Cross-posted from the Gmail Blog)serving images through secure proxy serversrequiring HTTPSthe Chrome Web StoreGoogle Security CenterThis post was updated on December 18th to add a description of the XSS defense benefit of CSP, and to more precisely define the interaction with extensions.