Google Online Security Blog: 2008

Announcing "Browser Security Handbook"

December 10, 2008

Posted by Michael Zalewski, Security Team.Web 2.0Browser Security Handbook

Native Client: A Technology for Running Native Code on the Web

December 8, 2008

Posted by Brad Chen, Native Client Team.Native Clientpost on the Google Code blogdeveloper site

User Experience in the Identity Community

December 2, 2008

Eric Sachs & Ben Laurie, Google Security

One of the major conferences on Internet identity standards is the Internet Identity Workshop (IIW), a semiannual 'un-conference' where the sessions are not determined ahead of time. It is attended by a large set of people who work on Internet security and identity standards such as OAuth, OpenID, SAML, InfoCards, etc. A major theme within the identity community this year has been about improving the user experience and growing the adoption of these technologies. The OpenID community is making great progress on user experience, with Yahoo, AOL, and Google quickly improving the support they provide (read a summary from Joseph Smarr of Plaxo). Similarly, the InfoCard community has been working on simplifying the user experience of InfoCard technology, including the updated CardSpace selector from Microsoft.

Another hot topic at IIW centered around how to improve the user experience when testing alternatives and enhancements to passwords to make them less susceptible to phishing attacks. Many websites and enterprises have tried these password enhancements/alternatives, but they found that people complained that they were hard to use, or that they weren't portable enough for people who use multiple computers, including web cafes and smart phones. We have published an article summarizing some of the community's current ideas for how to deploy these new authentication mechanisms using a multi-layered approach that minimizes additional work required by users. We have also pulled together a set of videos showing how a number of these different approaches work with both web-based and desktop applications. We hope this information will be helpful to other websites and enterprises who are concerned about phishing.

Gmail security and recent phishing activity

November 25, 2008

Posted by Chris Evansdomain theft from December 2007always run their entire session using httpshere

OAuth for Secure Mashups

November 18, 2008

Posted by Eric Sachs, Senior Product Manager, Google SecurityOAuthAuthSub
However, with the development of a common Internet standard in OAuth, we see much greater potential for data portability and secure mash-ups. Today we announced that the gadget platform now supports OAuth, and the interoperability of this standard was demonstrated by new iGoogle gadgets that AOL and MySpace both built to enable users to see their respective AOL or MySpace mailboxes (and other information) while on iGoogle. However, to ensure the user's privacy, this only works after the user has authorized AOL or MySpace to make their data available to the gadget running on iGoogle. We also previously announced that third-party developers can build their own iGoogle gadgets that access the OAuth-enabled APIs for Google applications such as Calendar, Picasa, and Docs. In fact, since both the gadget platform and OAuth technology are open standards, we are working to help other companies who run services similar to iGoogle to enhance them with support for these standards. Once that is in place, these new OAuth-powered gadgets that are available on iGoogle will also work on those other sites, including many of the gadgets that Google offers for its own applications. This provides a platform for some interesting mash-ups. For example, a third-party developer could create a single gadget that uses OAuth to access both Google OAuth-enabled APIs (such as a Gmail user's address book) and MySpace OAuth-enabled APIs (such as a user's friend list) and display a mashup of the combination.
While the combination of OAuth with gadgets is an exciting new use of the technology, most of the use of OAuth is between websites, such as to enable a user of Google Health to allow a clinical trial matching site to access his or her health profile. I previously mentioned that one privacy control provided by OAuth is that it defines a standard way for users to authorize one website to make their data accessible to another website. In addition, OAuth provides a way to do this without the first site needing to reveal the identity of the user -- it simply provides a different opaque security token to each additional website the user wants to share his or her data with. It would allow a mutual fund, for example, to provide an iGoogle gadget to their customers that would run on iGoogle and show the user the value of his or her mutual fund, but without giving Google any unique information about the user, such as a social security number or account number. In the future, maybe we will even see industries like banks use standards such as OAuth to allow their customers to authorize utility companies to perform direct debit from the user's bank account without that person having to actually share his or her bank account number with the utility vendor.
The OAuth community is continuing to enhance this standard and is very interested in having more companies engaged with its development. The OAuth.net website has more details about the current standard, and I maintain a website with advanced information about Google's use of OAuth, including work on integrating OAuth with desktop apps, and integrating with federation standards such as OpenID and SAML. If you're interested in engaging with the OAuth community, please get in touch with us.

Malware? We don't need no stinking malware!

October 24, 2008

Written by Oliver Fisher"This site may harm your computer"

loves turtlesUh-oh... I need help!some tipsquick security checklist for webmastersStopbadware.orgforums<site-name-here>Webmaster ToolsWebmaster Toolsrequest a malware reviewAdvance warningemails the website ownersWebmaster ToolsbeforeWebmaster Toolswarnings to webmastersReviewsWebmaster ToolsWebmaster Toolsrequest for reconsiderationreconsideration request

How long will a review take?

New spam and virus trends from Enterprise

August 12, 2008

Written by Amanda Kleha, Google Apps Security & Compliance team
Google Apps Security & ComplianceEnterprise blogwebinar

Keyczar: Safe and Simple Cryptography

August 11, 2008

Written by Steve WeisKeyczarGoogle Code projectdiscussion group

Are you using the latest web browser?

July 16, 2008

Written by Thomas DuebendorferSlow migration to latest browser version"Understanding the Web Browser Threat"Neglected security patches

Maximum measured share of users surfing the web with the most secure versions of Firefox, Safari, Opera and Internet Explorer in June 2008 as seen on Google websites.Obsolete browser warning

Example "best before" implementation on a Web browser

Meet ratproxy, our passive web security assessment tool

July 1, 2008

Posted by Michal Zalewskiratproxyherepage

Safe Browsing Diagnostic To The Rescue

May 15, 2008

Posted by Niels ProvosSafe Browsing APISafe Browsing diagnostic page

What is the current listing status for [the site in question]?

We display the current listing status of a site and also information on how often a site or parts of it were listed in the past.

What happened when Google visited this site?

This section includes information on when we analyzed the page, when it was last malicious, what kind of malware we encountered and so fourth. To help web masters clean up their site, we also provide information about the sites that were serving malicious software to users and which sites might have served as intermediaries.

Has this site acted as an intermediary resulting in further distribution of malware?

Here we provide information if this site has facilitated the distribution of malicious software in the past. This could be an advertising network or statistics site that accidentally participated in the distribution of malicious software.

Has this site hosted malware?

Here we provide information if the the site has hosted malicious software in the past. We also provide information on the victim sites that initiated the distribution of malicious software.

interstitialtech report [pdf]

Contributing To Open Source Software Security

May 5, 2008

Written by Will Drewryoperating systemsweb browsersSecure Programming for Linux and Unix HOWTO

people need to actually review the code

developers/reviewers need to know how to write secure code

once found, security problems need to be fixed quickly, and their fixes distributed quickly

said beforeregularly submitsecurity testing toolssecurity challengesopen source computer emergency response team

All Your `iFrame` Are Point to Us

February 11, 2008

Written by Niels Provos, Anti-Malware Teamdrive-by downloadstechnical report [PDF]Search Results Containing a URL Labeled as Harmful

Browsing HabitsDMOZMalicious Content InjectionGhost In the Browser [PDF]technical report [PDF]
Structural Properties of Malware Distribution

Mar	APR	May
	25
2025	2026	2027

Security Blog