mirror of
https://github.com/privacyguides/i18n.git
synced 2025-08-19 13:24:45 +00:00
New Crowdin translations by GitHub Action
This commit is contained in:
Crowdin Bot
104
i18n/zh/advanced/communication-network-types.md
Normal file
104
i18n/zh/advanced/communication-network-types.md
Normal file
@@ -0,0 +1,104 @@
|
||||
---
|
||||
title: "通信网络类型"
|
||||
icon: 'material/transit-connection-variant'
|
||||
description: An overview of several network architectures commonly used by instant messaging applications.
|
||||
---
|
||||
|
||||
有几种网络架构常用于人与人之间的信息传递。 这些网络可以提供不同的隐私保证，这就是为什么在决定使用哪种应用程序时，应该考虑你的 [威胁模型](../basics/threat-modeling.md)。
|
||||
|
||||
[推荐的即时通讯工具](../real-time-communication.md ""){.md-button}
|
||||
|
||||
## 集中式网络
|
||||
|
||||
{ align=left }
|
||||
|
||||
集中式通讯软件是指所有参与者都在同一服务器或由同一组织控制的服务器网络上。
|
||||
|
||||
一些自托管通讯软件允许您设置自己的服务器。 自托管可以提供额外的隐私保证，例如没有使用日志或对元数据（关于谁与谁交谈的数据）的访问限制。 自我托管的集中式通讯是孤立的，所有人都必须在同一个服务器上进行交流。
|
||||
|
||||
**优点：**
|
||||
|
||||
- 新的功能和更改可以更快地实施。
|
||||
- 更容易开始使用和寻找联系人。
|
||||
- 成熟和稳定的功能生态系统，因为它们集成于一套体系。
|
||||
- 当您选择自托管服务器时，隐私问题能缓解不少。
|
||||
|
||||
**缺点**
|
||||
|
||||
- 可以包括 [访问限制和审查](https://drewdevault.com/2018/08/08/Signal.html)。 这可能包括以下内容：
|
||||
- 封禁将可能提供更灵活的定制或更好的体验的[第三方客户端](https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165)。 通常在使用条款和条件中定义。
|
||||
- 为第三方开发者提供的文件很差或没有。
|
||||
- 当单个实体控制服务时，[所有权](https://web.archive.org/web/20210729191953/https://blog.privacytools.io/delisting-wire/)，隐私政策和服务的行为很容易改变，可能会在以后危及服务。
|
||||
- 自托管需要耐心和知识。
|
||||
|
||||
## 联邦网络
|
||||
|
||||
{ align=left }
|
||||
|
||||
联邦网络使用多个独立的去中心化服务器，这些服务器能够相互通信（例如电子邮件）。 联邦允许系统管理员控制自己的服务器，并且仍然是更大的网络的一部分。
|
||||
|
||||
自托管时，联合服务器的成员可以发现其他服务器的成员并与其进行通信，尽管某些服务器可以选择通过不联邦化（例如工作团队服务器）来保持私密性。
|
||||
|
||||
**优点：**
|
||||
|
||||
- 允许在运行自己的服务器时更好地控制自己的数据。
|
||||
- 允许您通过在多个“公共”服务器之间选择信任谁。
|
||||
- 通常允许第三方客户端提供更原生、定制或可访问的体验。
|
||||
- 可以验证服务器与公共源代码匹配，假设您有权访问服务器或您信任这样做的人（例如，家庭成员）。
|
||||
|
||||
**缺点**
|
||||
|
||||
- 添加新功能更加复杂，因为这些功能需要进行标准化和测试，以确保网络上的所有服务器都能一起使用。
|
||||
- 由于前一点，与集中式平台相比，功能可能缺乏，不完整或以意想不到的方式工作，例如脱机或消息删除时的消息中继。
|
||||
- 一些元数据可能是泄漏的（例如，像 "谁在和谁说话 "这样的信息，但如果使用E2EE，则没有实际的消息内容）。
|
||||
- 通常需要信任服务器的管理员。 他们可能是业余爱好者，也可能不是“安全专业人士” ，并且可能不会提供标准文档，如隐私政策或服务条款，详细说明如何使用您的数据。
|
||||
- 因为其他服务器的滥用行为或违反了公认的行为的一般规则，服务器管理员有时会选择封锁其他服务器 这会妨碍您与这些服务器的成员进行通信。
|
||||
|
||||
## 点对点网络
|
||||
|
||||
{ align=left }
|
||||
|
||||
点对点聊天软件连接到一个由节点组成的 [分布式网络](https://en.wikipedia.org/wiki/Distributed_networking) ，在没有第三方服务器的情况下将信息转发给收件人。
|
||||
|
||||
客户端（对等节点）通常通过使用 [分布式网络](https://en.wikipedia.org/wiki/Distributed_computing) 找到对方。 这方面的例子包括 [分布式哈希表](https://en.wikipedia.org/wiki/Distributed_hash_table) (DHT)，由 [torrents](https://en.wikipedia.org/wiki/BitTorrent_(protocol)) 和 [IPFS](https://en.wikipedia.org/wiki/InterPlanetary_File_System) 等使用。 另一种方法是基于近距离的网络，通过WiFi或蓝牙建立连接（例如，Briar或 [Scuttlebutt](https://www.scuttlebutt.nz) 社交网络协议）。
|
||||
|
||||
一旦一个节点通过这些方法中的任何一种找到了通往其联系人的路线，它们之间就会建立直接连接。 虽然信息通常是加密的，但观察者仍然可以推断出发件人和收件人的位置和身份。
|
||||
|
||||
P2P网络不使用服务器，因为节点之间直接通信，因此不存在自我托管。 不过，一些附加服务可能依赖于集中式服务器，例如用户发现或中继离线消息，自托管对此仍有帮助。
|
||||
|
||||
**优点：**
|
||||
|
||||
- 很小的第三方暴露。
|
||||
- 现代P2P平台默认端对端加密。 与集中式和联邦式模式不同，没有任何服务器可能会拦截和解密你的信息。
|
||||
|
||||
**缺点**
|
||||
|
||||
- 缺少很多特性：
|
||||
- 消息只有在两个节点都在线时才能发送，然而，你的客户端可以将消息存储在本地，以等待联系人重新上线。
|
||||
- 通常会增加移动设备的电池用量，因为客户端必须保持与分布式网络的连接，以了解联系人的在线情况。
|
||||
- 某些常见的Messenger功能可能没有实现或不完整，例如消息删除。
|
||||
- 如果你不与 [VPN](../vpn.md) 或 [Tor](../tor.md)结合使用该软件，你的IP地址和与你通信的联系人的IP地址可能会被暴露。 许多国家都有某种形式的大规模监控或元数据保留。
|
||||
|
||||
## 匿名路由
|
||||
|
||||
{ align=left }
|
||||
|
||||
使用 [匿名路由](https://doi.org/10.1007/978-1-4419-5906-5_628) 的Messenger隐藏发送方、接收方的身份或他们一直在通信的证据。 理想情况下，Messenger应该将这三者都隐藏起来。
|
||||
|
||||
有 [许多](https://doi.org/10.1145/3182658) 不同的方法来实现匿名网络。 其中最著名的是
|
||||
洋葱路由 （即 [Tor](tor-overview.md)），它通过一个强加密的 [覆盖网络](https://en.wikipedia.org/wiki/Overlay_network) ，隐藏每个节点的位置以及每个信息的接收者和发送者来通信。 发件人和收件人从不直接交互，只通过一个秘密的会合节点会面，这样就不会泄露IP地址或物理位置。 节点不能解密信息，也不能解密最终目的地；只有收件人可以。 每个中间节点只能解密一部分，表明下一步将把仍然加密的信息发送到哪里，直到它到达可以完全解密的收件人那里，因此命名为 "洋葱路由"。</p>
|
||||
|
||||
在匿名网络中自托管一个节点并不为托管者提供额外的隐私，而是有助于整个网络对识别攻击的抗性，对每个人都有好处。
|
||||
|
||||
**优点：**
|
||||
|
||||
- 最小第三方暴露。
|
||||
- 消息可以以去中心的方式中继，即使其中一方处于离线状态。
|
||||
|
||||
**缺点**
|
||||
|
||||
- 慢
|
||||
- 通常仅限于较少的媒体类型，主要是文本，因为很慢。
|
||||
- 如果通过随机路由选择节点，则某些节点可能远离发送方和接收方，增加延迟，甚至在其中一个节点脱机时无法传输消息。
|
||||
- 开始时比较复杂，因为需要创建和安全备份一个加密私钥。
|
||||
- 就像其他去中心化平台一样，对开发者来说，增加功能比中心化平台更复杂。 因此，功能可能缺乏或未完全实现，例如脱机消息中继或消息删除。
|
||||
354
i18n/zh/advanced/dns-overview.md
Normal file
354
i18n/zh/advanced/dns-overview.md
Normal file
@@ -0,0 +1,354 @@
|
||||
---
|
||||
title: "DNS简介"
|
||||
icon: material/dns
|
||||
description: The Domain Name System is the "phonebook of the internet," helping your browser find the website it's looking for.
|
||||
---
|
||||
|
||||
[域名系统](https://en.wikipedia.org/wiki/Domain_Name_System) 是“互联网电话簿”。 DNS将域名转换为IP地址，以便浏览器和其他服务可以通过分散的服务器网络加载互联网资源。
|
||||
|
||||
## 什么是DNS？
|
||||
|
||||
当您访问某个网站时，系统会返回一个数字地址。 例如，当你访问 `privacyguides.org`时，会返回地址 `192.98.54.105`。
|
||||
|
||||
DNS自互联网的 [早期](https://en.wikipedia.org/wiki/Domain_Name_System#History) 以来一直存在。 与DNS服务器间的通讯通常是 **未** 加密的。 在家用场景下，客户通过 [DHCP](https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol)获得由ISP提供的服务器。
|
||||
|
||||
未加密的DNS请求可能会被轻易地 **被监视** ，或者在传输过程中 **被修改**。 在世界的某些地方，Isp被要求做原始的 [DNS过滤](https://en.wikipedia.org/wiki/DNS_blocking)。 当你请求一个被封锁的域名的IP地址时，服务器可能不会回应，或可能以不同的IP地址回应。 由于DNS协议没有加密，ISP（或任何网络运营商）可以使用 [DPI](https://en.wikipedia.org/wiki/Deep_packet_inspection) 来监控请求。 ISP还可以基于共有特性阻止请求，无论使用的是哪个DNS服务器。 未加密的DNS始终使用 [端口](https://en.wikipedia.org/wiki/Port_(computer_networking)) 53 ，并且始终使用UDP。
|
||||
|
||||
下面，我们将探讨并提供一个教程来验证一下外部观察者对于使用常规未加密DNS和 [加密DNS](#what-is-encrypted-dns)这两种情况下分别可能看到什么。
|
||||
|
||||
### 未加密DNS
|
||||
|
||||
1. 使用 [`tshark`](https://www.wireshark.org/docs/man-pages/tshark.html) （ [Wireshark](https://en.wikipedia.org/wiki/Wireshark) 项目的一部分），我们可以监测和记录互联网数据包流。 此命令记录符合指定规则的数据包:
|
||||
|
||||
```bash
|
||||
tshark -w /tmp/dns.pcap udp port 53 and host 1.1.1.1 or host 8.8.8.8
|
||||
```
|
||||
|
||||
2. 然后我们可以使用 [`dig`](https://en.wikipedia.org/wiki/Dig_(command)) （Linux，MacOS等）或 [`nslookup`](https://en.wikipedia.org/wiki/Nslookup) （Windows）将DNS查询发送到两个服务器。 Web浏览器等软件会自动执行这些查找，除非它们被配置为使用加密的DNS。
|
||||
|
||||
=== "Linux, macOS"
|
||||
|
||||
```
|
||||
dig +noall +answer privacyguides.org @1.1.1.1
|
||||
dig +noall +answer privacyguides.org @8.8.8.8
|
||||
```
|
||||
=== "Windows"
|
||||
|
||||
```
|
||||
nslookup privacyguides.org 1.1.1.1
|
||||
nslookup privacyguides.org 8.8.8.8
|
||||
```
|
||||
|
||||
3. 接下来，我们来 [分析](https://www.wireshark.org/docs/wsug_html_chunked/ChapterIntroduction.html#ChIntroWhatIs) 输出的结果：
|
||||
|
||||
=== "Wireshark"
|
||||
|
||||
```
|
||||
wireshark -r /tmp/dns.pcap
|
||||
```
|
||||
|
||||
=== "tshark"
|
||||
|
||||
```
|
||||
tshark -r /tmp/dns.pcap
|
||||
```
|
||||
|
||||
如果运行上面的Wireshark命令，顶部窗格显示“[帧](https://en.wikipedia.org/wiki/Ethernet_frame)” ，底部窗格显示有关所选帧的所有数据。 企业过滤和监控解决方案（如政府购买的解决方案）可以自动完成这一过程，无需人工干预，并可以汇总多帧数据以产生对网络观察者有用的统计数据。
|
||||
|
||||
| No. | 时间 | 来源 | 目的地 | 协议 | 长度 | 信息 |
|
||||
| --- | -------- | --------- | --------- | --- | --- | ---------------------------------------------------------------------- |
|
||||
| 1 | 0.000000 | 192.0.2.1 | 1.1.1.1 | 云存储 | 104 | Standard query 0x58ba A privacyguides.org OPT |
|
||||
| 2 | 0.293395 | 1.1.1.1 | 192.0.2.1 | 云存储 | 108 | Standard query response 0x58ba A privacyguides.org A 198.98.54.105 OPT |
|
||||
| 3 | 1.682109 | 192.0.2.1 | 8.8.8.8 | 云存储 | 104 | Standard query 0xf1a9 A privacyguides.org OPT |
|
||||
| 4 | 2.154698 | 8.8.8.8 | 192.0.2.1 | 云存储 | 108 | Standard query response 0xf1a9 A privacyguides.org A 198.98.54.105 OPT |
|
||||
|
||||
观察者可以修改这些数据包中的任何一个。
|
||||
|
||||
## 什么是“加密DNS” ？
|
||||
|
||||
加密DNS可以指代若干协议中的一种，最常见的协议是：
|
||||
|
||||
### DNSCrypt
|
||||
|
||||
[**DNSCrypt**](https://en.wikipedia.org/wiki/DNSCrypt) 是首批加密DNS查询的方法之一。 DNSCrypt在端口443上运行，并可以使用TCP或UDP传输协议。 DNSCrypt从未提交给 [互联网工程任务组（IETF）](https://en.wikipedia.org/wiki/Internet_Engineering_Task_Force) 也没有经过 [征求意见（RFC）](https://en.wikipedia.org/wiki/Request_for_Comments) 过程，因此除了少数 [实现](https://dnscrypt.info/implementations)之外没有被广泛使用。 因此，它在很大程度上被更流行的 [DNS over HTTPS](#dns-over-https-doh)取代了。
|
||||
|
||||
### DNS over TLS (DoT)
|
||||
|
||||
[**DNS over TLS**](https://en.wikipedia.org/wiki/DNS_over_TLS) 是另一种加密DNS通信的方法，在 [RFC 7858](https://datatracker.ietf.org/doc/html/rfc7858)中被定义。 首次得到支持是在安卓9、iOS 14和Linux上，被版本号237的 [systemd-resolved](https://www.freedesktop.org/software/systemd/man/resolved.conf.html#DNSOverTLS=) 实现。 近年来，业界的偏好已经从DoT转向DoH，因为DoT是一个 [复杂的协议](https://dnscrypt.info/faq/) ，并且在现有的实现中对RFC的遵守情况各不相同。 DoT也在一个专用的853端口上运行，该端口很容易被限制性的防火墙阻断。
|
||||
|
||||
### DNS over HTTPS (DoH)
|
||||
|
||||
[**DNS over HTTPS**](https://en.wikipedia.org/wiki/DNS_over_HTTPS)由[RFC 8484](https://datatracker.ietf.org/doc/html/rfc8484) 定义，查询通过[HTTP/2](https://en.wikipedia.org/wiki/HTTP/2) 协议打包并通过 HTTPS保障安全性. 由Firefox 60和Chrome 83等Web浏览器首次实现支持。 由Firefox 60和Chrome 83等Web浏览器首次实现支持。
|
||||
|
||||
DoH的原生实现出现在iOS 14、macOS 11、微软Windows和Android 13中（然而，它不会被默认启用 [](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)）。 一般的Linux桌面支持还在等待systemd [实现](https://github.com/systemd/systemd/issues/8639) ，所以 [目前依然需要安装第三方软件](../dns.md#linux)。
|
||||
|
||||
## 外部一方能看到什么？
|
||||
|
||||
在本示例中，我们将记录当我们提出DoH请求时会发生什么：
|
||||
|
||||
1. 首先，启动 `tshark`。
|
||||
|
||||
```bash
|
||||
tshark -w /tmp/dns_doh.pcap -f "tcp port https and host 1.1.1.1"
|
||||
```
|
||||
|
||||
2. 其次，使用 `curl`提出请求：
|
||||
|
||||
```bash
|
||||
curl -vI --doh-url https://1.1.1.1/dns-query https://privacyguides.org
|
||||
```
|
||||
|
||||
3. 在提出请求后，我们可以用 <kbd>CTRL</kbd> + <kbd>C</kbd>停止抓包。
|
||||
|
||||
4. 在Wireshark中分析结果：
|
||||
|
||||
```bash
|
||||
wireshark -r /tmp/dns_doh.pcap
|
||||
```
|
||||
|
||||
我们可以看到任何加密连接都需要发生的 [连接建立](https://en.wikipedia.org/wiki/Transmission_Control_Protocol#Connection_establishment) 和 [TLS握手](https://www.cloudflare.com/learning/ssl/what-happens-in-a-tls-handshake/) 过程。 当查看下面的“应用程序数据”数据包时，没有一个数据包包含我们请求的域或返回的IP地址。
|
||||
|
||||
## 为什么我**不应该** 使用加密的DNS？
|
||||
|
||||
在有互联网过滤（或审查）的地方，访问被禁止的资源可能会有自己的后果，你应该在你的 [威胁模型](../basics/threat-modeling.md)。 我们 **不** 建议为此目的使用加密的DNS。 使用 [Tor](https://torproject.org) 或 [VPN](../vpn.md) 来代替。 如果您使用的是VPN ，则应使用VPN的DNS服务器。 使用VPN时，您已经信任它们的所有网络活动。
|
||||
|
||||
当我们进行DNS查找时，通常是因为我们想要访问资源。 下面，我们将讨论一些即使在使用加密的DNS时也可能泄露你的浏览活动的方法。
|
||||
|
||||
### IP 地址
|
||||
|
||||
确定浏览活动的最简单方法可能是查看你的设备所访问的IP地址。 例如，如果观察者知道 `privacyguides.org` 在 `198.98.54.105`，而你的设备正在从 `198.98.54.105`请求数据，你很有可能正在访问隐私指南。
|
||||
|
||||
这种方法只有在IP地址属于一个只承载少数网站的服务器时才有用。 如果网站托管在一个共享平台上（如Github Pages、Cloudflare Pages、Netlify、WordPress、Blogger等），它也不是很有用。 如果服务器托管在一个 [反向代理](https://en.wikipedia.org/wiki/Reverse_proxy)，它也不是很有用，这在现代互联网上非常普遍。
|
||||
|
||||
### 服务器名称指示（SNI）
|
||||
|
||||
服务器名称指示通常在一个IP地址承载许多网站时使用。 这可能是一个像Cloudflare这样的服务，或其他一些 [拒绝服务攻击](https://en.wikipedia.org/wiki/Denial-of-service_attack) 保护。
|
||||
|
||||
1. 再次开始捕获 `tshark`。 我们用我们的IP地址添加了一个过滤器，所以你不会捕获很多数据包。
|
||||
|
||||
```bash
|
||||
tshark -w /tmp/pg.pcap port 443 and host 198.98.54.105
|
||||
```
|
||||
|
||||
2. 然后我们访问 [https://privacyguides.org](https://privacyguides.org)。
|
||||
|
||||
3. 访问完网站后，我们要用 <kbd>CTRL</kbd> + <kbd>C</kbd>停止抓包。
|
||||
|
||||
4. 接下来我们要分析结果：
|
||||
|
||||
```bash
|
||||
wireshark -r /tmp/pg.pcap
|
||||
```
|
||||
|
||||
我们将看到连接的建立，然后是隐私指南网站的TLS握手。 第5帧左右。 你会看到一个 "Client Hello"。
|
||||
|
||||
5. 展开每个字段旁边的三角形 ▸。
|
||||
|
||||
```text
|
||||
▸ Transport Layer Security
|
||||
▸ TLSv1.3 Record Layer: Handshake Protocol: Client Hello
|
||||
▸ Handshake Protocol: Client Hello
|
||||
▸ Extension: server_name (len=22)
|
||||
▸ Server Name Indication extension
|
||||
```
|
||||
|
||||
6. 我们可以看到SNI值，它披露了我们正在访问的网站。 `tshark` 命令可以直接给你包含SNI值的所有数据包的值。
|
||||
|
||||
```bash
|
||||
tshark -r /tmp/pg.pcap -Tfields -Y tls.handshake.extensions_server_name -e tls.handshake.extensions_server_name
|
||||
```
|
||||
|
||||
这意味着即使我们使用 "加密DNS "服务器，域名也可能通过SNI被披露。 [TLS v1.3](https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.3) 协议带来了 [Client Hello](https://blog.cloudflare.com/encrypted-client-hello/)，可以防止这种泄漏。
|
||||
|
||||
</a> 各国政府，特别是 [中国](https://www.zdnet.com/article/china-is-now-blocking-all-encrypted-https-traffic-using-tls-1-3-and-esni/) 和 [俄罗斯](https://www.zdnet.com/article/russia-wants-to-ban-the-use-of-secure-protocols-such-as-tls-1-3-doh-dot-esni/)，已经开始阻止
|
||||
|
||||
，或表示希望这样做。 [最近，俄罗斯开始封锁使用 [HTTP/3](https://en.wikipedia.org/wiki/HTTP/3) 标准的外国网站](https://github.com/net4people/bbs/issues/108)。 这是因为作为HTTP/3一部分的 [QUIC](https://en.wikipedia.org/wiki/QUIC) 协议要求 `ClientHello` 也被加密。</p>
|
||||
|
||||
|
||||
|
||||
### 在线证书状态协议（OCSP）
|
||||
|
||||
你的浏览器披露你的浏览活动的另一种方式是通过 [在线证书状态协议](https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol)。 当访问一个HTTPS网站时，浏览器可能会检查该网站的 [证书](https://en.wikipedia.org/wiki/Public_key_certificate) 是否已被撤销。 这通常是通过HTTP协议完成的，这意味着它是 **，而不是** 加密的。
|
||||
|
||||
该OCSP请求包含证书"[序列号](https://en.wikipedia.org/wiki/Public_key_certificate#Common_fields)"，该证书是唯一的。 它被发送到 "OCSP响应者"，以检查其状态。
|
||||
|
||||
我们可以使用 [`openssl`](https://en.wikipedia.org/wiki/OpenSSL) 命令来模拟浏览器会做什么。
|
||||
|
||||
1. 获取服务器证书，并使用 [`sed`](https://en.wikipedia.org/wiki/Sed) ，只保留重要部分，并将其写入文件。
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
openssl s_client -connect privacyguides.org:443 < /dev/null 2>&1 |
|
||||
sed -n '/^-*BEGIN/,/^-*END/p' > /tmp/pg_server.cert
|
||||
```
|
||||
|
||||
|
||||
2. 获得中间证书。 [证书颁发机构（CA）](https://en.wikipedia.org/wiki/Certificate_authority) ，通常不直接签署证书；他们使用所谓的 "中间 "证书。
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
openssl s_client -showcerts -connect privacyguides.org:443 < /dev/null 2>&1 |
|
||||
sed -n '/^-*BEGIN/,/^-*END/p' > /tmp/pg_and_intermediate.cert
|
||||
```
|
||||
|
||||
|
||||
3. `pg_and_intermediate.cert` 中的第一个证书实际上是步骤1中的服务器证书。 我们可以再次使用 `sed` ，删除直到END的第一个实例。
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
sed -n '/^-*END CERTIFICATE-*$/!d;:a n;p;ba' \
|
||||
/tmp/pg_and_intermediate.cert > /tmp/intermediate_chain.cert
|
||||
```
|
||||
|
||||
|
||||
4. 获取服务器证书的OCSP应答器。
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
openssl x509 -noout -ocsp_uri -in /tmp/pg_server.cert
|
||||
```
|
||||
|
||||
|
||||
我们的证书显示的是Lets Encrypt证书响应者。 如果我们想查看证书的所有详细信息，我们可以使用：
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
openssl x509 -text -noout -in /tmp/pg_server.cert
|
||||
```
|
||||
|
||||
|
||||
5. 开始捕获数据包。
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
tshark -w /tmp/pg_ocsp.pcap -f "tcp port http"
|
||||
```
|
||||
|
||||
|
||||
6. 提出OCSP请求。
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
openssl ocsp -issuer /tmp/intermediate_chain.cert \
|
||||
-cert /tmp/pg_server.cert \
|
||||
-text \
|
||||
-url http://r3.o.lencr.org
|
||||
```
|
||||
|
||||
|
||||
7. 打开捕获。
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
wireshark -r /tmp/pg_ocsp.pcap
|
||||
```
|
||||
|
||||
|
||||
在 "OCSP "协议中会有两个数据包：一个 "请求 "和一个 "响应"。 对于 "请求"，我们可以通过展开每个字段旁边的三角形 ▸ ，看到 "序列号"。
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
▸ Online Certificate Status Protocol
|
||||
▸ tbsRequest
|
||||
▸ requestList: 1 item
|
||||
▸ Request
|
||||
▸ reqCert
|
||||
serialNumber
|
||||
```
|
||||
|
||||
|
||||
对于 "回应"，我们也可以看到 "序列号"。
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
▸ Online Certificate Status Protocol
|
||||
▸ responseBytes
|
||||
▸ BasicOCSPResponse
|
||||
▸ tbsResponseData
|
||||
▸ responses: 1 item
|
||||
▸ SingleResponse
|
||||
▸ certID
|
||||
serialNumber
|
||||
```
|
||||
|
||||
|
||||
8. 或者使用 `tshark` 来过滤序列号的数据包。
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
tshark -r /tmp/pg_ocsp.pcap -Tfields -Y ocsp.serialNumber -e ocsp.serialNumber
|
||||
```
|
||||
|
||||
|
||||
如果网络观察者拥有公开的公共证书，他们可以将序列号与该证书相匹配，从而从中确定你所访问的网站。 这个过程可以自动化，并能将IP地址与序列号联系起来。 也可以检查 [证书透明度](https://en.wikipedia.org/wiki/Certificate_Transparency) 日志中的序列号。
|
||||
|
||||
|
||||
|
||||
## 我应该使用加密的DNS吗？
|
||||
|
||||
我们做了这个流程图来描述你什么时候 *应该* 使用加密的DNS。
|
||||
|
||||
|
||||
|
||||
``` mermaid
|
||||
图TB
|
||||
开始[Start] --> 匿名{尝试<br> 匿名？}
|
||||
anonymous--> | Yes | tor(使用Tor)
|
||||
anonymous--> | No | censorship{Avoiding<br> censorship?｝
|
||||
审查 --> | 是 | vpnOrTor(使用<br> VPN或Tor)
|
||||
审查 --> | 不 | 隐私{想从ISP那里获得隐私<br>？}。
|
||||
privacy --> | Yes | vpnOrTor
|
||||
privacy --> | No | obnoxious{ISP使<br> obnoxious<br> redirects? }
|
||||
obnoxious --> | Yes | encryptedDNS(使用第三方的<br> 加密DNS<br> )
|
||||
obnoxious --> | No | ispDNS{ISP是否支持<br> 加密DNS？ }
|
||||
ispDNS --> | 是 | useISP(与ISP一起使用<br> 加密DNS<br> )
|
||||
ispDNS --> | 否 | nothing(什么都不做)
|
||||
```
|
||||
|
||||
|
||||
第三方的加密DNS应该只用于绕过重定向和基本的 [DNS拦截](https://en.wikipedia.org/wiki/DNS_blocking) ，当你能确定不会有任何后果，或者你对一个能做一些基本过滤的供应商感兴趣时。
|
||||
|
||||
[推荐的DNS服务器列表](../dns.md ""){.md-button}
|
||||
|
||||
|
||||
|
||||
## 什么是DNSSEC？
|
||||
|
||||
[域名系统安全扩展](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions) (DNSSEC)是DNS的一项功能，对域名查询的响应进行认证。 它不为这些查询提供隐私保护，而是防止攻击者操纵或毒害对DNS请求的响应。
|
||||
|
||||
换句话说，DNSSEC对数据进行数字签名，以帮助确保其有效性。 为了确保安全查询，签名发生在DNS查询过程中的每一级。 因此，来自DNS的所有答案都可以被信任。
|
||||
|
||||
DNSSEC的签署过程类似于某人用笔签署一份法律文件；该人用一个独特的签名签署，其他人无法创建，法院专家可以查看该签名并验证该文件是由该人签署的。 这些数字签名确保数据没有被篡改。
|
||||
|
||||
DNSSEC在DNS的所有层面上实现了分层的数字签名政策。 例如，在 `privacyguides.org` 查询的情况下，根 DNS 服务器将签署 `.org` 名称服务器的密钥，然后 `.org` 名称服务器将签署 `privacyguides.org`的权威名称服务器的密钥。
|
||||
|
||||
<small>改编自Google的[DNS安全扩展(DNSSEC)概述](https://cloud.google.com/dns/docs/dnssec)和Cloudflare的[DNSSEC: An Introduction](https://blog.cloudflare.com/dnssec-an-introduction/)，两者均以[CC BY 4.0](https://creativecommons.org/licenses/by/4.0/)授权。</small>
|
||||
|
||||
|
||||
|
||||
## 什么是QNAME最小化？
|
||||
|
||||
QNAME是一个 "限定名称"，例如 `privacyguides.org`。 QNAME最小化减少了从DNS服务器发送至 [权威名称服务器的信息量](https://en.wikipedia.org/wiki/Name_server#Authoritative_name_server)。
|
||||
|
||||
而不是发送整个域名 `privacyguides.org`，QNAME最小化意味着DNS服务器将要求所有以 `.org`结尾的记录。 进一步的技术描述在 [RFC 7816](https://datatracker.ietf.org/doc/html/rfc7816)中定义。
|
||||
|
||||
|
||||
|
||||
## 什么是EDNS客户子网（ECS）？
|
||||
|
||||
[EDNS 客户端子网](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) 是递归 DNS 解析器为 [主机或客户端](https://en.wikipedia.org/wiki/Client_(computing)) 进行 DNS 查询时，指定一个 [子网](https://en.wikipedia.org/wiki/Subnetwork) 的一种方法。
|
||||
|
||||
它的目的是 "加快 "数据的交付，给客户一个属于离他们很近的服务器的答案，如 [内容交付网络](https://en.wikipedia.org/wiki/Content_delivery_network)，这通常用于视频流和服务JavaScript网络应用。
|
||||
|
||||
这项功能确实是以隐私为代价的，因为它告诉DNS服务器一些关于客户端位置的信息。
|
||||
84
i18n/zh/advanced/payments.md
Normal file
84
i18n/zh/advanced/payments.md
Normal file
@@ -0,0 +1,84 @@
|
||||
---
|
||||
title: Private Payments
|
||||
icon: material/hand-coin
|
||||
---
|
||||
|
||||
There's a reason data about your buying habits is considered the holy grail of ad targeting: your purchases can leak a veritable treasure trove of data about you. Unfortunately, the current financial system is anti-privacy by design, enabling banks, other companies, and governments to easily trace transactions. Nevertheless, you have plenty of options when it comes to making payments privately.
|
||||
|
||||
## Cash
|
||||
|
||||
For centuries, **cash** has functioned as the primary form of private payment. Cash has excellent privacy properties in most cases, is widely accepted in most countries, and is **fungible**, meaning it is non-unique and completely interchangable.
|
||||
|
||||
Cash payment laws vary by country. In the United States, special disclosure is required for cash payments over $10,000 to the IRS on [Form 8300](https://www.irs.gov/businesses/small-businesses-self-employed/form-8300-and-reporting-cash-payments-of-over-10000). The receiving business is required to ID verify the payee’s name, address, occupation, date of birth, and Social Security Number or other TIN (with some exceptions). Lower limits without ID such as $3,000 or less exist for exchanges and money transmission. Cash also contains serial numbers. These are almost never tracked by merchants, but they can be used by law enforcement in targeted investigations.
|
||||
|
||||
Despite this, it’s typically the best option.
|
||||
|
||||
## Prepaid Cards & Gift Cards
|
||||
|
||||
It’s relatively simple to purchase gift cards and prepaid cards at most grocery stores and convenience stores with cash. Gift cards usually don’t have a fee, though prepaid cards often do, so pay close attention to these fees and expiry dates. Some stores may ask to see your ID at checkout to reduce fraud.
|
||||
|
||||
Gift cards usually have limits of up to $200 per card, but some offer limits of up to $2,000 per card. Prepaid cards (eg: from Visa or Mastercard) usually have limits of up to $1,000 per card.
|
||||
|
||||
Gift cards have the downside of being subject to merchant policies, which can have terrible terms and restrictions. For example, some merchants don’t accept payment in gift cards exclusively, or they may cancel the value of the card if they consider you to be a high-risk user. Once you have merchant credit, the merchant has a strong degree of control over this credit.
|
||||
|
||||
Prepaid cards don’t allow cash withdrawals from ATMs or “peer-to-peer” payments in Venmo and similar apps.
|
||||
|
||||
Cash remains the best option for in-person purchases for most people. Gift cards can be useful for the savings they bring. Prepaid cards can be useful for places that don’t accept cash. Gift cards and prepaid cards are easier to use online than cash, and they are easier to acquire with cryptocurrencies than cash.
|
||||
|
||||
### Online Marketplaces
|
||||
|
||||
If you have [cryptocurrency](../cryptocurrency.md), you can purchase gift cards with an online gift card marketplace. Some of these services offer ID verification options for higher limits, but they also allow accounts with just an email address. Basic limits start at $5,000-10,000 a day for basic accounts, and significantly higher limits for ID verified accounts (if offered).
|
||||
|
||||
When buying gift cards online, there is usually a slight discount. Prepaid cards are usually sold online at face value or with a fee. If you buy prepaid cards and gift cards with cryptocurrencies, you should strongly prefer to pay with Monero which provides strong privacy, more on this below. Paying for a gift card with a traceable payment method negates the benefits a gift card can provide when purchased with cash or Monero.
|
||||
|
||||
- [Online Gift Card Marketplaces :material-arrow-right-drop-circle:](../financial-services.md#gift-card-marketplaces)
|
||||
|
||||
## Virtual Cards
|
||||
|
||||
Another way to protect your information from merchants online is to use virtual, single-use cards which mask your actual banking or billing information. This is primarily useful for protecting you from merchant data breaches, less sophisticated tracking or purchase correlation by marketing agencies, and online data theft. They do **not** assist you in making a purchase completely anonymously, nor do they hide any information from the banking institution themselves. Regular financial institutions which offer virtual cards are subject to "Know Your Customer" (KYC) laws, meaning they may require your ID or other identifying information.
|
||||
|
||||
- [Recommended Payment Masking Services :material-arrow-right-drop-circle:](../financial-services.md#payment-masking-services)
|
||||
|
||||
These tend to be good options for recurring/subscription payments online, while prepaid gift cards are preferred for one-time transactions.
|
||||
|
||||
## Cryptocurrency
|
||||
|
||||
Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose.
|
||||
|
||||
!!! 危险
|
||||
|
||||
The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity.
|
||||
|
||||
Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust.
|
||||
|
||||
### Privacy Coins
|
||||
|
||||
There are a number of cryptocurrency projects which purport to provide privacy by making transactions anonymous. We recommend using one which provides transaction anonymity **by default** to avoid operational errors.
|
||||
|
||||
- [Recommended Cryptocurrency :material-arrow-right-drop-circle:](../cryptocurrency.md#coins)
|
||||
|
||||
Privacy coins have been subject to increasing scrutiny by government agencies. In 2020, [the IRS published a $625,000 bounty](https://www.forbes.com/sites/kellyphillipserb/2020/09/14/irs-will-pay-up-to-625000-if-you-can-crack-monero-other-privacy-coins/?sh=2e9808a085cc) for tools which can break Bitcoin Lightning Network and/or Monero's transaction privacy. They ultimately [paid two companies](https://sam.gov/opp/5ab94eae1a8d422e88945b64181c6018/view) (Chainalysis and Integra Fec) a combined $1.25 million for tools which purport to do so (it is unknown which cryptocurrency network these tools target). Due to the secrecy surrounding tools like these, ==none of these methods of tracing cryptocurrencies have been independently confirmed.== However, it is quite likely that tools which assist targeted investigations into private coin transactions exist, and that privacy coins only succeed in thwarting mass surveillance.
|
||||
|
||||
### Other Coins (Bitcoin, Ethereum, etc.)
|
||||
|
||||
The vast majority of cryptocurrency projects use a public blockchain, meaning that all transactions are both easily traceable and permanent. As such, we strongly discourage the use of most cryptocurrency for privacy-related reasons.
|
||||
|
||||
Anonymous transactions on a public blockchain are *theoretically* possible, and the Bitcoin wiki [gives one example of a "completely anonymous" transaction](https://en.bitcoin.it/wiki/Privacy#Example_-_A_perfectly_private_donation). However, doing so requires a complicated setup involving Tor and "solo-mining" a block to generate completely independent cryptocurrency, a practice which has not been practical for nearly any enthusiast for many years.
|
||||
|
||||
==Your best option is to avoid these cryptocurrencies entirely and stick with one which provides privacy by default.== Attempting to use other cryptocurrency is outside the scope of this site and strongly discouraged.
|
||||
|
||||
### Wallet Custody
|
||||
|
||||
With cryptocurrency there are two forms of wallets: custodial wallets and noncustodial wallets. Custodial wallets are operated by centralized companies/exchanges, where the private key for your wallet is held by that company, and you can access them anywhere typically with a regular username and password. Noncustodial wallets are wallets where you control and manage the private keys to access it. Assuming you keep your wallet's private keys secured and backed up, noncustodial wallets provide greater security and censorship-resistance over custodial wallets, because your cryptocurrency can't be stolen or frozen by a company with custody over your private keys. Key custody is especially important when it comes to privacy coins: Custodial wallets grant the operating company the ability to view your transactions, negating the privacy benefits of those cryptocurrencies.
|
||||
|
||||
### Acquisition
|
||||
|
||||
Acquiring [cryptocurrencies](../cryptocurrency.md) like Monero privately can be difficult. P2P marketplaces like [LocalMonero](https://localmonero.co/), a platform which facilitates trades between people, are one option that can be used. If using an exchange which requires KYC is an acceptable risk for you as long as subsequent transactions can't be traced, a much easier option is to purchase Monero on an exchange like [Kraken](https://kraken.com/), or purchase Bitcoin/Litecoin from a KYC exchange which can then be swapped for Monero. Then, you can withdraw the purchased Monero to your own noncustodial wallet to use privately from that point forward.
|
||||
|
||||
If you go this route, make sure to purchase Monero at different times and in different amounts than where you will spend it. If you purchase $5000 of Monero at an exchange and make a $5000 purchase in Monero an hour later, those actions could potentially be correlated by an outside observer regardless of which path the Monero took. Staggering purchases and purchasing larger amounts of Monero in advance to later spend on multiple smaller transactions can avoid this pitfall.
|
||||
|
||||
## Additional Considerations
|
||||
|
||||
When you're making a payment in-person with cash, make sure to keep your in-person privacy in mind. Security cameras are ubiquitous. Consider wearing non-distinct clothing and a face mask (such as a surgical mask or N95). Don’t sign up for rewards programs or provide any other information about yourself.
|
||||
|
||||
When purchasing online, ideally you should do so over [Tor](tor-overview.md). However, many merchants don’t allow purchases with Tor. You can consider using a [recommended VPN](../vpn.md) (paid for with cash, gift card, or Monero), or making the purchase from a coffee shop or library with free Wi-Fi. If you are ordering a physical item that needs to be delivered, you will need to provide a delivery address. You should consider using a PO box, private mailbox, or work address.
|
||||
94
i18n/zh/advanced/tor-overview.md
Normal file
94
i18n/zh/advanced/tor-overview.md
Normal file
@@ -0,0 +1,94 @@
|
||||
---
|
||||
title: "Tor概述"
|
||||
icon: 'simple/torproject'
|
||||
description: Tor是一个免费使用的去中心化网络，专为尽量隐私地使用互联网而设计。
|
||||
---
|
||||
|
||||
Tor是一个免费使用的去中心化网络，专为尽量隐私地使用互联网而设计。 如果使用得当，该网络可以实现隐私且匿名地浏览和通信。
|
||||
|
||||
## Path Building to Clearnet Services
|
||||
|
||||
"Clearnet services" are websites which you can access with any browser, like [privacyguides.org](https://www.privacyguides.org). Tor lets you connect to these websites anonymously by routing your traffic through a network comprised of thousands of volunteer-run servers called nodes (or relays).
|
||||
|
||||
Every time you [connect to Tor](../tor.md), it will choose three nodes to build a path to the internet—this path is called a "circuit."
|
||||
|
||||
<figure markdown>
|
||||
|
||||
|
||||
<figcaption>Tor circuit pathway</figcaption>
|
||||
</figure>
|
||||
|
||||
每个节点都有自己的功能：
|
||||
|
||||
### 入口节点
|
||||
|
||||
入口节点，通常被称为守护节点，是你的Tor客户端连接到的第一个节点。 入口节点能够看到你的IP地址，但它无法看到你正在连接什么。
|
||||
|
||||
与其他节点不同，Tor客户端会随机选择一个入口节点并坚持两到三个月，以保护你免受某些攻击。[^1]
|
||||
|
||||
### 中间节点
|
||||
|
||||
中间节点是你的Tor客户端连接的第二个节点。 它可以看到流量来自哪个节点--入口节点--以及它接下来要去哪个节点。 中间节点不能，看到你的IP地址或你正在连接的域。
|
||||
|
||||
对于每个新线路，在所有可用的Tor节点中随机选择中间节点。
|
||||
|
||||
### 出口节点
|
||||
|
||||
出口节点是你的网络流量离开Tor网络并被转发到待达目的地的地方。 出口节点无法看到你的IP地址，但它确实知道正在连接到哪个网站。
|
||||
|
||||
出口节点将从运行有出口中继标志的所有可用Tor节点中随机选择。[^2]
|
||||
|
||||
## Path Building to Onion Services
|
||||
|
||||
"Onion Services" (also commonly referred to as "hidden services") are websites which can only be accessed by the Tor browser. These websites have a long randomly generated domain name ending with `.onion`.
|
||||
|
||||
Connecting to an Onion Service in Tor works very similarly to connecting to a clearnet service, but your traffic is routed through a total of **six** nodes before reaching the destination server. Just like before however, only three of these nodes are contributing to *your* anonymity, the other three nodes protect *the Onion Service's* anonymity, hiding the website's true IP and location in the same manner that Tor Browser is hiding yours.
|
||||
|
||||
<figure style="width:100%" markdown>
|
||||
|
||||
|
||||
<figcaption>Tor circuit pathway with Onion Services. Nodes in the <span class="pg-blue">blue</span> fence belong to your browser, while nodes in the <span class="pg-red">red</span> fence belong to the server, so their identity is hidden from you.</figcaption>
|
||||
</figure>
|
||||
|
||||
## 加密
|
||||
|
||||
Tor用出口、中间和入口节点的密钥对每个数据包（一个传输的数据块）进行三次加密--按顺序进行。
|
||||
|
||||
一旦Tor建立了一个电路，数据传输就会按以下方式进行。
|
||||
|
||||
1. 首先：当数据包到达入口节点时，第一层的加密被移除。 在这个加密的数据包中，入口节点会发现另一个带有中间节点地址的加密数据包。 然后，入口节点将把数据包转发给中间节点。
|
||||
|
||||
2. 第二：当中间节点收到来自入口节点的数据包时，它也会用自己的密钥去掉一层加密，这时会发现一个带有出口节点地址的加密数据包。 然后，中间节点将把数据包转发给出口节点。
|
||||
|
||||
3. 最后：当出口节点收到其数据包时，它将用其密钥去除最后一层加密。 出口节点将看到目标地址并将数据包转发到该地址。
|
||||
|
||||
下面是一个显示该过程的替代图。 每个节点都会移除自己的加密层，而当目的地服务器返回数据时，同样的过程会完全反向发生。 例如，出口节点不知道你是谁，但它知道它来自哪个节点，因此它添加了自己的加密层并将其发送回来。
|
||||
|
||||
<figure markdown>
|
||||
|
||||
|
||||
<figcaption>Sending and receiving data through the Tor Network</figcaption>
|
||||
</figure>
|
||||
|
||||
通过使用Tor，我们可以在没有任何一方知道整个线路的情况下连接到一个服务器。 入口节点知道你是谁，但不知道你要去哪里；中间节点不知道你是谁，也不知道你要去哪里；而出口节点知道你要去哪里，但不知道你是谁。 因为出口节点是进行最终连接的，目标服务器永远不会知道你的IP地址。
|
||||
|
||||
## Caveats (注意)
|
||||
|
||||
尽管Tor确实提供了强有力的隐私保障，但您必须意识到Tor并不完美：
|
||||
|
||||
- 资金充足、能够被动地观察全球大多数网络通信量的对手有机会通过先进的通信量分析将Tor用户去匿名化。 Tor也不能防止您错误地暴露自己，例如分享了太多关于您真实身份的信息。
|
||||
- Tor出口节点也可以监控通过它们的流量。 这意味着没有加密的流量，如普通的HTTP流量，可以被记录和监控。 如果这种流量包含个人可识别信息，那么那个出口节点可以把你去匿名化。 因此，我们建议尽可能使用HTTPS over Tor。
|
||||
|
||||
如果您希望使用Tor浏览网页，我们只建议使用 **官方** Tor浏览器，该浏览器旨在防止指纹。
|
||||
|
||||
- [Tor浏览器 :material-arrow-right-drop-circle:](../tor.md#tor-browser)
|
||||
|
||||
## 其它资源
|
||||
|
||||
- [Tor浏览器用户手册](https://tb-manual.torproject.org)
|
||||
- [How Tor Works - Computerphile](https://invidious.privacyguides.net/embed/QRYzre4bf7I?local=true) <small>(YouTube)</small>
|
||||
- [Tor Onion Services - Computerphile](https://invidious.privacyguides.net/embed/lVcbq_a5N9I?local=true) <small>(YouTube)</small>
|
||||
|
||||
[^1]: 您线路上的第一个中继称为“入口警卫“或“警卫”。 它是一个快速而稳定的中继，会在2-3个月内持续作为你的线路的第一个中继，以防止已知的破坏匿名性的攻击。 你的线路其余部分会随着你访问的每个新网站而改变，所有这些中继器一起提供Tor的全部隐私保护。 关于警卫中继器如何工作的更多信息，请参阅这篇 [博文](https://blog.torproject.org/improving-tors-anonymity-changing-guard-parameters) 和 [关于入口警卫的论文](https://www-users.cs.umn.edu/~hoppernj/single_guard.pdf)。 ([https://support.torproject.org/tbb/tbb-2/](https://support.torproject.org/tbb/tbb-2/))
|
||||
|
||||
[^2]: 中继标志：由目录权限分配并在目录协议规范中进一步定义的线路位置（例如， “Guard”、“Exit”、“BadExit” ）、线路属性（例如， “Fast”、“Stable” ）或角色（例如， “Authority”、“HSDir” ）的中继的特殊（ dis- ）限定。 ([https://metrics.torproject.org/glossary.html](https://metrics.torproject.org/glossary.html))
|
||||
Reference in New Issue
Block a user