mirror of
https://github.com/privacyguides/privacyguides.org.git
synced 2025-08-09 20:41:09 +00:00
New Crowdin Translations (#2110)
Co-authored-by: Crowdin Bot <support+bot@crowdin.com>
This commit is contained in:
Privacy Guides [bot]
committed by
GitHub
GitHub
parent
6582156917
commit
4847c25066
@@ -1,22 +1,22 @@
|
||||
---
|
||||
title: "刪除帳號"
|
||||
title: "刪除帳戶"
|
||||
icon: 'material/account-remove'
|
||||
description: 一般人很容易累積大量的網路服務帳戶，這裏有一些如何順理這些資料的小訣竅。
|
||||
---
|
||||
|
||||
隨著時間的推移，它可以很容易地積累一些在線帳戶，其中許多你可能不再使用。 刪除這些未使用的帳戶是收回隱私的重要一步，因為休眠帳戶容易受到數據洩露的影響。 資料外洩是指服務的安全性受到破壞，受保護的資訊被未經授權的行為者檢視、傳輸或竊取。 不幸的是近來資料外洩事件 [已見怪不怪](https://haveibeenpwned.com/PwnedWebsites) ，保持良好的數位清潔才能減輕資料外洩對個人生活的衝擊。 本指南的目標是幫助您通過令人討厭的帳戶刪除過程，通常由 [欺騙性設計](https://www.deceptive.design/)使您變得困難，以改善您的在線存在。
|
||||
隨著時間的推移，一般人很容易地積累一些網路帳戶，但可能其中有不少早已不再使用。 刪除這些未使用的帳戶是收回隱私的重要一步，因為休眠帳戶容易受到數據洩露的影響。 資料外洩是指服務的安全性受到破壞，受保護的資訊被未經授權的行為者檢視、傳輸或竊取。 不幸的是近來資料外洩事件 [已見怪不怪](https://haveibeenpwned.com/PwnedWebsites) ，保持良好的數位清潔才能減輕資料外洩對個人生活的衝擊。 本指南的目標是幫助您通過令人討厭的帳戶刪除過程----通常由 [欺騙性設計](https://www.deceptive.design/)讓刪除困難，以改善您的網路現身。
|
||||
|
||||
## 查找舊帳戶
|
||||
|
||||
### 密碼管理器。
|
||||
|
||||
如果你有一個密碼管理器，你已經使用了你的整個數字生活，這部分將是非常容易的。 通常，它們包括內置功能，用於檢測您的憑證是否在數據洩露中暴露-例如Bitwarden的 [數據洩露報告](https://bitwarden.com/blog/have-you-been-pwned/)。
|
||||
如果您使用一個貫穿整個數位生活的密碼管理器，這部分將非常容易。 通常，它們包括內置功能，用於檢測您的憑證是否在資料洩露中暴露-例如Bitwarden的 [資料洩露報告](https://bitwarden.com/blog/have-you-been-pwned/)。
|
||||
|
||||
<figure markdown>
|
||||
|
||||
</figure>
|
||||
|
||||
即使您之前沒有明確使用過密碼管理器，也有可能您在瀏覽器或手機中使用了密碼管理器，甚至沒有意識到這一點。 例如： [Firefox Password Manager](https://support.mozilla.org/kb/password-manager-remember-delete-edit-logins)、 [Google Password Manager](https://passwords.google.com/intro) 和 [Edge Password Manager](https://support.microsoft.com/en-us/microsoft-edge/save-or-forget-passwords-in-microsoft-edge-b4beecb0-f2a8-1ca0-f26f-9ec247a3f336)。
|
||||
即使您之前沒有明確使用過密碼管理器，但可能在無意中早已透過瀏覽器或手機中使用了密碼管理器。 例如： [Firefox 密碼管理器](https://support.mozilla.org/kb/password-manager-remember-delete-edit-logins)、 [Google 密碼管理器](https://passwords.google.com/intro) 和 [Edge 密碼管理器](https://support.microsoft.com/en-us/microsoft-edge/save-or-forget-passwords-in-microsoft-edge-b4beecb0-f2a8-1ca0-f26f-9ec247a3f336)。
|
||||
|
||||
桌面平臺通常還有一個密碼管理器，可以幫助您恢復忘記的密碼：
|
||||
|
||||
@@ -39,7 +39,7 @@ description: 一般人很容易累積大量的網路服務帳戶，這裏有一
|
||||
|
||||
### GDPR （僅限歐洲經濟區居民）
|
||||
|
||||
歐盟居民在資料刪除上享有額外權利，其詳見於 GDPR [第 17 條](https://www.gdpr.org/regulation/article-17.html)規定。 如果適用於您，請閱讀任何特定服務的隱私權政策，以查找有關如何行使刪除權利的資訊。 閱讀隱私政策可能很重要，因為某些服務的「刪除帳戶」選項，實際上只是停用您的帳戶，若要真正刪除，您必須採取額外行動。 有時，刪除過程中可能需填寫調查、向服務商的資料保護人員發送電子郵件，甚至提出您為歐盟居民的證明。 如果您計劃這樣做，請執行 **而不是** 覆寫帳戶信息-可能需要您作為歐洲經濟區居民的身份。 Note that the location of the service does not matter; GDPR applies to anyone serving European users. If the service does not respect your right to erasure, you can contact your national [Data Protection Authority](https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/redress/what-should-i-do-if-i-think-my-personal-data-protection-rights-havent-been-respected_en) and you may be entitled to monetary compensation.
|
||||
歐盟居民在資料刪除上享有額外權利，其詳見於 GDPR [第 17 條](https://www.gdpr.org/regulation/article-17.html)規定。 如果適用於您，請閱讀任何特定服務的隱私權政策，以查找有關如何行使刪除權利的資訊。 閱讀隱私政策可能很重要，因為某些服務的「刪除帳戶」選項，實際上只是停用您的帳戶，若要真正刪除，您必須採取額外行動。 有時，刪除過程中可能需填寫調查、向服務商的資料保護人員發送電子郵件，甚至提出您為歐盟居民的證明。 如果您打算這樣做，請 **不要** 覆寫帳戶資訊-可能需要歐盟居民身份。 請注意，服務的位置並不重要； GDPR 適用於為歐盟用戶服務的任何人。 若服務商不願尊重您請求刪除的權利，可聯絡所在國的[官方資料保護機關](https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/redress/what-should-i-do-if-i-think-my-personal-data-protection-rights-havent-been-respected_en)，您可能有權請求金錢賠償。
|
||||
|
||||
### 覆寫帳戶資訊
|
||||
|
||||
|
||||
@@ -1,60 +1,94 @@
|
||||
---
|
||||
title: "常見的迷思"
|
||||
icon: 'material/robot-confused'
|
||||
description: Privacy isn't a straightforward topic, and it's easy to get caught up in marketing claims and other disinformation.
|
||||
description: 隱私並不是一個直覺的話題，它容易遭行銷話術與其它虛假訊息的綁架。
|
||||
schema:
|
||||
-
|
||||
"@context": https://schema.org
|
||||
"@type": FAQPage
|
||||
mainEntity:
|
||||
-
|
||||
"@type": Question
|
||||
name: 開源軟件本質上安全嗎？
|
||||
acceptedAnswer:
|
||||
"@type": Answer
|
||||
text: |
|
||||
源代碼是否可公開取得以及軟件本身的授權條件並不會影響其安全性。 開源軟件可能比商有軟件更安全，但這點並非絕對保證。 評估軟體時，應該根據個別情況來評估每個工具的聲譽和安全性。
|
||||
-
|
||||
"@type": Question
|
||||
name: 將信任轉移到另一個提供商可以增加隱私嗎？
|
||||
acceptedAnswer:
|
||||
"@type": Answer
|
||||
text: |
|
||||
在討論 VPN 等解決方案時，我們經常談到「轉移信任」 （將您對 ISP 的信任轉移到 VPN 提供商）。 雖然這可以特別保護瀏覽數據免受 ISP 影響，但挑選的 VPN 提供商仍然可以訪問您的瀏覽數據：資料並非得到完全保護。
|
||||
-
|
||||
"@type": Question
|
||||
name: 以隱私為中心的解決方案本質上可信賴嗎?
|
||||
acceptedAnswer:
|
||||
"@type": Answer
|
||||
text: |
|
||||
僅專注於單一工具或提供商的隱私政策和營銷可能會讓您忽視其弱點。 當您正在尋找更私密的解決方案時，您應該確定潛在的問題是什麼，並找到該問題的技術解決方案。 例如，您可能希望避免 Google 雲端硬碟，這會讓 Google 存取您的所有資料。 這種情況下潛在的問題是缺乏E2EE ，因此應確保切換的提供商有真地落實 E2EE ，或者使用雲端服務商提供的 E2EE 工具（如Cryptomator ）。 轉換到“以隱私為中心”的提供商（其不用 E2EE ）不能解決您的問題：它只是將信任從 Google 轉移到該供應商。
|
||||
-
|
||||
"@type": Question
|
||||
name: 我的威脅模型需要多複雜？
|
||||
acceptedAnswer:
|
||||
"@type": Answer
|
||||
text: |
|
||||
我們經常看到人們描述過於複雜的隱私威脅模型。 通常，這些解決方案包括許多不同的電子郵件帳戶或具有許多移動部件和條件的複雜設置等問題。 答案通常是“做 X 的最佳方式是什麼？”
|
||||
為自己找到“最佳”解決方案並不一定意味著您正在尋找具有數十種條件的絕對解決方案-這些解決方案通常很難實際使用。 正如先前所討論的，安全性通常是以方便為代價。
|
||||
---
|
||||
|
||||
## 「開源軟體永遠是安全的」或「商業軟體更安全」
|
||||
|
||||
這些迷思源於許多偏見，原始碼是否開放以及軟體的許可並不會以任何方式影響其安全性。 開源軟件 *可能* 比商業軟件更安全，但絕對不能保證這一點。當你評估軟體時，你應該根據每個工具的聲譽和安全性進行評估。
|
||||
這些迷思源於許多偏見，原始碼是否開放以及軟體的許可並不會以任何方式影響其安全性。 ==開源軟件 *可能* 比商業軟件更安全，但絕對不能保證這一點。==評估軟體時，您應該根據每個工具的聲譽和安全性進行評估。
|
||||
|
||||
Open-source software *can* be audited by third-parties, and is often more transparent about potential vulnerabilities than proprietary counterparts. 它還允許您查看代碼並禁用您發現的任何可疑功能。 然而，*除非你真的這樣做了*，否則不能保證程式碼曾經被評估過，特別是對於較小的軟體項目。 The open development process has also sometimes been exploited to introduce new vulnerabilities into even large projects.[^1]
|
||||
開源軟體*能夠*由第三方人員進行審計，比起同類商用軟體，前者對待潛在漏洞更為透明。 它還允許您查看代碼並禁用您發現的任何可疑功能。 然而，*除非您真的這樣做了*，否則不能保證程式碼曾經被評估過，特別是小型軟體專案。 開放的發展過程有時會遭利用，甚至在大型專案中被引入新的漏洞。
|
||||
|
||||
另一方面，專有軟件不太透明，但這並不意味著它不安全。 主要的專有軟件項目可以由內部和第三方機構進行審計，獨立的安全研究人員仍然可以通過逆向工程等技術發現漏洞。
|
||||
另一方面，專有軟件不太透明，但這並不意味著它不安全。 主要的商用軟件專案會由內部和第三方機構進行審計，獨立的安全研究人員仍然可以通過逆向工程等技術發現漏洞。
|
||||
|
||||
To avoid biased decisions, it's *vital* that you evaluate the privacy and security standards of the software you use.
|
||||
避免決策上的偏見，這點在評估所使用軟體的隱私與安全標準上至關重要。
|
||||
|
||||
## 「信任的轉移可以增加隱私」
|
||||
|
||||
在討論 VPN 等解決方案時，我們經常談到「轉移信任」 （將您對 ISP 的信任轉移到 VPN 提供商）。 雖然這可以保護您的瀏覽數據免受 *特定* ISP 的侵害，但您選擇的 VPN 提供商仍然可以訪問您的瀏覽數據：您的數據並非完全受到各方的保護。 這意味著：
|
||||
在討論 VPN 等解決方案時，我們經常談到「轉移信任」 （將您對 ISP 的信任轉移到 VPN 提供商）。 雖然這可以保護您的瀏覽資料免受 *特定* ISP 的侵害，但您選擇的 VPN 提供商仍然可以訪問您的瀏覽數據：您的資料並非完全受到各方的保護。 這意味著：
|
||||
|
||||
1. You must exercise caution when choosing a provider to shift trust to.
|
||||
2. You should still use other techniques, like E2EE, to protect your data completely. Merely distrusting one provider to trust another is not securing your data.
|
||||
1. 把信任轉付給挑選的服務供應商時，您必須謹慎行事。
|
||||
2. 您應該利用其它技巧，如 E2EE 來完全保護您的資料。 僅因個別供應商的信任與否，並不能確保資料的安全。
|
||||
|
||||
## "Privacy-focused solutions are inherently trustworthy"
|
||||
## 「以隱私為中心的解決方案本質上是值得信賴的」
|
||||
|
||||
Focusing solely on the privacy policies and marketing of a tool or provider can blind you to its weaknesses. 當您正在尋找更私密的解決方案時，您應該確定潛在的問題是什麼，並找到該問題的技術解決方案。 For example, you may want to avoid Google Drive, which gives Google access to all of your data. The underlying problem in this case is lack of E2EE, so you should make sure that the provider you switch to actually implements E2EE, or use a tool (like [Cryptomator](../encryption.md#cryptomator-cloud)) which provides E2EE on any cloud provider. Switching to a "privacy-focused" provider (that doesn't implement E2EE) doesn't solve your problem: it just shifts trust from Google to that provider.
|
||||
僅專注於單一工具或提供商的隱私政策和營銷可能會讓您忽視其弱點。 當您正在尋找更私密的解決方案時，您應該確定潛在的問題是什麼，並找到該問題的技術解決方案。 例如，您可能希望避免 Google 雲端硬碟，這會讓 Google 存取您的所有資料。 這種情況的問題是缺乏 E2EE ，因此您應該確保您轉換的供應商真正實現了E2EE ，或者使用可在任何雲提供商安裝 E2EE 的工具（如 [Cryptomator](../encryption.md#cryptomator-cloud)）。 轉換到“以隱私為中心”的提供商（其不用 E2EE ）不能解決您的問題：它只是將信任從 Google 轉移到該供應商。
|
||||
|
||||
The privacy policies and business practices of providers you choose are very important, but should be considered secondary to technical guarantees of your privacy: You shouldn't shift trust to another provider when trusting a provider isn't a requirement at all.
|
||||
您選擇的供應商的隱私政策和商業實踐非常重要，但應視為隱私技術保證的次要條件：當無須信任供應商時，您不必將信任轉移到另一個供應商。
|
||||
|
||||
## 「愈複雜愈好」
|
||||
|
||||
我們經常看到人們描述過於複雜的隱私威脅模型。 通常，這些解決方案包括許多不同的電子郵件帳戶或具有許多運動部件和條件的複雜設置等問題。 The replies are usually answers to "What is the best way to do *X*?"
|
||||
我們經常看到人們描述過於複雜的隱私威脅模型。 通常，這些解決方案包括許多不同的電子郵件帳戶或具有許多移動部件和條件的複雜設置等問題。 答案通常是“做 * X *的最佳方式是什麼？”
|
||||
|
||||
Finding the "best" solution for yourself doesn't necessarily mean you are after an infallible solution with dozens of conditions—these solutions are often difficult to work with realistically. As we discussed previously, security often comes at the cost of convenience. Below, we provide some tips:
|
||||
為自己找到“最佳”解決方案並不一定意味著您正在尋找具有數十種條件的絕對解決方案-這些解決方案通常很難實際使用。 正如先前所討論的，安全性通常是以方便為代價。 下面，我們提供一些訣竅：
|
||||
|
||||
1. ==Actions need to serve a particular purpose:== think about how to do what you want with the fewest actions.
|
||||
2. ==Remove human failure points:== We fail, get tired, and forget things. To maintain security, avoid relying on manual conditions and processes that you have to remember.
|
||||
3. ==Use the right level of protection for what you intend.== We often see recommendations of so-called law-enforcement or subpoena-proof solutions. These often require specialist knowledge and generally aren't what people want. There's no point in building an intricate threat model for anonymity if you can be easily de-anonymized by a simple oversight.
|
||||
1. == 行動需要達到特定的目的：== 想想如何用最少的行動做到想做的事。
|
||||
2. ==移除人類的失敗點：== 人總會失敗、疲倦、忘記事情。 要保持安全性，請避免依賴大腦記憶的手動條件和流程。
|
||||
3. = =使用您要想的適當保護等級。== 我們經常看到所謂的執法或傳票證明解決方案的建議。 這些通常需要專業知識，通常不是人們想要的。 建立一個複雜的匿名威脅模型是沒有意義的，如果您的行為容易地被一個簡單的監督去匿名化。
|
||||
|
||||
So, how might this look?
|
||||
那麼，這看起來會怎麼樣？
|
||||
|
||||
One of the clearest threat models is one where people *know who you are* and one where they do not. 總會有你必須申報你的法定姓名的情況，還有其他你不需要的情況。
|
||||
最清晰的威胁模型之一是，部分人*，知道你是谁* ，而另一部分人不知道。 有些必須提出您的法定姓名的情況，但也有其他情況不需要提供全名。
|
||||
|
||||
1. **Known identity** - A known identity is used for things where you must declare your name. 有許多法律文件和合同需要合法身份。 這可能包括開設銀行帳戶，簽署財產租賃，獲得護照，進口物品時的海關申報，或以其他方式與您的政府打交道。 這些東西通常會導致憑證，如信用卡，信用評級檢查，帳戶號碼，以及可能的物理地址。
|
||||
1. **已知身份** - 已知身份是用于必須告之姓名的事務。 有許多法律文件和合同需要合法身份。 這可能包括開設銀行帳戶、簽署財產租賃、獲得護照、進口物品時的海關申報，或其他與政府打交道的方式。 這些東西通常會需要憑證，如信用卡，信用評級檢查，帳戶號碼，以及實際地址等。
|
||||
|
||||
我們不建議您使用 VPN 或 Tor 來處理這些事情，因為您的身份已經通過其他方式被對方知道。
|
||||
|
||||
!!! tip
|
||||
!!! 訣竅
|
||||
|
||||
在網上購物時，使用[包裹儲物櫃] (https://zh.wikipedia.org/wiki/Parcel_locker)有助於保護您的實際地址的私密性。
|
||||
在網上購物時，使用[包裹儲物櫃] (https://zh.wikipedia.org/wiki/Parcel_locker)有助於保護您實際地址的私密性。
|
||||
|
||||
2. **未知身份** - 未知身份可能是您經常使用的穩定假名。 它不是匿名的，因為它不會改變。 如果您是線上社群的一員，您可能希望保留其他人知道的角色。 這個假名不是匿名的，因為如果監控時間足夠長，關於所有者的詳細信息可以透露更多信息，例如他們的寫作方式，他們對感興趣主題的一般知識等。
|
||||
2. **未知身份** - 未知身份可能是您經常使用的穩定假名。 它已不算匿名了，因為不會變動。 如果您是線上社群的一員，您可能希望保留其他人知道的角色。 這個假名不是匿名的，因為如果監控時間足夠長，關於所有者的詳細信息可以透露更多信息，例如他們的寫作方式，他們對感興趣主題的一般知識等。
|
||||
|
||||
您可能希望使用 VPN 來隱藏您的 IP 地址。 金融交易更難掩蓋：您可以考慮使用匿名加密貨幣，例如 [Monero](https://www.getmonero.org/)。 採用山寨幣轉移也可能有助於偽裝您的貨幣起源。 通常情況下，交易所需要完成 KYC （了解您的客戶） ，然後才能將法定貨幣兌換為任何類型的加密貨幣。 線下操作也可能是一個解決方案；然而，這些往往更昂貴，有時也需要 KYC。
|
||||
您可能希望使用 VPN 來隱藏您的 IP 地址。 金融交易更難掩蓋：您可以考慮使用匿名加密貨幣，例如 [Monero](https://www.getmonero.org/)。 採用山寨幣轉移也可能有助於偽裝您的貨幣來源。 通常情況下，交易所需要完成 KYC （了解您的客戶） ，然後才能將法定貨幣兌換為任何類型的加密貨幣。 線下操作也可能是一個解決方案；然而，這些往往更昂貴，有時也需要 KYC。
|
||||
|
||||
3. **匿名身份** - 即使有經驗的專家，也很難長時間保持一個帳號的匿名性。 它們應該是短期和短暫的身份，定期輪流。
|
||||
|
||||
使用 Tor 可以幫助我們做到這一點。 同樣值得注意的是，通過異步溝通可以實現更大的匿名性：實時溝通容易受到打字模式分析的影響（即不止一段文字，在論壇上分發，通過電子郵件等）。
|
||||
|
||||
[^1]: One notable example of this is the [2021 incident in which University of Minnesota researchers introduced three vulnerabilities into the Linux kernel development project](https://cse.umn.edu/cs/linux-incident).
|
||||
[^1]: 一個值得注意的例子是 [發生在2021年，明尼蘇達大學的研究人員在 Linux 內核開發項目中引入了三個漏洞](https://cse.umn.edu/cs/linux-incident).
|
||||
|
||||
@@ -1,148 +1,148 @@
|
||||
---
|
||||
title: "Common Threats"
|
||||
title: "常見威脅"
|
||||
icon: 'material/eye-outline'
|
||||
description: Your threat model is personal to you, but these are some of the things many visitors to this site care about.
|
||||
description: 您的威脅模型雖說是個人的事，但它也是本站許多訪客關心的課題。
|
||||
---
|
||||
|
||||
從廣義上講，我們將我們的建議分為適用於大多數人的 [個威脅](threat-modeling.md) 或目標。 你可能會關心沒有，一個，幾個或所有這些可能性，你使用的工具和服務取決於你的目標是什麼。 您也可能有這些類別之外的特定威脅，這完全有可能！ 重要的是要了解您選擇使用的工具的好處和缺點，因為幾乎沒有一種工具可以保護您免受任何威脅。
|
||||
廣義來講，我們將建議歸類為適用於大多數人的 [威脅](threat-modeling.md) 或目標。 您可能會在意各種可能性的組合，而選用的工具和服務則取決於您的目標何在。 您也可能有超出這些類別之外的特定威脅，這完全有可能！ 重要的是要了解您選擇使用的工具的好處和缺點，因為幾乎沒有一種工具可以保護您免受任何威脅。
|
||||
|
||||
- <span class="pg-purple">:material-incognito: 匿名</span> -保護您的在線活動免受您的真實身份影響，保護您免受試圖特別揭露 *您* 身份的人的侵害。
|
||||
- <span class="pg-red">:material-target-account: 有針對性的攻擊</span> -保護免受駭客或其他惡意行為者的攻擊，這些行為者正試圖特別訪問 *個您的* 個數據或設備。
|
||||
- <span class="pg-purple">:material-incognito: 匿名</span> -保護您的在線活動免受您真實身份影響，保護您防範某些企圖揭露 *您* 身份的侵害。
|
||||
- <span class="pg-red">:material-target-account: 針對性的攻擊</span> -保護免受駭客或其他惡意行為者的攻擊，他們正試圖存取訪問 *您的* 資料或設備。
|
||||
- <span class="pg-orange">:material-bug-outline: 被動攻擊</span> -保護免受惡意軟體、數據洩露和其他同時針對多人的攻擊。
|
||||
- <span class="pg-teal">:material-server-network: Service Providers</span> - Protecting your data from service providers (e.g. with E2EE, which renders your data unreadable to the server).
|
||||
- <span class="pg-blue">:material-eye-outline: Mass Surveillance</span> - Protection from government agencies, organizations, websites, and services which work together to track your activities.
|
||||
- <span class="pg-brown">:material-account-cash: Surveillance Capitalism</span> - Protecting yourself from big advertising networks, like Google and Facebook, as well as a myriad of other third-party data collectors.
|
||||
- <span class="pg-green">:material-account-search: Public Exposure</span> - Limiting the information about you that is accessible online—to search engines or the general public.
|
||||
- <span class="pg-blue-gray">:material-close-outline: Censorship</span> - Avoiding censored access to information or being censored yourself when speaking online.
|
||||
- <span class="pg-teal">:material-server-network: 服務供應商</span> - 保護您的資料免受服務供應商侵害（例如，使用 E2EE ，使您保存在伺服器的資料無法被他人讀取）。
|
||||
- <span class="pg-blue">:material-eye-outline: 大規模監控</span> -保護您免受政府機構、組織、網站和服務共同追蹤您的活動。
|
||||
- <span class="pg-brown">:material-account-cash: 監控資本主義</span> - 保議自己不會被 Google， Facebook 等大型網路廣告以及其它無數第三方資料收集者監控。
|
||||
- <span class="pg-green">:material-account-search: 公開曝光</span> -限制搜尋引擎或一般大眾可在網路上找到有關您的資訊。
|
||||
- <span class="pg-blue-gray">:material-close-outline: 審查</span> -避免資訊被封鎖或自己的網路發言時受到審查。
|
||||
|
||||
其中一些威脅對您來說可能比其他威脅更重要，這取決於您的具體問題。 For example, a software developer with access to valuable or critical data may be primarily concerned with <span class="pg-red">:material-target-account: Targeted Attacks</span>, but they probably still want to protect their personal data from being swept up in <span class="pg-blue">:material-eye-outline: Mass Surveillance</span> programs. Similarly, many people may be primarily concerned with <span class="pg-green">:material-account-search: Public Exposure</span> of their personal data, but they should still be wary of security-focused issues, such as <span class="pg-orange">:material-bug-outline: Passive Attacks</span>—like malware affecting their devices.
|
||||
其中一些威脅對您來說可能比其他威脅更嚴重，這取決於您的具體問題。 例如，有權訪問有價值或重要資料的開發人員可能主要關注 <span class="pg-red">:material-target-account: 針對性攻擊</span>，但他們仍然希望保護自己的個資免受 <span class="pg-blue">:material-eye-outline: 大規模監控</span> 計劃的影響。 同樣，許多人主要關心其個人資料的 <span class="pg-green">:material-account-search: 公開曝光</span> ，但他們仍應該警惕聚焦安全的問題，例如 <span class="pg-orange">:material-bug-outline: 被動攻擊</span>-例如惡意軟件影響他們的設備。
|
||||
|
||||
## Anonymity vs. Privacy
|
||||
## 匿名 vs. 隱私
|
||||
|
||||
<span class="pg-purple">:material-incognito: Anonymity</span>
|
||||
<span class="pg-purple">:material-incognito: 匿名性</span>
|
||||
|
||||
Anonymity is often confused with privacy, but they're distinct concepts. While privacy is a set of choices you make about how your data is used and shared, anonymity is the complete disassociation of your online activities from your real identity.
|
||||
匿名通常與隱私相混淆，但它們是不同的概念。 隱私是您對如何使用和共享資料所做出的一系列選擇，而匿名是將您的線上活動與真實身份完全分離。
|
||||
|
||||
Whistleblowers and journalists, for example, can have a much more extreme threat model which requires total anonymity. That's not only hiding what they do, what data they have, and not getting hacked by malicious actors or governments, but also hiding who they are entirely. They will often sacrifice any kind of convenience if it means protecting their anonymity, privacy, or security, because their lives could depend on it. Most people don't need to go so far.
|
||||
舉例來說，揭密者和記者會需要一個更極端、要求完全匿名的威脅模型。 這不僅隱藏了他們所做的事情、擁有的資料，不會被惡意行為者或政府駭客入侵，而且還完全隱暪了他們的身份。 他們經常需犧牲任何形式的便利，以保護自身的匿名性，隱私或安全，因為很可能事關自己的性命。 大多數人都不需要那樣。
|
||||
|
||||
## Security and Privacy
|
||||
## 安全與隱私
|
||||
|
||||
<span class="pg-orange">:material-bug-outline: Passive Attacks</span>
|
||||
<span class="pg-orange">:material-bug-outline: 被動攻擊</span>
|
||||
|
||||
Security and privacy are also often confused, because you need security to obtain any semblance of privacy: Using tools—even if they're private by design—is futile if they could be easily exploited by attackers who later release your data. However, the inverse isn't necessarily true: The most secure service in the world *isn't necessarily* private. The best example of this is trusting data to Google who, given their scale, have had few security incidents by employing industry-leading security experts to secure their infrastructure. Even though Google provides very secure services, very few people would consider their data private in Google's free consumer products (Gmail, YouTube, etc.)
|
||||
安全性和隱私也經常被混淆，因為您需要安全性來獲得任何形式的隱私：使用的工具----即便設計私密----但若很容易地受到攻擊者造成資料外洩，一切就是白廢了。 然而，相反的情況並不一定成立：世界上最安全的服務 *不一定是* 私密。 最好的例子是信任把資料交給 Google，因為它們規模龐大聘請業界領先的安全專家來保護其基礎設施，幾乎沒有發生過安全事故。 儘管 Google 提供了非常安全的服務，但很少有人會認為在Google 免費消費產品（Gmail、YouTube 等）中的資料是私有的。
|
||||
|
||||
When it comes to application security, we generally don't (and sometimes can't) know if the software we use is malicious, or might one day become malicious. Even with the most trustworthy developers, there's generally no guarantee that their software doesn't have a serious vulnerability that could later be exploited.
|
||||
當涉及到應用程式安全性時，我們通常不知道（有時甚至無法）使用的軟體是否是惡意或者有一天它會變成惡意。 即使是最值得信賴的開發人員，也無法保證他們的軟體沒有嚴重的漏洞有一天會被利用。
|
||||
|
||||
To minimize the damage that a malicious piece of software *could* do, you should employ security by compartmentalization. For example, this could come in the form of using different computers for different jobs, using virtual machines to separate different groups of related applications, or using a secure operating system with a strong focus on application sandboxing and mandatory access control.
|
||||
減少惡意軟體*可能造成的破壞* ，最好能落實安全劃分方案。 例如，用不同電腦作不同的事、利用虛擬器來分組不同的相關應用程式，或者使用一個高集中的應用程式沙盒和強制訪問控制的安全操作系統。
|
||||
|
||||
!!! tip
|
||||
!!! 提示
|
||||
|
||||
Mobile operating systems generally have better application sandboxing than desktop operating systems: Apps can't obtain root access, and require permission for access to system resources.
|
||||
行動作業系統通常具有比桌面作業系統具備更好的應用程式沙盒：應用程式沒有根存取權限，且需要存取系統資源的權限。
|
||||
|
||||
Desktop operating systems generally lag behind on proper sandboxing. ChromeOS has similar sandboxing capabilities to Android, and macOS has full system permission control (and developers can opt-in to sandboxing for applications). However, these operating systems do transmit identifying information to their respective OEMs. Linux tends to not submit information to system vendors, but it has poor protection against exploits and malicious apps. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../../desktop/#qubes-os).
|
||||
桌面操作系統通常在適當的沙盒化上落後。 ChromeOS 具備與 Android 相似的沙盒功能， macOS 具有完整的系統權限控制（開發人員可以選擇為應用程式加入沙盒）。 然而，這些作業系統確實會將識別資料傳回給各自的原始設備製造商。 Linux 傾向於不對系統供應商提交資料，但它在漏洞和惡意應用程式的保護很差。 這可以通過專門的發行版來緩解，這些發行版大量使用虛擬器或容器，例如 [Qubes OS] （../../desktop/# qubes-os ）。
|
||||
|
||||
<span class="pg-red">:material-target-account: Targeted Attacks</span>
|
||||
<span class="pg-red">:material-target-account: 目標攻擊</span>
|
||||
|
||||
Targeted attacks against a specific person are more problematic to deal with. Common attacks include sending malicious documents via email, exploiting vulnerabilities (e.g. in browsers and operating systems), and physical attacks. If this is a concern for you, you should employ more advanced threat mitigation strategies.
|
||||
針對特定人士的針對性攻擊更難處理。 常見的攻擊包括通過電子郵件發送惡意文件、利用(瀏覽器和操作系統的)漏洞以及物理攻擊。 如果這是您擔心這點，應該採用更先進的威脅減輕策略。
|
||||
|
||||
!!! tip
|
||||
!!! 提示
|
||||
|
||||
By design, **web browsers**, **email clients**, and **office applications** typically run untrusted code, sent to you from third parties. Running multiple virtual machines—to separate applications like these from your host system, as well as each other—is one technique you can use to mitigate the chance of an exploit in these applications compromising the rest of your system. For example, technologies like Qubes OS or Microsoft Defender Application Guard on Windows provide convenient methods to do this.
|
||||
在設計上， * *網頁瀏覽器* *、* *電子郵件用戶端* *和* *辦公室應用程式* *常常運行第三方發送無法信任的代碼。 運行多個虛擬器-將這些應用程序與主機系統相互分開，此技術可減少系統遭到應用程序攻擊的機會。 例如， Qubes OS 或 Windows 上的 Microsoft Defender Application Guard 等技術提供了方便的作法。
|
||||
|
||||
If you are concerned about **physical attacks** you should use an operating system with a secure verified boot implementation, such as Android, iOS, macOS, or [Windows (with TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process). You should also make sure that your drive is encrypted, and that the operating system uses a TPM or Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) or [Element](https://developers.google.com/android/security/android-ready-se) to rate limit attempts to enter the encryption passphrase. You should avoid sharing your computer with people you don't trust, because most desktop operating systems don't encrypt data separately per-user.
|
||||
若您特別擔心 **物理攻擊**，就應選用具安全驗證開機的作業系統，例如 Android, iOS, macOS, 或[Windows (帶 TPM)](https://docs.microsoft.com/en-us/windows/security/information-protection/secure-the-windows-10-boot-process)。 應確保您的驅動器是加密的，並且操作系統使用 TPM或 Secure [Enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1) 或 [Element](https://developers.google.com/android/security/android-ready-se) 來限制輸入加密密碼的嘗試率。 您應該避免與不信任的人共享您的電腦，因為大多數桌面作業系統不會單獨加密每個用戶的數據。
|
||||
|
||||
## Privacy From Service Providers
|
||||
## 服務供應商的隱私權
|
||||
|
||||
<span class="pg-teal">:material-server-network: Service Providers</span>
|
||||
<span class="pg-teal">:material-server-network: 服務提供商</span>
|
||||
|
||||
We live in a world where almost everything is connected to the internet. Our "private" messages, emails, and social interactions are typically stored on a server, somewhere. Generally, when you send someone a message it's stored on a server, and when your friend wants to read the message the server will show it to them.
|
||||
我們活在一個幾乎所有東西都連上網際網路的世界。 我們的「私人」訊息、電子郵件和社交互動通常儲存在伺服器的某個地方。 通常，當您向某人發送訊息時，它會儲存在伺服器上，當對方想要閱讀訊息時，伺服器會將其顯示給他們。
|
||||
|
||||
The obvious problem with this is that the service provider (or a hacker who has compromised the server) can access your conversations whenever and however they want, without you ever knowing. This applies to many common services, like SMS messaging, Telegram, and Discord.
|
||||
顯而易見的問題是，服務提供商（或破壞伺服器的黑客）可以隨時隨地訪問您的對話，而您永遠不會知道。 這適用在許多常見服務，如 SMS 簡訊、Teleram 和 Discord。
|
||||
|
||||
Thankfully, E2EE can alleviate this issue by encrypting communications between you and your desired recipients before they are even sent to the server. The confidentiality of your messages is guaranteed, assuming the service provider doesn't have access to the private keys of either party.
|
||||
慶幸的是， E2EE 可以加密您與收件人之間的通信，甚至在訊息送到伺服器之前，緩解此問題。 假設服務提供商無法訪問任何一方的私鑰，您的訊息保密性得到保證。
|
||||
|
||||
!!! note "Note on Web-based Encryption"
|
||||
!!! 備註 "Web 加密備註"
|
||||
|
||||
In practice, the effectiveness of different E2EE implementations varies. Applications, such as [Signal](../real-time-communication.md#signal), run natively on your device, and every copy of the application is the same across different installations. If the service provider were to introduce a [backdoor](https://en.wikipedia.org/wiki/Backdoor_(computing)) in their application—in an attempt to steal your private keys—it could later be detected with [reverse engineering](https://en.wikipedia.org/wiki/Reverse_engineering).
|
||||
實際上，不同 E2EE 操作的效力各不相同。 應用程式，例如 [Signal](../real-time-communication.md#signal) ，會在您的裝置上原生執行，且此應用程式在不同設備的安裝上都是如此。 如果服務提供商在他們的應用程序中引入 [後門](https://zh.wikipedia.org/wiki/Backdoor_(computing) ----試圖竊取您的私鑰----它稍後可以通過[逆向工程] (https://zh.wikipedia.org/wiki/Reverse_engineering )檢測。
|
||||
|
||||
On the other hand, web-based E2EE implementations, such as Proton Mail's webmail or Bitwarden's *Web Vault*, rely on the server dynamically serving JavaScript code to the browser to handle cryptography. A malicious server can target you and send you malicious JavaScript code to steal your encryption key (and it would be extremely hard to notice). Because the server can choose to serve different web clients to different people—even if you noticed the attack—it would be incredibly hard to prove the provider's guilt.
|
||||
另一方面，執行網頁 E2EE，例如 Proton Mail 的網頁郵件或Bitwarden 的* Web Vault * ，依靠伺服器動態地向瀏覽器提供JavaScript 代碼來處理加密。 惡意伺服器可以針對您發送惡意 JavaScript 代碼以竊取您的加密密鑰（這將非常難以察覺）。 因為伺服器可以選擇為不同的人提供不同的網頁用戶端，即使您注意到攻擊也很難證明提供商有罪。
|
||||
|
||||
Therefore, you should use native applications over web clients whenever possible.
|
||||
因此，您應該盡可能使用原生軟體程式多於網頁客戶端。
|
||||
|
||||
Even with E2EE, service providers can still profile you based on **metadata**, which typically isn't protected. While the service provider can't read your messages, they can still observe important things, such as who you're talking to, how often you message them, and when you're typically active. Protection of metadata is fairly uncommon, and—if it's within your [threat model](threat-modeling.md)—you should pay close attention to the technical documentation of the software you're using to see if there's any metadata minimization or protection at all.
|
||||
即便使用 E2EE ，服務商仍然可以對 **元數據**進行分析，這通常不受保護。 雖然服務提供商無法讀取您的訊息，但他們仍然可以觀察重要的事情，例如您正在與誰交談、傳送訊息的頻率以及使用活躍時段。 元數據的保護不多，如果它在您的 [威脅模型](threat-modeling.md)中，就應該密切注意使用軟體的技術文檔，看看元數據是否最小化或任何保護。
|
||||
|
||||
## Mass Surveillance Programs
|
||||
## 大規模監督計劃
|
||||
|
||||
<span class="pg-blue">:material-eye-outline: Mass Surveillance</span>
|
||||
<span class="pg-blue">:material-eye-outline: 大規模監測</span>
|
||||
|
||||
Mass surveillance is the intricate effort to monitor the "behavior, many activities, or information" of an entire (or substantial fraction of a) population.[^1] It often refers to government programs, such as the ones [disclosed by Edward Snowden in 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)). However, it can also be carried out by corporations, either on behalf of government agencies or by their own initiative.
|
||||
大規模監控是對全體 (或其中某一群特定)人群進行錯綜複雜的監視活動。[^1] 它通常是指政府項目，例如由[Edward Snowden 在 2013](https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present))所揭露的內幕。 然而，它也可以由公司代表政府機構或由他們自己主動進行。
|
||||
|
||||
!!! abstract "Atlas of Surveillance"
|
||||
!!! 摘要"監控地圖集"
|
||||
|
||||
If you want to learn more about surveillance methods and how they're implemented in your city you can also take a look at the [Atlas of Surveillance](https://atlasofsurveillance.org/) by the [Electronic Frontier Foundation](https://www.eff.org/).
|
||||
如果您想進一步了解監控方法及其在您所在城市的實施方式，您也可以查看[電子前鋒基金會 EFF] (https://www.eff.org/)的[監控地圖集] (https://atlasofsurveillance.org/)。
|
||||
|
||||
In France you can take a look at the [Technolopolice website](https://technopolice.fr/villes/) maintained by the non-profit association La Quadrature du Net.
|
||||
在法國，您可以看看非營利組織 La Quadrature du Net 維護的 [Technolopolice 網站] (https://technopolice.fr/villes/ )。
|
||||
|
||||
Governments often justify mass surveillance programs as necessary means to combat terrorism and prevent crime. However, breaching human rights, it's most often used to disproportionately target minority groups and political dissidents, among others.
|
||||
政府常認為大規模監控計劃是打擊恐怖主義和預防犯罪的必要手段。 然而，少數羣體和政治異見人士最常遭受不成比例地人權侵害。
|
||||
|
||||
!!! quote "ACLU: [*The Privacy Lesson of 9/11: Mass Surveillance is Not the Way Forward*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)"
|
||||
!!! 美國自由民權聯盟 ACLU： [*9/11 的隱私教訓：大規模監控不是前進的道路*](https://www.aclu.org/news/national-security/the-privacy-lesson-of-9-11-mass-surveillance-is-not-the-way-forward)
|
||||
|
||||
In the face of [Edward Snowden's disclosures of government programs such as [PRISM](https://en.wikipedia.org/wiki/PRISM) and [Upstream](https://en.wikipedia.org/wiki/Upstream_collection)], intelligence officials also admitted that the NSA had for years been secretly collecting records about virtually every American’s phone calls — who’s calling whom, when those calls are made, and how long they last. This kind of information, when amassed by the NSA day after day, can reveal incredibly sensitive details about people’s lives and associations, such as whether they have called a pastor, an abortion provider, an addiction counselor, or a suicide hotline.
|
||||
面對[愛德華·斯諾登（ Edward Snowden ）披露的 [PRISM]（ https://en.wikipedia.org/wiki/PRISM ）和 [Upstream]（ https://en.wikipedia.org/wiki/Upstream_collection ）]等政府計劃，情報官員承認，國家安全局多年來一直祕密地收集每個美國人電話的記錄—誰在打電話，何時打電話，以及通話時間多久。 當 NSA 日復一日地收集這類資訊時，就可以揭示人們生活相關聯的敏感細節，例如他們是否打電話給牧師、墮胎提供者、成癮顧問或自殺熱線。
|
||||
|
||||
Despite growing mass surveillance in the United States, the government has found that mass surveillance programs like Section 215 have had "little unique value" with respect to stopping actual crimes or terrorist plots, with efforts largely duplicating the FBI's own targeted surveillance programs.[^2]
|
||||
儘管在美國有越來越多的大規模監控，政府卻發現像依 215 條採取的監控計畫在阻卻犯案與恐怖陰謀上沒有實用價值，它們幾乎只是重複著 FBI 所做的特定監控計畫而已。[^2]
|
||||
|
||||
Online, you can be tracked via a variety of methods:
|
||||
在網上，您可以通過各種方法進行追蹤：
|
||||
|
||||
- Your IP address
|
||||
- Browser cookies
|
||||
- The data you submit to websites
|
||||
- Your browser or device fingerprint
|
||||
- Payment method correlation
|
||||
- 您的 IP 地址
|
||||
- 瀏覽器 cookie
|
||||
- 您提交到網站的資料
|
||||
- 您的瀏覽器或裝置指紋
|
||||
- 付款方式關聯
|
||||
|
||||
\[This list isn't exhaustive].
|
||||
\ [此列表並非詳盡無缺]。
|
||||
|
||||
If you're concerned about mass surveillance programs, you can use strategues like compartmentalizing your online identities, blending in with other users, or, whenever possible, simply avoiding giving out identifying information.
|
||||
如果您擔心大規模監控計劃，您可以隨時隨地策略性避免提供識別個資，例如劃分您的網路身份，與其他用戶混合。
|
||||
|
||||
<span class="pg-brown">:material-account-cash: Surveillance Capitalism</span>
|
||||
<span class="pg-brown">:material-account-cash: 監控資本主義</span>
|
||||
|
||||
> Surveillance capitalism is an economic system centered around the capture and commodification of personal data for the core purpose of profit-making.[^3]
|
||||
> 監控資本主義的核心是獲取個人資料並將之商品化，以謀求最大利潤的經濟體系。[^3]
|
||||
|
||||
For many people, tracking and surveillance by private corporations is a growing concern. Pervasive ad networks, such as those operated by Google and Facebook, span the internet far beyond just the sites they control, tracking your actions along the way. Using tools like content blockers to limit network requests to their servers, and reading the privacy policies of the services you use can help you avoid many basic adversaries (although it can't completely prevent tracking).[^4]
|
||||
對於許多人來說，私人公司的追蹤和監視是一個越來越令人擔憂的問題。 無處不在的廣告網絡，例如 Google 和 Facebook 運營的廣告網絡，跨越網際網路遠超過他們控制的網站，在跟蹤您的行為。 使用內容攔截工具來限制對伺服器的請求、閱讀了解所用服務的隱私政策，都有助於避開許多基本對手 (雖然這不能完全防止跟蹤)。[^4]
|
||||
|
||||
Additionally, even companies outside of the *AdTech* or tracking industry can share your information with [data brokers](https://en.wikipedia.org/wiki/Information_broker) (such as Cambridge Analytica, Experian, or Datalogix) or other parties. You can't automatically assume your data is safe just because the service you're using doesn't fall within the typical AdTech or tracking business model. The strongest protection against corporate data collection is to encrypt or obfuscate your data whenever possible, making it difficult for different providers to correlate data with each other and build a profile on you.
|
||||
此外，即使是 *AdTech* 或追蹤行業以外的公司，也可以與 [資料掮客](https://en.wikipedia.org/wiki/Information_broker) （如Cambridge Analytica、Experian 或 Datalogix ）或其他方共享您的資料。 您無法自行假設您的資料是安全的，因為您使用的服務不屬於典型的 AdTech 或跟蹤商業模式。 對抗企業資料收集最好的保護是盡可能加密或混淆您的數據，讓不同的供應商難以將資料相互關聯去建立您的個人剖繪。
|
||||
|
||||
## Limiting Public Information
|
||||
## 限制公共資訊
|
||||
|
||||
<span class="pg-green">:material-account-search: Public Exposure</span>
|
||||
<span class="pg-green">:material-account-search: 公共曝露</span>
|
||||
|
||||
The best way to keep your data private is simply not making it public in the first place. Deleting unwanted information you find about yourself online is one of the best first steps you can take to regain your privacy.
|
||||
保持資料私密性的最佳方法是根本不要公開它。 刪除網路上有關您現已不用的資訊是恢復隱私的最佳第一步。
|
||||
|
||||
- [View our guide on account deletion :material-arrow-right-drop-circle:](account-deletion.md)
|
||||
- [查看帳戶刪除指南 :material-arrow-right-drop-circle:](account-deletion.md)
|
||||
|
||||
On sites where you do share information, checking the privacy settings of your account to limit how widely that data is spread is very important. For example, enable "private mode" on your accounts if given the option: This ensures that your account isn't being indexed by search engines, and that it can't be viewed without your permission.
|
||||
對於您分享資訊的網站，檢查帳戶的隱私設定以限制資料傳播的範圍非常重要。 例如，如果提供選項，請在您的帳戶上啟用「私人模式」：這可確保您的帳戶不會被搜尋引擎編入索引，而且在未經您的許可下無法查看。
|
||||
|
||||
If you've already submitted your real information to sites which shouldn't have it, consider using disinformation tactics, like submitting fictitious information related to that online identity. This makes your real information indistinguishable from the false information.
|
||||
如果您已經將真實資訊提交給不應該擁有該資訊的網站，請考慮使用虛假策略，例如提交該網路身份的虛構資訊。 這使得您的真實資訊無法與虛假資訊作區分。
|
||||
|
||||
## Avoiding Censorship
|
||||
## 避免審查
|
||||
|
||||
<span class="pg-blue-gray">:material-close-outline: Censorship</span>
|
||||
<span class="pg-blue-gray">:material-close-outline: 審查</span>
|
||||
|
||||
Censorship online can be carried out (to varying degrees) by actors including totalitarian governments, network administrators, and service providers. These efforts to control communication and restrict access to information will always be incompatible with the human right to Freedom of Expression.[^5]
|
||||
網口審查包括由極權主義政府、網路管理員和服務提供商等所進行的行為（在不同程度上）。 這些試圖控制通訊與限縮資料取用的作為，往往不見容於意見自由的基本人權。[^5]
|
||||
|
||||
Censorship on corporate platforms is increasingly common, as platforms like Twitter and Facebook give in to public demand, market pressures, and pressures from government agencies. Government pressures can be covert requests to businesses, such as the White House [requesting the takedown](https://www.nytimes.com/2012/09/17/technology/on-the-web-a-fine-line-on-free-speech-across-globe.html) of a provocative YouTube video, or overt, such as the Chinese government requiring companies to adhere to a strict regime of censorship.
|
||||
對企業平臺的審查越來越普遍，如Twitter 和 Facebook 等平臺屈服於公眾需求、市場和政府機構的壓力。 政府對企業的施壓可能是隱蔽的，例如白宮私下 [要求拿掉](https://www.nytimes.com/2012/09/17/technology/on-the-web-a-fine-line-on-free-speech-across-globe.html) 某個勯動的 Youtube 影片，或是公開者如中國政府命令企業要遵循嚴厲的審查制度。
|
||||
|
||||
People concerned with the threat of censorship can use technologies like [Tor](../advanced/tor-overview.md) to circumvent it, and support censorship-resistant communication platforms like [Matrix](../real-time-communication.md#element), which doesn't have a centralized account authority that can close accounts arbitrarily.
|
||||
關注審查威脅的人可以使用像 [Tor](../advanced/tor-overview.md) 這樣的技術來規避它，並支持像 [Matrix](../real-time-communication.md#element)這樣的抗審查通信平臺，該平臺沒有可以任意關閉帳戶的集中帳戶權限。
|
||||
|
||||
!!! tip
|
||||
!!! 提示
|
||||
|
||||
While evading censorship itself can be easy, hiding the fact that you are doing it can be very problematic.
|
||||
雖然很容易避掉審查，但隱藏您正在做的事可就沒那麼簡單了。
|
||||
|
||||
You should consider which aspects of the network your adversary can observe, and whether you have plausible deniability for your actions. For example, using [encrypted DNS](../advanced/dns-overview.md#what-is-encrypted-dns) can help you bypass rudimentary, DNS-based censorship systems, but it can't truly hide what you are visiting from your ISP. A VPN or Tor can help hide what you are visiting from network administrators, but can't hide that you're using those networks in the first place. Pluggable transports (such as Obfs4proxy, Meek, or Shadowsocks) can help you evade firewalls that block common VPN protocols or Tor, but your circumvention attempts can still be detected by methods like probing or [deep packet inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection).
|
||||
您應該考慮可讓對手觀察哪些網路行為，以及能否對這些行為有合理的否認說辭。 例如，使用[加密 DNS ] (../advanced/dns-overview.md#what-is-encrypted-dns)可以幫助您繞過對 DNS 基本審查系統，但它無法對 ISP 隱藏您正在訪問的內容。 VPN 或 Tor 有助於向網路管理員隱藏您正在訪問的內容，但無法隱藏您正在使用 VPN 或 Tor 。 可插拔傳輸（例如 Obfs4proxy、Meek 或 Shadowsocks ）可以幫助您避開阻擋常見VPN 協議或 Tor 的防火牆，但仍然可以通過探測或[深度封包檢查] (https://en.wikipedia.org/wiki/Deep_packet_inspection)等方法檢測您嘗圖作的規避。
|
||||
|
||||
You must always consider the risks of trying to bypass censorship, the potential consequences, and how sophisticated your adversary may be. You should be cautious with your software selection, and have a backup plan in case you are caught.
|
||||
您必須考慮試圖繞過網路審查的風險、潛在的後果以及您的對手可能很經驗老道。 您應該謹慎選擇軟件，並制定備份計劃以防被抓住。
|
||||
|
||||
[^1]: Wikipedia: [*Mass Surveillance*](https://en.wikipedia.org/wiki/Mass_surveillance) and [*Surveillance*](https://en.wikipedia.org/wiki/Surveillance).
|
||||
[^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf)
|
||||
[^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism)
|
||||
[^4]: "[Enumerating badness](https://www.ranum.com/security/computer_security/editorials/dumb/)" (or, "listing all the bad things that we know about"), as many adblockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques.
|
||||
[^5]: United Nations: [*Universal Declaration of Human Rights*](https://www.un.org/en/about-us/universal-declaration-of-human-rights).
|
||||
[^1]: 維基百科: [*大型監控*](https://en.wikipedia.org/wiki/Mass_surveillance) 與 [*監控*](https://en.wikipedia.org/wiki/Surveillance).
|
||||
[^2]: 美國隱私和公民自由監督委員會： [*根據第 215 條進行的電話記錄計劃的報告*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf)
|
||||
[^3]: 維基百科: [*監控資本主義*](https://en.wikipedia.org/wiki/Surveillance_capitalism)
|
||||
[^4]: “[枚舉壞處](https://www.ranum.com/security/computer_security/editorials/dumb/)” （或“列出所知的全部壞事” ），未能充分保護您免受新的和未知的威脅，因為許多廣告攔截程式和防病毒程式尚未被添加到過濾器列表。 您還應採用其他緩解技術。
|
||||
[^5]: 聯合國： [*《世界人權宣言》*](https://www.un.org/en/about-us/universal-declaration-of-human-rights).
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
title: 電子郵件安全
|
||||
icon: material/email
|
||||
description: Email is inherently insecure in many ways, and these are some of the reasons it isn't our top choice for secure communications.
|
||||
description: 從許多方面來看電子郵件本質上是不安全的，這也是它並非安全通信首選的原因。
|
||||
---
|
||||
|
||||
電子郵件本身即非安全的通訊形式。 您可以使用 OpenPGP 等工具提高電子郵件安全性，這些工具為您的消息添加端到端加密，但與其他消息傳遞應用程序中的加密相比， OpenPGP 仍然存在許多缺點，而且由於電子郵件的設計方式，某些電子郵件數據永遠不會加密。
|
||||
@@ -18,15 +18,15 @@ description: Email is inherently insecure in many ways, and these are some of th
|
||||
|
||||
### 哪些郵件客戶端支持 E2EE？
|
||||
|
||||
Email providers which allow you to use standard access protocols like IMAP and SMTP can be used with any of the [email clients we recommend](../email-clients.md). 根據驗證方法的不同，如果提供者或電子郵件用戶端不支持OAT或橋接應用程序，這可能會導致安全性降低，因為 [多因素驗證](multi-factor-authentication.md) 在純密碼驗證中是不可能的。
|
||||
電子郵件服務供應商讓您能使用標準訪問協議如 IMAP 與SMTP，以便應用[我們推薦的電子郵件客戶端軟體](../email-clients.md)。 根據驗證方法的不同，如果提供者或電子郵件用戶端不支持OAT或橋接應用程序，這可能會導致安全性降低，因為 [多因素驗證](multi-factor-authentication.md) 在純密碼驗證中是不可能的。
|
||||
|
||||
### 我要怎樣保護自己的私密鑰匙？
|
||||
|
||||
A smartcard (such as a [Yubikey](https://support.yubico.com/hc/en-us/articles/360013790259-Using-Your-YubiKey-with-OpenPGP) or [Nitrokey](https://www.nitrokey.com)) works by receiving an encrypted email message from a device (phone, tablet, computer, etc) running an email/webmail client. The message is then decrypted by the smartcard and the decrypted content is sent back to the device.
|
||||
安全鑰卡 (例如 [Yubikey](https://support.yubico.com/hc/en-us/articles/360013790259-Using-Your-YubiKey-with-OpenPGP) 或 [Nitrokey](https://www.nitrokey.com)) 可在設備 (手機、平板或桌機等 ) 的電子郵件軟體或網頁電郵上收取加密的郵件訊息。 安全鑰卡會解密該訊息再把解開的內容傳到設備。
|
||||
|
||||
在智能卡上進行解密是有利的，以避免可能將您的私鑰暴露在受損的設備上。
|
||||
|
||||
## Email Metadata Overview
|
||||
## 電子郵件元資料概覽
|
||||
|
||||
電子郵件中繼資料儲存在電子郵件的 [個訊息標題](https://en. wikipedia. org/wiki/Email#Message_header) 中，並包含您可能已經看到的一些可見標題，例如： `To`、 `From`、 `Cc`、 `Date`、 `Subject`。 許多電子郵件客戶端和提供商還包含一些隱藏的標題，可以揭示有關您的帳戶的信息。
|
||||
|
||||
@@ -36,6 +36,6 @@ A smartcard (such as a [Yubikey](https://support.yubico.com/hc/en-us/articles/36
|
||||
|
||||
電子郵件元數據受到外部觀察者的保護， [Opportunistic TLS](https://en.wikipedia.org/wiki/Opportunistic_TLS) 保護它免受外部觀察者的影響，但它仍然能夠被您的電子郵件客戶端軟件（或網絡郵件）和任何伺服器看到，將您的消息轉發給任何收件人，包括您的電子郵件提供商。 有時，電子郵件伺服器也會使用第三方服務來防範垃圾郵件，垃圾郵件通常也可以訪問您的郵件。
|
||||
|
||||
### Why Can't Metadata be E2EE?
|
||||
### 爲什麼元數據不能是E2EE ？
|
||||
|
||||
電子郵件元數據對於電子郵件最基本的功能（它來自何處，以及它必須去向何處）至關重要。 E2EE 最初並未內建於電子郵件協議中，而是需要像 OpenPGP 這樣的附加軟件。 由於 OpenPGP 訊息仍必須與傳統的電子郵件供應商合作，因此它無法加密電子郵件元數據，只能加密訊息正文本身。 這意味著即使在使用 OpenPGP 時，外部觀察者也可以看到關於您的消息的大量信息，例如您正在發送電子郵件的人，主題行，當您發送電子郵件時等。
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
title: "多重身分驗證"
|
||||
icon: 'material/two-factor-authentication'
|
||||
description: MFA is a critical security mechanism for securing your online accounts, but some methods are stronger than others.
|
||||
description: MFA是保護您線上帳戶的關鍵安全機制，但有些方法比其他方法更強大。
|
||||
---
|
||||
|
||||
**多因素認證**（**MFA**）是一種安全機制，除了輸入用戶名（或電子郵件）和密碼之外，還需要其他步驟。 最常見的方法是您會從簡訊或應用程式收到的有時間限制的代碼。
|
||||
@@ -14,15 +14,15 @@ description: MFA is a critical security mechanism for securing your online accou
|
||||
|
||||
### 簡訊或 Email 多重身分驗證
|
||||
|
||||
透過簡訊或電子郵件接收 OTP 代碼是透過 MFA 保護帳戶安全的最弱方法之一。 Obtaining a code by email or SMS takes away from the "something you *have*" idea, because there are a variety of ways a hacker could [take over your phone number](https://en.wikipedia.org/wiki/SIM_swap_scam) or gain access to your email without having physical access to any of your devices at all. 如果未經授權的人獲得了您的電子郵件訪問權限，他們將能夠使用該訪問權限重設您的密碼並收到驗證碼，使他們能夠完全訪問您的帳戶。
|
||||
透過簡訊或電子郵件接收 OTP 代碼是透過 MFA 保護帳戶安全的最弱方法之一。 通過電子郵件或簡訊接收驗證碼動搖了*"持有安心*”的概念，因為駭客根本不需要實際拿到您的設備，就可透過多種方式 [接管電話號碼](https://en.wikipedia.org/wiki/SIM_swap_scam) 或讀取電子郵件。 如果未經授權的人獲得了您的電子郵件訪問權限，他們將能夠使用該訪問權限重設您的密碼並收到驗證碼，使他們能夠完全訪問您的帳戶。
|
||||
|
||||
### 推送通知
|
||||
|
||||
推送通知多重身份認證的形式是將訊息發送到手機上的應用程式，要求您確認新的帳戶登入。 這種方法比短信或電子郵件要好得多，因為攻擊者通常無法在沒有已經登錄的設備的情況下獲得這些推送通知，這意味著他們需要首先破壞您的其他設備之一。
|
||||
|
||||
We all make mistakes, and there is the risk that you might accept the login attempt by accident. 推送通知登入授權通常一次發送到 *所有* 您的設備，如果您有多個設備，則可擴大 MFA 代碼的可用性。
|
||||
我們都會犯錯誤，您可能不小心接受登錄嘗試。 推送通知登入授權通常一次發送到 *所有* 您的設備，如果您有多個設備，則可擴大 MFA 代碼的可用性。
|
||||
|
||||
推送通知 MFA 的安全性取決於應用程序的品質，伺服器組件以及生成它的開發人員的信任。 Installing an app may also require you to accept invasive privileges that grant access to other data on your device. An individual app also requires that you have a specific app for each service which may not require a password to open, unlike a good TOTP generator app.
|
||||
推送通知 MFA 的安全性取決於應用程序的品質，伺服器組件以及生成它的開發人員的信任。 安裝應用程式可能會要求授予對裝置上其他資料存取的侵入性權限。 不同於好的TOTP 生成器，個別應用程式還要求特定的應用程序，甚至不需要密碼就可開啟服務。
|
||||
|
||||
### 暫時性的一次性密碼 (TOTP)
|
||||
|
||||
@@ -30,9 +30,9 @@ TOTP 是最常見的 MFA 形式之一。 當您設置TOTP時，您通常需要
|
||||
|
||||
然後，時間限制代碼從共享機密和當前時間衍生出來。 由於代碼僅在短時間內有效，無法訪問共享機密，因此對手無法生成新代碼。
|
||||
|
||||
If you have a hardware security key with TOTP support (such as a YubiKey with [Yubico Authenticator](https://www.yubico.com/products/yubico-authenticator/)), we recommend that you store your "shared secrets" on the hardware. Hardware such as the YubiKey was developed with the intention of making the "shared secret" difficult to extract and copy. A YubiKey is also not connected to the Internet, unlike a phone with a TOTP app.
|
||||
如果您擁有支援 TOTP 的硬體安全金鑰（例如具有 [Yubico Authenticator](https://www.yubico.com/products/yubico-authenticator/)的YubiKey ） ，我們建議您將「共享機密」儲存在硬體上。 像 YubiKey 這類硬體就是為了讓“共享祕密”難以提取、複製而開發的工具。 YubiKey 也不會連接到網際網路，不像使用 TOTP 應用程式的手機。
|
||||
|
||||
Unlike [WebAuthn](#fido-fast-identity-online), TOTP offers no protection against [phishing](https://en.wikipedia.org/wiki/Phishing) or reuse attacks. If an adversary obtains a valid code from you, they may use it as many times as they like until it expires (generally 60 seconds).
|
||||
與 [WebAuthn](#fido-fast-identity-online)不同， TOTP 無法應對 [網絡釣魚](https://en.wikipedia.org/wiki/Phishing) 或重複使用攻擊。 如果對手從您身上取得有效的登錄碼，他們可以隨意多次使用它，直到過期（通常是60秒）。
|
||||
|
||||
對手可以建立一個網站來模仿官方服務，試圖欺騙你提供你的用戶名，密碼和當前的 TOTP 代碼。 如果對手使用這些記錄的憑證，他們可能能夠登錄到真正的服務並劫持帳戶。
|
||||
|
||||
@@ -40,55 +40,55 @@ Unlike [WebAuthn](#fido-fast-identity-online), TOTP offers no protection against
|
||||
|
||||
### 硬體安全金鑰
|
||||
|
||||
The YubiKey stores data on a tamper-resistant solid-state chip which is [impossible to access](https://security.stackexchange.com/a/245772) non-destructively without an expensive process and a forensics laboratory.
|
||||
YubiKey 將資料存在防纂改的強固晶片， 除非運用先進實驗室等級的取證程序，一般非破壞方式[很難存取](https://security.stackexchange.com/a/245772) 。
|
||||
|
||||
These keys are generally multi-function and provide a number of methods to authenticate. Below are the most common ones.
|
||||
這些金鑰通常具多重功能，並提供了許多驗證方法。 下面是最常見的。
|
||||
|
||||
#### Yubico OTP
|
||||
|
||||
Yubico OTP is an authentication protocol typically implemented in hardware security keys. When you decide to use Yubico OTP, the key will generate a public ID, private ID, and a Secret Key which is then uploaded to the Yubico OTP server.
|
||||
Yubico OTP 的驗證協議通常是執行在硬體安全金鑰上。 當決定使用 Yubico OTP 時，該密鑰將產生公用 ID ，私有 ID 和祕密密鑰，然後密鑰日上傳到 Yubico OTP 伺服器。
|
||||
|
||||
When logging into a website, all you need to do is to physically touch the security key. The security key will emulate a keyboard and print out a one-time password into the password field.
|
||||
在登入網站時，需要做的就是實際觸摸安全金鑰。 安全金鑰將模擬鍵盤並將一次性密碼列印到密碼欄位中。
|
||||
|
||||
The service will then forward the one-time password to the Yubico OTP server for validation. A counter is incremented both on the key and Yubico's validation server. The OTP can only be used once, and when a successful authentication occurs, the counter is increased which prevents reuse of the OTP. Yubico provides a [detailed document](https://developers.yubico.com/OTP/OTPs_Explained.html) about the process.
|
||||
它會將一次性密碼轉發到 Yubico OTP 伺服器進行驗證。 在密鑰和 Yubico 驗證伺服器上的計數器都會迭加。 OTP 只能使用一次，當成功驗證後，計數器會增加，以防止重複使用 OTP。 Yubico 提供了此過程的 [詳細文件](https://developers.yubico.com/OTP/OTPs_Explained.html) 。
|
||||
|
||||
<figure markdown>
|
||||
|
||||
</figure>
|
||||
|
||||
There are some benefits and disadvantages to using Yubico OTP when compared to TOTP.
|
||||
與 TOTP 相比，使用Yubico OTP 有一些優缺點。
|
||||
|
||||
The Yubico validation server is a cloud based service, and you're placing trust in Yubico that they are storing data securely and not profiling you. The public ID associated with Yubico OTP is reused on every website and could be another avenue for third-parties to profile you. Like TOTP, Yubico OTP does not provide phishing resistance.
|
||||
Yubico 驗證伺服器是雲端服務，您把信任託付給 Yubico 相信他們會安全地儲存資料而不會拿來分析您。 與 Yubico OTP 相關聯的公共 ID 可在每個網站上重複使用，並可能讓第三方可對您進行個人剖繪。 與TOTP 一樣， Yubico OTP 無法對抗網路釣魚。
|
||||
|
||||
If your threat model requires you to have different identities on different websites, **do not** use Yubico OTP with the same hardware security key across those websites as public ID is unique to each security key.
|
||||
若您的威脅模型要求在不同網站使用不同身份， **請不要** 在這些網站中使用同一個硬體安全密鑰 Yubico OTP ，因為每個安全密鑰都有相同的公共 ID。
|
||||
|
||||
#### FIDO (Fast IDentity Online)
|
||||
#### FIDO （ 快速線上身份驗證）
|
||||
|
||||
[FIDO](https://en.wikipedia.org/wiki/FIDO_Alliance) includes a number of standards, first there was U2F and then later [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) which includes the web standard [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn).
|
||||
[FIDO ](https://en.wikipedia.org/wiki/FIDO_Alliance) 包含許多標準，首先是U2F ，然後是 [FIDO2](https://en.wikipedia.org/wiki/FIDO2_Project) ，其中包括 Web 標準 [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn)。
|
||||
|
||||
U2F and FIDO2 refer to the [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol), which is the protocol between the security key and the computer, such as a laptop or phone. It complements WebAuthn which is the component used to authenticate with the website (the "Relying Party") you're trying to log in on.
|
||||
U2F 和 FIDO2 指的是 [Client to Authenticator Protocol](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol)，這是安全金鑰和電腦之間的協議，例如筆記本電腦或手機。 它補充了 WebAuthn ， WebAuthn 為驗證網站登錄（ “依賴方” ）之組件。
|
||||
|
||||
WebAuthn is the most secure and private form of second factor authentication. While the authentication experience is similar to Yubico OTP, the key does not print out a one-time password and validate with a third-party server. Instead, it uses [public key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography) for authentication.
|
||||
WebAuthn是最安全、最私密的第二要素驗證形式。 雖然驗證體驗與 Yubico OTP 類似，但密鑰不會打印出一次性密碼也不會使用第三方伺服器進行驗證。 相反，它使用 [公鑰加密](https://en.wikipedia.org/wiki/Public-key_cryptography) 進行驗證。
|
||||
|
||||
<figure markdown>
|
||||
|
||||
</figure>
|
||||
|
||||
When you create an account, the public key is sent to the service, then when you log in, the service will require you to "sign" some data with your private key. The benefit of this is that no password data is ever stored by the service, so there is nothing for an adversary to steal.
|
||||
當您創建一個帳戶時，公鑰會發送到服務，然後當您登錄時，服務會要求您使用您的私鑰“簽署”一些數據。 這樣做的好處是，服務不會儲存密碼資料，因此對手無從竊取任何東西。
|
||||
|
||||
This presentation discusses the history of password authentication, the pitfalls (such as password reuse), and discussion of FIDO2 and [WebAuthn](https://webauthn.guide) standards.
|
||||
這份簡報探討了密碼驗證的歷史，陷阱（如密碼重用）以及FIDO2 和 [WebAuthn](https://webauthn.guide) 標準等課題。
|
||||
|
||||
<div class="yt-embed">
|
||||
<iframe width="560" height="315" src="https://invidious.privacyguides.net/embed/aMo4ZlWznao?local=true" title="How FIDO2 and WebAuthn Stop Account Takeovers" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
|
||||
<iframe width="560" height="315" src="https://invidious.privacyguides.net/embed/aMo4ZlWznao?local=true" title="FIDO2 和 WebAuthn 如何防止帳戶接管" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
|
||||
</div>
|
||||
|
||||
FIDO2 and WebAuthn have superior security and privacy properties when compared to any MFA methods.
|
||||
相較於其它 MFA方法， FIDO2 和 WebAuthn 具有卓越的安全和隱私特點。
|
||||
|
||||
Typically for web services it is used with WebAuthn which is a part of the [W3C recommendations](https://en.wikipedia.org/wiki/World_Wide_Web_Consortium#W3C_recommendation_(REC)). It uses public key authentication and is more secure than shared secrets used in Yubico OTP and TOTP methods, as it includes the origin name (usually, the domain name) during authentication. Attestation is provided to protect you from phishing attacks, as it helps you to determine that you are using the authentic service and not a fake copy.
|
||||
通Web服務通常與 WebAuthn 一起使用， 這是來自 [W3C 的建議](https://en.wikipedia.org/wiki/World_Wide_Web_Consortium#W3C_recommendation_(REC))。 它使用公鑰驗證，並且比在 Yubico OTP 和 TOTP 使用的共享機密更安全，因為它在驗證期間包括原始名稱（通常是域名）。 提供證明以保護您免受網路釣魚攻擊，以幫助您確定使用真實服務而不是假網站服務。
|
||||
|
||||
Unlike Yubico OTP, WebAuthn does not use any public ID, so the key is **not** identifiable across different websites. It also does not use any third-party cloud server for authentication. All communication is completed between the key and the website you are logging into. FIDO also uses a counter which is incremented upon use in order to prevent session reuse and cloned keys.
|
||||
與 Yubico OTP不同，WebAuthn不使用任何公共ID ，因此密鑰 **無法** 被不同網站識別。 它也不使用任何第三方雲端伺服器進行驗證。 所有通訊都已在密鑰和所登入的網站之間完成。 FIDO 還使用計數器，該計數器在使用時會增加，以防止期間重用和克隆密鑰。
|
||||
|
||||
If a website or service supports WebAuthn for the authentication, it is highly recommended that you use it over any other form of MFA.
|
||||
如果網站或服務支援 WebAuthn 驗證，強烈建議您使用它而不是其他形式的 MFA。
|
||||
|
||||
## 一般性建議
|
||||
|
||||
@@ -96,7 +96,7 @@ If a website or service supports WebAuthn for the authentication, it is highly r
|
||||
|
||||
### 我應該選擇哪種方法？
|
||||
|
||||
When configuring your MFA method, keep in mind that it is only as secure as your weakest authentication method you use. This means it is important that you only use the best MFA method available. For instance, if you are already using TOTP, you should disable email and SMS MFA. If you are already using FIDO2/WebAuthn, you should not be using Yubico OTP or TOTP on your account.
|
||||
設置MFA 方法時，請記住，它的安全程度與您使用的最弱的身份驗證方法一樣。 這意味著您只需使用的最佳MFA方法。 例如，如果您已經使用TOTP ，您應該禁用電子郵件和SMS MFA。 如果您已經使用 FIDO2/WebAuthn ，則不應該在您的帳戶上使用 Yubico OTP 或TOTP。
|
||||
|
||||
### 備份
|
||||
|
||||
@@ -104,31 +104,31 @@ When configuring your MFA method, keep in mind that it is only as secure as your
|
||||
|
||||
當與驗證器應用程式一起使用TOTP時，請務必備份您的恢復密鑰或應用程式本身，或將「共享機密」複製到不同手機上的應用程式的另一個實例或加密容器（例如 [VeraCrypt](../encryption.md#veracrypt)）。
|
||||
|
||||
### Initial Set Up
|
||||
### 初始設定
|
||||
|
||||
When buying a security key, it is important that you change the default credentials, set up password protection for the key, and enable touch confirmation if your key supports it. Products such as the YubiKey have multiple interfaces with separate credentials for each one of them, so you should go over each interface and set up protection as well.
|
||||
購買安全金鑰時，請務必變更預設憑證、為金鑰設定密碼保護，並在金鑰支援時啟用觸控確認。 YubiKey 等產品有多重介面，各有其獨立憑證，因此您應該仔細查看每個介面並設置保護。
|
||||
|
||||
### Email and SMS
|
||||
### 電子郵件和簡訊
|
||||
|
||||
If you have to use email for MFA, make sure that the email account itself is secured with a proper MFA method.
|
||||
如果您必須使用電子郵件進行MFA ，請確保電子郵件帳戶本身具有適當的 MFA 方法。
|
||||
|
||||
If you use SMS MFA, use a carrier who will not switch your phone number to a new SIM card without account access, or use a dedicated VoIP number from a provider with similar security to avoid a [SIM swap attack](https://en.wikipedia.org/wiki/SIM_swap_scam).
|
||||
如果您使用簡訊 MFA ，請選擇不會進行未授權的號碼切換的營營商，或使用具有類似安全性的專用VoIP 號碼，以避免 [SIM 交換攻擊](https://en.wikipedia.org/wiki/SIM_swap_scam)。
|
||||
|
||||
[MFA tools we recommend](../multi-factor-authentication.md ""){.md-button}
|
||||
[我們推薦的 MFA 工具](../multi-factor-authentication.md ""){.md-button}
|
||||
|
||||
## More Places to Set Up MFA
|
||||
## 更多設定MFA的地方
|
||||
|
||||
Beyond just securing your website logins, multi-factor authentication can be used to secure your local logins, SSH keys or even password databases as well.
|
||||
除了保護您的網站登錄外，多因素身份驗證還可用於保護您的本地設備的登錄、 SSH 密鑰甚至密碼資料庫。
|
||||
|
||||
### Windows
|
||||
|
||||
Yubico has a dedicated [Credential Provider](https://docs.microsoft.com/en-us/windows/win32/secauthn/credential-providers-in-windows) that adds Challenge-Response authentication for the username + password login flow for local Windows accounts. If you have a YubiKey with Challenge-Response authentication support, take a look at the [Yubico Login for Windows Configuration Guide](https://support.yubico.com/hc/en-us/articles/360013708460-Yubico-Login-for-Windows-Configuration-Guide), which will allow you to set up MFA on your Windows computer.
|
||||
Yubico 有專門的 [憑證提供者](https://docs.microsoft.com/en-us/windows/win32/secauthn/credential-providers-in-windows) ，為本地 Windows 帳戶在登錄流程添加了Challenge-Response 驗證。 如果您擁有具 Challenge-Response 驗證支援的 YubiKey ，請查看 [Yubico Login for Windows Configuration Guide](https://support.yubico.com/hc/en-us/articles/360013708460-Yubico-Login-for-Windows-Configuration-Guide)，該指南將協助您在 Windows 電腦上設置MFA。
|
||||
|
||||
### macOS
|
||||
|
||||
macOS 具有 [原生支援](https://support.apple.com/guide/deployment/intro-to-smart-card-integration-depd0b888248/web) 用於使用智慧卡(PIV)進行驗證。 If you have a smartcard or a hardware security key that supports the PIV interface such as the YubiKey, we recommend that you follow your smartcard/hardware security vendor's documentation and set up second factor authentication for your macOS computer.
|
||||
macOS 具有 [原生支援](https://support.apple.com/guide/deployment/intro-to-smart-card-integration-depd0b888248/web) 用於使用智慧卡(PIV)進行驗證。 如果您有支援 PIV 介面的智慧卡或硬體安全金鑰(例如 YubiKey) ，建議您遵循智慧卡/硬體安全供應商的文件，為您的macOS 電腦設定第二要素驗證。
|
||||
|
||||
Yubico have a guide [Using Your YubiKey as a Smart Card in macOS](https://support.yubico.com/hc/en-us/articles/360016649059) which can help you set up your YubiKey on macOS.
|
||||
Yubico 指南 [在macOS](https://support.yubico.com/hc/en-us/articles/360016649059) 中使用 YubiKey 作為智慧卡，可幫助您在 macOS 設置 YubiKey。
|
||||
|
||||
設定智慧卡/安全金鑰後，我們建議您在終端機中執行此命令：
|
||||
|
||||
@@ -136,30 +136,30 @@ Yubico have a guide [Using Your YubiKey as a Smart Card in macOS](https://suppor
|
||||
sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLogin -bool YES
|
||||
```
|
||||
|
||||
The command will prevent an adversary from bypassing MFA when the computer boots.
|
||||
該指令會防止對手在電腦啟動時繞過 MFA。
|
||||
|
||||
### Linux
|
||||
|
||||
!!! warning
|
||||
!!! 警告
|
||||
|
||||
If the hostname of your system changes (such as due to DHCP), you would be unable to login. It is vital that you set up a proper hostname for your computer before following this guide.
|
||||
如果系統主機名稱發生變更（例如由於 DHCP ） ，您將無法登入。 在遵循本指南之前，為您的電腦設置正確的主機名至關重要。
|
||||
|
||||
The `pam_u2f` module on Linux can provide two-factor authentication for logging in on most popular Linux distributions. If you have a hardware security key that supports U2F, you can set up MFA authentication for your login. Yubico has a guide [Ubuntu Linux Login Guide - U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) which should work on any distribution. The package manager commands—such as `apt-get`—and package names may however differ. This guide does **not** apply to Qubes OS.
|
||||
Linux 上的 `pam_u2f` 模組可以提供雙因素驗證，以便在最流行的 Linux 發行版上登錄。 如果您有支援 U2F 的硬體安全金鑰，可以為您的登入設定 MFA 驗證。 Yubico有一個 [Ubuntu Linux 登錄指南- U2F](https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F) ，應該適用於任何發行版。 軟體包管理器指令（例如 `apt-get`）和軟體包名稱可能不同。 本指南 **不適用於** Qubes OS.
|
||||
|
||||
### Qubes OS
|
||||
|
||||
Qubes OS has support for Challenge-Response authentication with YubiKeys. If you have a YubiKey with Challenge-Response authentication support, take a look at the Qubes OS [YubiKey documentation](https://www.qubes-os.org/doc/yubikey/) if you want to set up MFA on Qubes OS.
|
||||
Qubes OS 支援 YubiKeys 進行 Challenge-Response 驗證。 如果您擁有具 Challenge-Response 驗證支援的 YubiKey ，請查看 Qubes OS [YubiKey 文檔](https://www.qubes-os.org/doc/yubikey/) ，以在Qubes OS 設置 MFA。
|
||||
|
||||
### SSH
|
||||
|
||||
#### Hardware Security Keys
|
||||
#### 硬件安全金鑰
|
||||
|
||||
SSH MFA could be set up using multiple different authentication methods that are popular with hardware security keys. We recommend that you check out Yubico's [documentation](https://developers.yubico.com/SSH/) on how to set this up.
|
||||
SSH MFA 可以使用多種不同的身份驗證方法進行設置，這些方法在硬體安全金鑰中很受歡迎。 建議您查看 Yubico [文件檔](https://developers.yubico.com/SSH/) ，了解如何設置此功能。
|
||||
|
||||
#### 暫時性的一次性密碼 (TOTP)
|
||||
|
||||
SSH MFA can also be set up using TOTP. DigitalOcean has provided a tutorial [How To Set Up Multi-Factor Authentication for SSH on Ubuntu 20.04](https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-20-04). Most things should be the same regardless of distribution, however the package manager commands—such as `apt-get`—and package names may differ.
|
||||
SSH MFA 也可以使用 TOTP 設定。 DigitalOcean 提供教學 [如何在 Ubuntu 20.04](https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-20-04) 為 SSH 設置多因素身份驗證。 無論是哪一個發行版本，大多數操作方式都相同，但是軟體包管理器命令-例如 `apt-get`-和軟體包名稱可能不同。
|
||||
|
||||
### KeePass (and KeePassXC)
|
||||
### KeePass （和KeePassXC ）
|
||||
|
||||
KeePass and KeePassXC databases can be secured using Challenge-Response or HOTP as a second-factor authentication. Yubico has provided a document for KeePass [Using Your YubiKey with KeePass](https://support.yubico.com/hc/en-us/articles/360013779759-Using-Your-YubiKey-with-KeePass) and there is also one on the [KeePassXC](https://keepassxc.org/docs/#faq-yubikey-2fa) website.
|
||||
KeePass 和 KeePassXC 資料庫可以使用 Challenge-Response 或 HOTP 作為第二要素驗證進行密碼保護。 Yubico 提供了一份 KeePass [Using Your YubiKey with KeePass](https://support.yubico.com/hc/en-us/articles/360013779759-Using-Your-YubiKey-with-KeePass) 文件， [KeePassXC](https://keepassxc.org/docs/#faq-yubikey-2fa) 網站上也有一份。
|
||||
|
||||
@@ -1,111 +1,111 @@
|
||||
---
|
||||
title: "Introduction to Passwords"
|
||||
title: "密碼介紹"
|
||||
icon: 'material/form-textbox-password'
|
||||
description: These are some tips and tricks on how to create the strongest passwords and keep your accounts secure.
|
||||
description: 以下是關於如何建立最強密碼並確保帳戶安全的一些提示和技巧。
|
||||
---
|
||||
|
||||
Passwords are an essential part of our everyday digital lives. We use them to protect our accounts, our devices and our secrets. Despite often being the only thing between us and an adversary who's after our private information, not a lot of thought is put into them, which often leads to people using passwords that can be easily guessed or brute-forced.
|
||||
密碼是我們日常數位生活的重要組成部分。 我們使用它們來保護自己帳戶、設備和祕密。 儘管密碼常常是我們與挖取我們私人資訊的對手之間僅有的唯一阻隔，但人們並未對密碼有充分的考量，導致人們使用的密碼很容易被猜到或強力破解。
|
||||
|
||||
## Best Practices
|
||||
## 最佳實踐
|
||||
|
||||
### Use unique passwords for every service
|
||||
### 每項服務各選用不同的獨特密碼
|
||||
|
||||
Imagine this; you sign up for an account with the same e-mail and password on multiple online services. If one of those service providers is malicious, or their service has a data breach that exposes your password in an unencrypted format, all a bad actor would have to do is try that e-mail and password combination across multiple popular services until they get a hit. It doesn't matter how strong that one password is, because they already have it.
|
||||
想像一下，您在各個不同的網路服務註冊時都使用同一組電子郵件和密碼。 如果其中一個服務提供商懷有惡意，或者其服務發生資料洩露，以未加密格式暴露了您的密碼，那麼不良行為者只需嘗試跨多個流行服務的電子郵件和密碼組合，就可輕易得手。 密碼強度已無關緊要，因為對手已經打開它了。
|
||||
|
||||
This is called [credential stuffing](https://en.wikipedia.org/wiki/Credential_stuffing), and it is one of the most common ways that your accounts can be compromised by bad actors. To avoid this, make sure that you never re-use your passwords.
|
||||
這稱為 [憑證填充](https://en.wikipedia.org/wiki/Credential_stuffing)，是最常見帳戶被不良行為者破壞的方式之一。 為了避免這種情況，請確保您永遠不會重複使用密碼。
|
||||
|
||||
### Use randomly generated passwords
|
||||
### 使用隨機生成的密碼
|
||||
|
||||
==You should **never** rely on yourself to come up with a good password.== We recommend using [randomly generated passwords](#passwords) or [diceware passphrases](#diceware-passphrases) with sufficient entropy to protect your accounts and devices.
|
||||
==您 **不應該** 僅靠自己去想出好密碼== ;建議使用充足熵量的[隨機產生密碼randomly generated passwords](#passwords) 或 [diceware 口令密語](#diceware-passphrases) ，以保護裝備和帳戶的安全。
|
||||
|
||||
All of our [recommended password managers](../passwords.md) include a built-in password generator that you can use.
|
||||
我們所推薦的 [密碼管理器](../passwords.md) 都內建密碼生成器。
|
||||
|
||||
### Rotating Passwords
|
||||
### 輪換密碼
|
||||
|
||||
You should avoid changing passwords that you have to remember (such as your password manager's master password) too often unless you have reason to believe it has been compromised, as changing it too often exposes you to the risk of forgetting it.
|
||||
應避免經常更改必須記住的密碼（例如密碼管理器的主密碼） ，除非有理由相信它已被破壞，否則頻繁更改它往往會使您面臨忘記密碼的風險。
|
||||
|
||||
When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](threat-modeling.md) calls for it, we recommend going through important accounts (especially accounts that don't use multi-factor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage.
|
||||
對於無需記住的密碼（例如存儲在密碼管理器中的密碼）時，如果您的 [威脅模型](threat-modeling.md) 需要它，建議每隔幾個月查看一次重要帳戶（特別是沒使用多因素身份驗證的帳戶）並更改其密碼，以防它們在尚未公開的資料洩露中遭到破壞。 大多數密碼管理器可為密碼設定到期日期，以便更容易管理。
|
||||
|
||||
!!! tip "Checking for data breaches"
|
||||
!!! 提示“檢查數據洩露”
|
||||
|
||||
If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../news-aggregators.md).
|
||||
如果您的密碼管理器可以檢查密碼是否已被破壞，請務必檢查並立即更改可能已暴露在資料外洩的密碼。 或者，您可以在[news aggregator] (../news-aggregators.md)的幫助下關注[Have I Been Pwned 最新資料外洩情報] (https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches)。
|
||||
|
||||
## Creating strong passwords
|
||||
## 建立強密碼
|
||||
|
||||
### Passwords
|
||||
### 密碼
|
||||
|
||||
A lot of services impose certain criteria when it comes to passwords, including a minimum or maximum length, as well as which special characters, if any, can be used. You should use your password manager's built-in password generator to create passwords that are as long and complex as the service will allow by including capitalized and lowercase letters, numbers and special characters.
|
||||
許多服務對密碼施加了某些標準，包括最小或最大長度，以及可以使用哪些特殊字符（如果有的話）。 您應該利用密碼管理器內建的密碼生成器來創建夠長、複雜的密碼，只要服務允許，最好是混合大寫和小寫字母、數字和特殊字符搭配。
|
||||
|
||||
If you need a password you can memorize, we recommend a [diceware passphrase](#diceware-passphrases).
|
||||
若需要一個記得住的密碼，建議採用 [diceware 口令密語](#diceware-passphrases)。
|
||||
|
||||
### Diceware Passphrases
|
||||
### Diceware 口令密語
|
||||
|
||||
Diceware is a method for creating passphrases which are easy to remember, but hard to guess.
|
||||
Diceware 是一種創建密碼短語的方法，這些密短口令易於記憶，但很難猜測。
|
||||
|
||||
Diceware passphrases are a great option when you need to memorize or manually input your credentials, such as for your password manager's master password or your device's encryption password.
|
||||
當您需要記憶或手動輸入憑證時，例如密碼管理員的主密碼或設備的加密密碼， Diceware 口令密語是個好選擇。
|
||||
|
||||
An example of a diceware passphrase is `viewable fastness reluctant squishy seventeen shown pencil`.
|
||||
舉一個 Diceware 口令密語的例子 `viewable fastness reluctant squishy seventeen shown pencil`。
|
||||
|
||||
To generate a diceware passphrase using real dice, follow these steps:
|
||||
使用骰子來產生一組 diceware 口令密語，請按照以下步驟：
|
||||
|
||||
!!! note
|
||||
!!! 備註
|
||||
|
||||
These instructions assume that you are using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate the passphrase, which requires five dice rolls per word. Other wordlists may require more or less rolls per word, and may require a different amount of words to achieve the same entropy.
|
||||
這裏的說明假設您正使用[ EFF的大型單詞清單] (https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt)來生成密語，每個單詞需要骰子滾動五次。 其他單詞列表的單詞其骰子滾動次數不一，且可能需要不同單詞數量來達成相同的熵。
|
||||
|
||||
1. Roll a six-sided die five times, noting down the number after each roll.
|
||||
1. 將1~6 骰子滾動五次，記下每次出現的數字。
|
||||
|
||||
2. As an example, let's say you rolled `2-5-2-6-6`. Look through the [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) for the word that corresponds to `25266`.
|
||||
2. 例如，假設您滾動了 `2-5-2-6-6`。 查看 [EFF 的大型單詞清單](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) ，找出對應於 `25266` 的單詞。
|
||||
|
||||
3. You will find the word `encrypt`. Write that word down.
|
||||
3. 你會得到單詞 `encrypt`。 把這個詞寫下來。
|
||||
|
||||
4. Repeat this process until your passphrase has as many words as you need, which you should separate with a space.
|
||||
4. 重複相同手續，直到您的口令密語達到足夠的單詞，請用空格分隔單詞。
|
||||
|
||||
!!! warning "Important"
|
||||
!!! 警告“重要”
|
||||
|
||||
You should **not** re-roll words until you get a combination of words that appeal to you. The process should be completely random.
|
||||
你* *不應* *重新滾動單詞，以取得自己喜好的單詞組合。 這個過程應該是完全隨機的。
|
||||
|
||||
If you don't have access to or would prefer to not use real dice, you can use your password manager's built-in password generator, as most of them have the option to generate diceware passphrases in addition to regular passwords.
|
||||
如果您手邊沒有或不想使用真正的骰子，可利用密碼管理器內建密碼生成器，因為大多數密碼生成器除了普通密碼之外還可以選擇生成 diceware 口令密語。
|
||||
|
||||
We recommend using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) to generate your diceware passphrases, as it offers the exact same security as the original list, while containing words that are easier to memorize. There are also [other wordlists in different languages](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline), if you do not want your passphrase to be in English.
|
||||
我們建議使用 [EFF 的大型單詞清單](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) 來生成您的diceware 口令密語，因為它提供與原始列表完全相同的安全性，同時更容易記憶的單詞。 如果不想要使用英文密語，也有 [其他語言的單詞清單](https://theworld.com/~reinhold/diceware.html#Diceware%20in%20Other%20Languages|outline)。
|
||||
|
||||
??? note "Explanation of entropy and strength of diceware passphrases"
|
||||
??? 附註「diceware 口令密語的熵和強度的說明」
|
||||
|
||||
To demonstrate how strong diceware passphrases are, we'll use the aforementioned seven word passphrase (`viewable fastness reluctant squishy seventeen shown pencil`) and [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) as an example.
|
||||
為了證明 diceware 密語的強度，我們將使用前面提到的七個單詞密語（`viewable fastness reluctant squishy seventeen shown pencil` ）和 [EFF 的大型單詞列表] (https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt)作例子。
|
||||
|
||||
One metric to determine the strength of a diceware passphrase is how much entropy it has. The entropy per word in a diceware passphrase is calculated as $\text{log}_2(\text{WordsInList})$ and the overall entropy of the passphrase is calculated as $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$.
|
||||
判斷 diceware 口令密語強度的衡量標準是確定它有多少熵。 diceware 口令密語中的個別單詞的熵為 $\text{log}_2(\text{WordsInList})$ 而整組密語的熵總量為 $\text{log}_2(\text{WordsInList}^\text{WordsInPhrase})$.
|
||||
|
||||
Therefore, each word in the aforementioned list results in ~12.9 bits of entropy ($\text{log}_2(7776)$), and a seven word passphrase derived from it has ~90.47 bits of entropy ($\text{log}_2(7776^7)$).
|
||||
因此，上述列表中的每個單詞都會產生~ 12.9 位熵（($\text{log}_2 (7776) $) ，而其中取得七個單詞組成的口令密語就具有~ 90.47位熵 ($\text{log}_2 (7776 ^ 7) $ )。
|
||||
|
||||
The [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) contains 7776 unique words. To calculate the amount of possible passphrases, all we have to do is $\text{WordsInList}^\text{WordsInPhrase}$, or in our case, $7776^7$.
|
||||
[EFF 的大型單詞清單] (https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt)包含 7776 個獨特單詞。 要計算可能的口令密語數量，所要做的就是 $\text{WordsInList}^\text{WordsInPhrase}$ ，或者依我們的情況， $ 7776 ^ 7 $。
|
||||
|
||||
Let's put all of this in perspective: A seven word passphrase using [EFF's large wordlist](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) is one of ~1,719,070,799,748,422,500,000,000,000 possible passphrases.
|
||||
讓我們從這個角度來看：使用 [EFF 的大型單詞列表] (https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt)的七個單詞的口令密短約有1,719,070,799,748,422,500,000,000 種組合。
|
||||
|
||||
On average, it takes trying 50% of all the possible combinations to guess your phrase. With that in mind, even if your adversary is capable of ~1,000,000,000,000 guesses per second, it would still take them ~27,255,689 years to guess your passphrase. That is the case even if the following things are true:
|
||||
平均而言，至少要嘗試所有可能組合的一半來猜測您的密語。 考慮到這一點，即使對手每秒能夠猜測~ 1,000,000,000,000 次，他們仍然需要~ 27,255,689 年來猜出您的密語。 即使以下情況屬實，也是如此：
|
||||
|
||||
- Your adversary knows that you used the diceware method.
|
||||
- Your adversary knows the specific wordlist that you used.
|
||||
- Your adversary knows how many words your passphrase contains.
|
||||
- 對手知道您使用 diceware 方法。
|
||||
- 對手知道您所使用的具體單詞清單。
|
||||
- 對手知道您的密語包含多少個單詞。
|
||||
|
||||
To sum it up, diceware passphrases are your best option when you need something that is both easy to remember *and* exceptionally strong.
|
||||
總而言之， diceware 口令密語是最佳選擇，當您需要既容易記住 *又* 非常強大的東西。
|
||||
|
||||
## Storing Passwords
|
||||
## 儲存密碼
|
||||
|
||||
### Password Managers
|
||||
### 密碼管理器。
|
||||
|
||||
The best way to store your passwords is by using a password manager. They allow you to store your passwords in a file or in the cloud and protect them with a single master password. That way, you will only have to remember one strong password, which lets you access the rest of them.
|
||||
儲存密碼的最佳方式是使用密碼管理器。 可將密碼存儲在檔案或雲端，使用單個主密碼保護與開啟它們。 這樣，您只需要記住一個強大的密碼，就可以訪問其餘密碼。
|
||||
|
||||
There are many good options to choose from, both cloud-based and local. Choose one of our recommended password managers and use it to establish strong passwords across all of your accounts. We recommend securing your password manager with a [diceware passphrase](#diceware-passphrases) comprised of at least seven words.
|
||||
有許多好的選項可參考，不管是雲端和本地設備安裝。 選擇任一推薦的密碼管理器，利用它為所有帳戶建立強密碼。 建議利用至少七個單詞的 [diceware 口令密語](#diceware-passphrases) 來保護密碼管理器的安全。
|
||||
|
||||
[List of recommended password managers](../passwords.md ""){.md-button}
|
||||
[推薦的密碼管理員列表](../passwords.md ""){.md-button}
|
||||
|
||||
!!! warning "Don't place your passwords and TOTP tokens inside the same password manager"
|
||||
!!! 警告： “不要將密碼和 TOTP 令牌放在同一個密碼管理器中”
|
||||
|
||||
When using TOTP codes as [multi-factor authentication](../multi-factor-authentication.md), the best security practice is to keep your TOTP codes in a [separate app](../multi-factor-authentication.md#authenticator-apps).
|
||||
當使用 TOTP 代碼作為[多因素驗證] (../multifactor-authentication.md)時，最好的安全措施是將 TOTP 代碼保存在[分開的應用程序] (../multifactor-authentication.md#authenticator-apps)中。
|
||||
|
||||
Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager.
|
||||
將您的 TOTP 令牌存儲在與密碼相同的位置，雖然方便，但假若對手可以存取密碼管理器，則帳戶安全驗證則減少為單一因素。
|
||||
|
||||
Furthermore, we do not recommend storing single-use recovery codes in your password manager. Those should be stored separately such as in an encrypted container on an offline storage device.
|
||||
此外，我們不建議把一次性修復代碼存在密碼管理器。 它們應分開儲存，例如放在離線儲存設備的加密容器中。
|
||||
|
||||
### 備份
|
||||
|
||||
You should store an [encrypted](../encryption.md) backup of your passwords on multiple storage devices or a cloud storage provider. This can help you access your passwords if something happens to your primary device or the service you are using.
|
||||
您應該將密碼備份 [加密](../encryption.md) 在 數個儲存裝置或雲端儲存服務。 如果您主要裝置或正在使用的服務出問題，這可以幫助您存得密碼。
|
||||
|
||||
@@ -1,110 +1,110 @@
|
||||
---
|
||||
title: "Threat Modeling"
|
||||
title: "建立威脅模型"
|
||||
icon: 'material/target-account'
|
||||
description: Balancing security, privacy, and usability is one of the first and most difficult tasks you'll face on your privacy journey.
|
||||
description: 平衡安全性、隱私權和可用性是您在隱私權之旅中將面臨的首要和最困難的任務之一。
|
||||
---
|
||||
|
||||
Balancing security, privacy, and usability is one of the first and most difficult tasks you'll face on your privacy journey. Everything is a trade-off: The more secure something is, the more restricting or inconvenient it generally is, etc. Often, people find that the problem with the tools they see recommended is that they're just too hard to start using!
|
||||
平衡安全性、隱私權和可用性是您在隱私權之旅中將面臨的首要和最困難的任務之一。 一切都要各方權衡：越安全的東西，它通常越受限制或越不方便。 通常，人們發現那些被推薦的工具的問題是它們太難開始使用了！
|
||||
|
||||
If you wanted to use the **most** secure tools available, you'd have to sacrifice *a lot* of usability. And, even then, ==nothing is ever fully secure.== There's **high** security, but never **full** security. That's why threat models are important.
|
||||
如果要使用**最安全**的工具，就必須犠牲許多*可用性*。 就算如此，也沒有什麼是完全安全的。有 **高** 安全，但從來沒有 **完整** 安全。 這就是為什麼威脅模型很重要。
|
||||
|
||||
**So, what are these threat models, anyway?**
|
||||
**那麼，這些威脅模型究竟是什麼呢？**
|
||||
|
||||
==A threat model is a list of the most probable threats to your security and privacy endeavors.== Since it's impossible to protect yourself against **every** attack(er), you should focus on the **most probable** threats. In computer security, a threat is an event that could undermine your efforts to stay private and secure.
|
||||
==威脅模型，列出對您的安全與隱私可能造成的威脅。== 既然無法完全防範**每一次** 攻擊(者)，請將精力放在 **最可能發生的** 威脅。 在電腦安全上，威脅指可能破壞您保持私密和安全努力的事件。
|
||||
|
||||
Focusing on the threats that matter to you narrows down your thinking about the protection you need, so you can choose the tools that are right for the job.
|
||||
專注在對您認為重要的威脅，可縮小對所需保護的考慮，以讓您選擇出適合的工具。
|
||||
|
||||
## Creating Your Threat Model
|
||||
## 建立您的威脅模型
|
||||
|
||||
To identify what could happen to the things you value and determine from whom you need to protect them, you should answer these five questions:
|
||||
為了分辨所重視的事物會發生什麼，保護它們必須避開哪些人，請回答以下五個問題：
|
||||
|
||||
1. What do I want to protect?
|
||||
2. Who do I want to protect it from?
|
||||
3. How likely is it that I will need to protect it?
|
||||
4. How bad are the consequences if I fail?
|
||||
5. How much trouble am I willing to go through to try to prevent potential consequences?
|
||||
1. 我想保護什麼？
|
||||
2. 我想要保護它免受誰的侵害？
|
||||
3. 我需要保護它的可能性有多大？
|
||||
4. 若不幸失敗將帶來多嚴重的後果？
|
||||
5. 我願意承受多少麻煩來防止潛在的後果？
|
||||
|
||||
### What do I want to protect?
|
||||
### 我想保護什麼？
|
||||
|
||||
An “asset” is something you value and want to protect. In the context of digital security, ==an asset is usually some kind of information.== For example, your emails, contact lists, instant messages, location, and files are all possible assets. Your devices themselves may also be assets.
|
||||
“資產”是你重視和想要保護的東西。 在討論數位安全時，資產通常是某種資訊。例如，您的電子郵件、聯繫人列表、即時消息、位置和檔案等都是可能的資產。 你的設備本身也可能是資產。
|
||||
|
||||
*Make a list of your assets: data that you keep, where it's kept, who has access to it, and what stops others from accessing it.*
|
||||
*列出您的資產：您保存的資料、保存的地方、誰可以取用它，以及阻止其他人使用它的原因。*
|
||||
|
||||
### Who do I want to protect it from?
|
||||
### 我想要保護它免受誰的侵害？
|
||||
|
||||
To answer this question, it's important to identify who might want to target you or your information. ==A person or entity that poses a threat to your assets is an “adversary”.== Examples of potential adversaries are your boss, your former partner, your business competition, your government, or a hacker on a public network.
|
||||
要回答這個問題，重要的是要找出誰可能會針對您或您的資訊。 對您的資產構成威脅的個人或實體即是“敵人”。潛在對手可能為：您的老闆、前任情人、商業競爭對手、政府或公共網路上的黑客。
|
||||
|
||||
*Make a list of your adversaries or those who might want to get ahold of your assets. Your list may include individuals, a government agency, or corporations.*
|
||||
*列出對手或那些可能想要獲取您的資產的敵人。 您的名單可能包括個人、政府機構或公司。*
|
||||
|
||||
Depending on who your adversaries are, under some circumstances, this list might be something you want to destroy after you're done security planning.
|
||||
根據對手是誰，在某些情況下，這份清單可能是在完成安全計劃後必須鎖毀的東西。
|
||||
|
||||
### How likely is it that I will need to protect it?
|
||||
### 它需要被保護的可能性有多大？
|
||||
|
||||
==Risk is the likelihood that a particular threat against a particular asset will actually occur.== It goes hand-in-hand with capability. While your mobile phone provider has the capability to access all of your data, the risk of them posting your private data online to harm your reputation is low.
|
||||
==風險是指某個資產發生特定威脅實際的可能性。= =它與能力密切相關。 雖然您的手機供應商有能力訪問您的資料，但他們將私人數據散佈在網路以損您聲譽的這種風險發生機率很低。
|
||||
|
||||
It is important to distinguish between what might happen and the probability it may happen. For instance, there is a threat that your building might collapse, but the risk of this happening is far greater in San Francisco (where earthquakes are common) than in Stockholm (where they are not).
|
||||
重要的是要能區分可能發生什麼事和事情發生的概率。 例如，您的建築物可能會倒塌，但很常有地震的舊金山發生這種情況的風險遠遠大於地震並不常見的斯德哥爾摩。
|
||||
|
||||
Assessing risks is both a personal and subjective process. Many people find certain threats unacceptable, no matter the likelihood they will occur, because the mere presence of the threat is not worth the cost. In other cases, people disregard high risks because they don't view the threat as a problem.
|
||||
評估風險既是私人的，也是主觀的過程。 許多人認為某些威脅是不可接受的，無關乎其發生的可能性，而是因它們根本不值得。 在其他情況下，人們忽視高風險，因為他們不認為威脅是問題。
|
||||
|
||||
*Write down which threats you are going to take seriously, and which may be too rare or too harmless (or too difficult to combat) to worry about.*
|
||||
*寫下你認真看待哪些威脅，哪些可能太罕見或無害（或太難以對抗）。*
|
||||
|
||||
### How bad are the consequences if I fail?
|
||||
### 若不幸失敗將帶來多嚴重的後果？
|
||||
|
||||
There are many ways that an adversary could gain access to your data. For example, an adversary can read your private communications as they pass through the network, or they can delete or corrupt your data.
|
||||
對手有很多方法可以取用您的資料。 例如，他們通過網路讀取您的私人通訊，或是刪除或破壞您的資料。
|
||||
|
||||
==The motives of adversaries differ widely, as do their tactics.== A government trying to prevent the spread of a video showing police violence may be content to simply delete or reduce the availability of that video. In contrast, a political opponent may wish to gain access to secret content and publish that content without you knowing.
|
||||
== 對手的動機差異很大，他們的戰術也是如此。==政府試圖阻止警察暴力影片傳播，簡單地刪除或減少該影片的可用性大概就可以。 相比之下，政治對手可能希望在您不知情的情況下，獲得您的祕密內容並發布。
|
||||
|
||||
Security planning involves understanding how bad the consequences could be if an adversary successfully gains access to one of your assets. To determine this, you should consider the capability of your adversary. For example, your mobile phone provider has access to all of your phone records. A hacker on an open Wi-Fi network can access your unencrypted communications. Your government might have stronger capabilities.
|
||||
安全規劃涉及了解若對手成功地取用您的資產後，會帶來多嚴重的後果。 要確定這一點，應該考慮對手的能力。 例如，您的手機供應商可以存取您所有的電話記錄。 公共 Wi-Fi 網路上的駭客可以訪問您未加密的通訊。 政府往往有更強的能力。
|
||||
|
||||
*Write down what your adversary might want to do with your private data.*
|
||||
*寫下對手可能想用您的私人資料做什麼。*
|
||||
|
||||
### How much trouble am I willing to go through to try to prevent potential consequences?
|
||||
### 我願意承受多少麻煩來防止潛在的後果？
|
||||
|
||||
==There is no perfect option for security.== Not everyone has the same priorities, concerns, or access to resources. Your risk assessment will allow you to plan the right strategy for you, balancing convenience, cost, and privacy.
|
||||
==沒有完美的安全保障。==不是每個人都有相同的優先事項、關切點或可用資源。 您的風險評估能為您規劃正確的策略，平衡便利性、成本和隱私。
|
||||
|
||||
For example, an attorney representing a client in a national security case may be willing to go to greater lengths to protect communications about that case, such as using encrypted email, than a mother who regularly emails her daughter funny cat videos.
|
||||
例如，在國家安全案件中代表客戶的律師可能願意全力保護該案件的相關通信，例如使用加密電子郵件，而常向女兒發送有趣貓咪短片的母親就不會想要加密。
|
||||
|
||||
*Write down what options you have available to you to help mitigate your unique threats. Note if you have any financial constraints, technical constraints, or social constraints.*
|
||||
*寫下您可用的選項，以幫助減輕您的獨特威脅。 ，如果您有任何財務、技術或社會上的限制，請予備註。*
|
||||
|
||||
### Try it yourself: Protecting Your Belongings
|
||||
### 自己試試：保護好您的財產
|
||||
|
||||
These questions can apply to a wide variety of situations, online and offline. As a generic demonstration of how these questions work, let's build a plan to keep your house and possessions safe.
|
||||
這些問題可以適用於線上和線下的各種情況。 示範這些問題如何運作，我們來制定一個保護您房屋和財產安全的計畫。
|
||||
|
||||
**What do you want to protect? (Or, *what do you have that is worth protecting?*)**
|
||||
**您想保護什麼？ ( 或者*)您有什麼值得保護的？ (*)**
|
||||
:
|
||||
|
||||
Your assets might include jewelry, electronics, important documents, or photos.
|
||||
您的資產可能包括珠寶、電子產品、重要文件或照片。
|
||||
|
||||
**Who do you want to protect it from?**
|
||||
**你想保護它免受誰的侵害？**
|
||||
:
|
||||
|
||||
Your adversaries might include burglars, roommates, or guests.
|
||||
你的對手可能包括竊賊、室友或客人。
|
||||
|
||||
**How likely is it that you will need to protect it?**
|
||||
**您需要保護它的可能性有多大？**
|
||||
:
|
||||
|
||||
Does your neighborhood have a history of burglaries? How trustworthy are your roommates or guests? What are the capabilities of your adversaries? What are the risks you should consider?
|
||||
您的社區發生過入室盜竊的案件嗎？ 你的室友或客人可信任的程度？ 你的對手有哪些能力？ 應該考慮哪些風險？
|
||||
|
||||
**How bad are the consequences if you fail?**
|
||||
**失敗的後果有多嚴重？**
|
||||
:
|
||||
|
||||
Do you have anything in your house that you cannot replace? Do you have the time or money to replace those things? Do you have insurance that covers goods stolen from your home?
|
||||
你家裡有什麼東西是你無法取代的嗎？ 您有時間或金錢來取代這些東西嗎？ 是否已為家裏物品投保失竊險？
|
||||
|
||||
**How much trouble are you willing to go through to prevent these consequences?**
|
||||
**你願意承受多少麻煩來防止這些後果？**
|
||||
:
|
||||
|
||||
Are you willing to buy a safe for sensitive documents? Can you afford to buy a high-quality lock? Do you have time to open a security box at your local bank and keep your valuables there?
|
||||
您是否願意為敏感文件購買保險箱？ 你能買到高品質的鎖嗎？ 您有時間在當地銀租用保險箱並將貴重物品存放在那裡嗎？
|
||||
|
||||
Only once you have asked yourself these questions will you be in a position to assess what measures to take. If your possessions are valuable, but the probability of a break-in is low, then you may not want to invest too much money in a lock. But, if the probability of a break-in is high, you'll want to get the best lock on the market and consider adding a security system.
|
||||
只有真正自問這些問題後，才能評估該採取哪些措施。 如果您的財產具有價值，但被入侵的可能性很低，那麼可能不想在防鎖上投資太多。 但是，如果被入侵的可能性很高，您會希望取得市場上最好的鎖並考慮添加安全系統。
|
||||
|
||||
Making a security plan will help you to understand the threats that are unique to you and to evaluate your assets, your adversaries, and your adversaries' capabilities, along with the likelihood of risks you face.
|
||||
制定安全計劃有助於了解您獨有的威脅、評估自己的資產、對手與其能力，以及您面臨風險的可能性。
|
||||
|
||||
## Further Reading
|
||||
## 延伸閱讀
|
||||
|
||||
For people looking to increase their privacy and security online, we've compiled a list of common threats our visitors face or goals our visitors have, to give you some inspiration and demonstrate the basis of our recommendations.
|
||||
針對希望提高線上隱私和安全性者，我們編制了一份本站訪客面臨的常見威脅或目標清單，為您提供一些靈感並展示我們建議的基礎。
|
||||
|
||||
- [Common Goals and Threats :material-arrow-right-drop-circle:](common-threats.md)
|
||||
- [共同目標與威脅 :material-arrow-right-drop-circle:](common-threats.md)
|
||||
|
||||
## Sources
|
||||
## 來源
|
||||
|
||||
- [EFF Surveillance Self Defense: Your Security Plan](https://ssd.eff.org/en/module/your-security-plan)
|
||||
- [EFF監控自衛：您的安全計劃](https://ssd.eff.org/en/module/your-security-plan)
|
||||
|
||||
@@ -1,77 +1,80 @@
|
||||
---
|
||||
title: VPN Overview
|
||||
title: VPN 簡介
|
||||
icon: material/vpn
|
||||
description: Virtual Private Networks shift risk away from your ISP to a third-party you trust. You should keep these things in mind.
|
||||
description: 虛擬私用網路將風險從您的ISP 轉移到您信任的第三方。 你應該記住這些事情。
|
||||
---
|
||||
|
||||
Virtual Private Networks are a way of extending the end of your network to exit somewhere else in the world. An ISP can see the flow of internet traffic entering and exiting your network termination device (i.e. modem).
|
||||
虛擬專用網路是將您的網路末端延伸到世界其它地方的一種方式。 ISP 可以看到網路終端設備（例如數據機）的網際網路進出流量。
|
||||
|
||||
Encryption protocols such as HTTPS are commonly used on the internet, so they may not be able to see exactly what you're posting or reading, but they can get an idea of the [domains you request](../advanced/dns-overview.md#why-shouldnt-i-use-encrypted-dns).
|
||||
HTTPS 等加密協議通常應用在網際網路，因此雖無法確切地知道您發布或閱讀的內容，但還是可以了解您所請求訪問的 [網域名](../advanced/dns-overview.md#why-shouldnt-i-use-encrypted-dns)。
|
||||
|
||||
A VPN can help as it can shift trust to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing into it.
|
||||
VPN 可以提供幫助，將信任轉移到世界其他地方的伺服器。 因此， ISP只會看到您已連接到VPN ，而不會看到您正在傳遞的活動。
|
||||
|
||||
## Should I use a VPN?
|
||||
## 我應該使用 VPN 嗎？
|
||||
|
||||
**Yes**, unless you are already using Tor. A VPN does two things: shifting the risks from your Internet Service Provider to itself and hiding your IP from a third-party service.
|
||||
**是**，除非你已經在使用Tor。 VPN可以做兩件事：將風險從網際網路服務提供商轉移到 VPN，並將向第三方服務隱藏您的 IP 地址。
|
||||
|
||||
VPNs cannot encrypt data outside of the connection between your device and the VPN server. VPN providers can see and modify your traffic the same way your ISP could. And there is no way to verify a VPN provider's "no logging" policies in any way.
|
||||
VPN 無法加密裝置與 VPN 伺服器之間連線以外的資料。 VPN 提供商可以像 ISP 一樣查看和修改您的流量。 而且沒有方式可以驗證 VPN 提供商的“無記錄”政策是否貫徹。
|
||||
|
||||
However, they do hide your actual IP from a third-party service, provided that there are no IP leaks. They help you blend in with others and mitigate IP based tracking.
|
||||
VPN 確實可向第三方服務隱藏您的實際 IP ，但前提是IP 沒被洩漏。 它們有助您混在他人之中，以減輕基於 IP 的追蹤。
|
||||
|
||||
## When shouldn't I use a VPN?
|
||||
## 什麼時候不該使用 VPN ？
|
||||
|
||||
Using a VPN in cases where you're using your [known identity](common-threats.md#common-misconceptions) is unlikely be useful.
|
||||
在 [身份已可辨識](common-threats.md#common-misconceptions) 的情況下，VPN 就沒效用了。
|
||||
|
||||
Doing so may trigger spam and fraud detection systems, such as if you were to log into your bank's website.
|
||||
這樣做可能會觸發垃圾郵件和欺詐偵測系統，例如您正試圖登入銀行網站。
|
||||
|
||||
## What about encryption?
|
||||
## 那加密呢？
|
||||
|
||||
Encryption offered by VPN providers are between your devices and their servers. It guarantees that this specific link is secure. This is a step up from using unencrypted proxies where an adversary on the network can intercept the communications between your devices and said proxies and modify them. However, encryption between your apps or browsers with the service providers are not handled by this encryption.
|
||||
VPN供應商提供的加密僅發生在您的裝置與伺服器之間。 它保證此特定連結是安全的。 這比用未加密代理的更進一步，因為對手可以攔截您的設備和前述未加密代理之間的通訊並加以修改。 然而軟體或瀏覽器與服務供應商之間的加密並不是依此加密處理。
|
||||
|
||||
In order to keep what you actually do on the websites you visit private and secure, you must use HTTPS. This will keep your passwords, session tokens, and queries safe from the VPN provider. Consider enabling "HTTPS everywhere" in your browser to mitigate downgrade attacks like [SSL Strip](https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf).
|
||||
為了保持所瀏覽網站活動的私密和安全，您必須使用 HTTPS。 這將確保您的密碼、會話令牌和查詢對VPN提供商是安全的。 請考慮在瀏覽器中啟用「HTTPS everywhere」，以減輕 [SSL Strip](https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf)等攻擊。
|
||||
|
||||
## Should I use encrypted DNS with a VPN?
|
||||
## 我應該將加密 DNS 與 VPN 一起使用嗎？
|
||||
|
||||
Unless your VPN provider hosts the encrypted DNS servers, **no**. Using DOH/DOT (or any other form of encrypted DNS) with third-party servers will simply add more entities to trust and does **absolutely nothing** to improve your privacy/security. Your VPN provider can still see which websites you visit based on the IP addresses and other methods. Instead of just trusting your VPN provider, you are now trusting both the VPN provider and the DNS provider.
|
||||
除非您的 VPN 服務商自行託管加密的 DNS 伺服器， **不要**. 使用 DOH/DOT (或其它任何 DNS 加密) 與第三方伺服器只有需信任更多實體，在安全隱私則**一點幫助也沒有** 。 您的 VPN 提供商仍可以根據 IP 地址和其他方法查看您訪問的網站。 您現在除了信任 VPN 供應商外，還得同時信任 VPN 供應商和DNS 供應商。
|
||||
|
||||
A common reason to recommend encrypted DNS is that it helps against DNS spoofing. However, your browser should already be checking for [TLS certificates](https://en.wikipedia.org/wiki/Transport_Layer_Security#Digital_certificates) with **HTTPS** and warn you about it. If you are not using **HTTPS**, then an adversary can still just modify anything other than your DNS queries and the end result will be little different.
|
||||
推薦加密 DNS 的常見理由是有助於防止 DNS 欺騙。 您的瀏覽器應該已經檢查了 [TLS 憑證](https://en.wikipedia.org/wiki/Transport_Layer_Security#Digital_certificates) 和 **HTTPS** ，並警告您。 如果沒用 **HTTPS**，則對手可以修改您的 DNS 查詢之外的任何東西，最終結果將沒太大差異。
|
||||
|
||||
Needless to say, **you shouldn't use encrypted DNS with Tor**. This would direct all of your DNS requests through a single circuit and would allow the encrypted DNS provider to deanonymize you.
|
||||
**您不應把加密 DNS 與Tor**一起使用。 這將把您所有 DNS 請求引至某單一迴路，這會讓加密 DNS 提供商可對您消除匿名性。
|
||||
|
||||
## Should I use Tor *and* a VPN?
|
||||
## 我應該*同時* 使用 Tor 與 VPN 嗎？
|
||||
|
||||
By using a VPN with Tor, you're creating essentially a permanent entry node, often with a money trail attached. This provides zero additional benefits to you, while increasing the attack surface of your connection dramatically. If you wish to hide your Tor usage from your ISP or your government, Tor has a built-in solution for that: Tor bridges. [Read more about Tor bridges and why using a VPN is not necessary](../advanced/tor-overview.md).
|
||||
撔 Tor 與 VPN 一起使用 ，您基本上創建了一個永久的入口節點，這類節點通常帶有與金錢相關追蹤痕跡。 這樣根本沒增加額外好處，反而明顯地擴大了連接時的攻擊面。 如果您希望向 ISP 或政府隱藏您的Tor 使用， Tor 內建一個解決方案：Tor 橋接。 [閱讀更多關於Tor橋接以及為什麼沒必要使用 VPN](../advanced/tor-overview.md)。
|
||||
|
||||
## What if I need anonymity?
|
||||
## 如果我需要匿名怎麼辦？
|
||||
|
||||
VPNs cannot provide anonymity. Your VPN provider will still see your real IP address, and often has a money trail that can be linked directly back to you. You cannot rely on "no logging" policies to protect your data. Use [Tor](https://www.torproject.org/) instead.
|
||||
VPN無法提供匿名性。 您的VPN提供商可知道您真實 IP 地址，並且通常有一個可以直接與您連結的金錢線索。 您不能依靠 VPN「無記錄」政策來保護您的資料。 請用 [Tor](https://www.torproject.org/) 代替。
|
||||
|
||||
## What about VPN providers that provide Tor nodes?
|
||||
## 提供Tor 節點的 VPN 提供商好不好呢？
|
||||
|
||||
Do not use that feature. The point of using Tor is that you do not trust your VPN provider. Currently Tor only supports the [TCP](https://en.wikipedia.org/wiki/Transmission_Control_Protocol) protocol. [UDP](https://en.wikipedia.org/wiki/User_Datagram_Protocol) (used in [WebRTC](https://en.wikipedia.org/wiki/WebRTC) for voice and video sharing, the new [HTTP3/QUIC](https://en.wikipedia.org/wiki/HTTP/3) protocol, etc), [ICMP](https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol) and other packets will be dropped. To compensate for this, VPN providers typically will route all non-TCP packets through their VPN server (your first hop). This is the case with [ProtonVPN](https://protonvpn.com/support/tor-vpn/). Additionally, when using this Tor over VPN setup, you do not have control over other important Tor features such as [Isolated Destination Address](https://www.whonix.org/wiki/Stream_Isolation) (using a different Tor circuit for every domain you visit).
|
||||
不要使用此功能。 使用 Tor 的重點是不信任您的 VPN 提供商。 目前 Tor 只支援 [TCP](https://en.wikipedia.org/wiki/Transmission_Control_Protocol) 通訊協議。 [UDP](https://en.wikipedia.org/wiki/User_Datagram_Protocol) （在 [WebRTC](https://en.wikipedia.org/wiki/WebRTC) 中用於語音和影片分享，新的 [HTTP3/QUIC](https://en.wikipedia.org/wiki/HTTP/3) 協議等） ， [ICMP](https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol) 和其他封包將被丟棄。 為了彌補這一點， VPN 提供商通常會引導全部的non-TCP 封包通過他們的 VPN 伺服器（您的第一個跳）。 [ProtonVPN ](https://protonvpn.com/support/tor-vpn/)的情況就是如此。 此外，使用此 Tor over VPN 設定時，您無法控制 Tor 其他重要的功能，例如 [隔離目標位址](https://www.whonix.org/wiki/Stream_Isolation) （為您訪問不同網域使用不同的Tor 迴路）。
|
||||
|
||||
The feature should be viewed as a convenient way to access the Tor Network, not to stay anonymous. For proper anonymity, use the Tor Browser, TorSocks, or a Tor gateway.
|
||||
該功能應被視為方便訪問 Tor 網絡的方式，而不是為了保持匿名。 為保持適當的匿名性，請使用 Tor 瀏覽器、TorSocks 或 Tor 閘道。
|
||||
|
||||
## When are VPNs useful?
|
||||
## VPN 何時有用？
|
||||
|
||||
A VPN may still be useful to you in a variety of scenarios, such as:
|
||||
VPN在各種情況下仍可能對您有用，例如：
|
||||
|
||||
1. Hiding your traffic from **only** your Internet Service Provider.
|
||||
1. Hiding your downloads (such as torrents) from your ISP and anti-piracy organizations.
|
||||
1. Hiding your IP from third-party websites and services, preventing IP based tracking.
|
||||
1. **僅需**對網路連線服務商隱藏您的流量 。
|
||||
1. 對 ISP 和反盜版組織隱藏您的下載（如 torrents）。
|
||||
1. 從第三方網站和服務中隱藏您的IP ，防止基於IP的追蹤。
|
||||
|
||||
For situations like these, or if you have another compelling reason, the VPN providers we listed above are who we think are the most trustworthy. However, using a VPN provider still means you're *trusting* the provider. In pretty much any other scenario you should be using a secure**-by-design** tool such as Tor.
|
||||
類似這些情況或者如果您有其他令人信服的理由，可考慮使用我們所列出認為最值得信賴的 VPN 提供商。 使用 VPN 意謂著您 *方便* 這些服務供應者。 任何情況下，最好使用以安全為**設計理念** 的工具，例如 Tor。
|
||||
|
||||
## Sources and Further Reading
|
||||
## 資料來源和進一步閱讀
|
||||
|
||||
1. [VPN - a Very Precarious Narrative](https://schub.io/blog/2019/04/08/very-precarious-narrative.html) by Dennis Schubert
|
||||
1. [Tor Network Overview](../advanced/tor-overview.md)
|
||||
1. [IVPN Privacy Guides](https://www.ivpn.net/privacy-guides)
|
||||
1. ["Do I need a VPN?"](https://www.doineedavpn.com), a tool developed by IVPN to challenge aggressive VPN marketing by helping individuals decide if a VPN is right for them.
|
||||
1. [Tor Network概述](../advanced/tor-overview.md)
|
||||
1. [IVPN隱私指南](https://www.ivpn.net/privacy-guides)
|
||||
1. [「我需要 VPN 嗎？」"Do I need a VPN?" ](https://www.doineedavpn.com)，
|
||||
IVPN 開發的工具，幫助個人決定 VPN 是否適合他們，以因應各式 VPN 營銷。</li> </ol>
|
||||
|
||||
|
||||
|
||||
## Related VPN Information
|
||||
## VPN 相關資訊
|
||||
|
||||
- [The Trouble with VPN and Privacy Review Sites](https://blog.privacyguides.org/2019/11/20/the-trouble-with-vpn-and-privacy-review-sites/)
|
||||
- [Free VPN App Investigation](https://www.top10vpn.com/free-vpn-app-investigation/)
|
||||
- [Hidden VPN owners unveiled: 101 VPN products run by just 23 companies](https://vpnpro.com/blog/hidden-vpn-owners-unveiled-97-vpns-23-companies/)
|
||||
- [This Chinese company is secretly behind 24 popular apps seeking dangerous permissions](https://vpnpro.com/blog/chinese-company-secretly-behind-popular-apps-seeking-dangerous-permissions/)
|
||||
- [VPN 問題和隱私評論網站](https://blog.privacyguides.org/2019/11/20/the-trouble-with-vpn-and-privacy-review-sites/)
|
||||
- [免費 VPN 應用程式調查](https://www.top10vpn.com/free-vpn-app-investigation/)
|
||||
- [揭露隱身的 VPN 擁有者：由 23 家公司運營101款 VPN 產品](https://vpnpro.com/blog/hidden-vpn-owners-unveiled-97-vpns-23-companies/)
|
||||
- [這家中國公司祕密支持24個尋求危險權限的流行應用程序](https://vpnpro.com/blog/chinese-company-secretly-behind-popular-apps-seeking-dangerous-permissions/)
|
||||
|
||||
Reference in New Issue
Block a user