安全与隐私apple.com
致客户的一封信
A Message to Our Customers
2016 — 2021，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
这是苹果2016年由Tim Cook署名的致客户公开信，解释公司为何拒绝FBI要求开发后门来解锁圣贝纳迪诺枪击案涉案iPhone，认为这会削弱所有用户的安全并开创危险先例。2021年它再登首页，是因为苹果宣布iCloud照片儿童性虐待材料（CSAM）检测功能引发争议，评论者拿这封信对比其立场变化。
为什么经久不衰：它是科技公司与政府加密后门之争的标志性文本，清晰论证了“一旦为执法建后门，所有人的安全都会被削弱”，至今仍是隐私与安全辩论的试金石。
HN 评论精选
真正风险是开创先例，迫使苹果未来为各种调查降低设备安全性。
我惊讶没人讨论这份回应的真正实质。它跟苹果多年来按简单法院命令帮警方暴力破解iPhone无关，而是苹果明确表示：如果依1789年《所有令状法》被迫创建这个特定后门，就会打开闸门，未来各种要求添加后门、降低安全性的请求都会涌来。FBI完全可能利用这个先例，通过一次固件更新就让iPhone失去所有安全防护。
ghshephard查看英文原文
I'm surprised that nobody on this thread has commented on the real substance of this response. It has nothing to do with Apple brute forcing iPhones for the police (which it has done for years, with a simple court order) - but instead, is Apple making it abundantly clear, that if they comply (or are forced to comply) with the All Writs Act of 1789 to create this particular back door, then that opens the floodgate moving forward for all sorts of requests to add backdoors/decrease security. It's entirely possible, that the FBI can then use this precedent to simply have Apple remove all security from an iPhone in pursuit of an active investigation, which can be done with a straightforward firmware update - which IOS users tend to do without much thought.
所要求的后门其实是允许电子输入密码以便暴力破解，强密码加关闭Touch ID仍能自保。
大力支持苹果，希望谷歌、Facebook和亚马逊也能跟进。我好奇苹果怎么能造后门，文末解释是：政府要求移除安全功能、允许电子输入密码，从而用现代电脑速度暴力试成千上万种组合。这反而让人安心——即使苹果也无法破解设置了强密码（10位以上）并关闭Touch ID的iPhone，而Touch ID稍费点力就能被指纹破解。
epaga查看英文原文
Huge props to Apple - here's hoping against hope that Google, Facebook, and Amazon get behind this. One thing I was wondering is how Apple is even able to create a backdoor. It is explained toward the end: "The government would have us remove security features and add new capabilities to the operating system, allowing a passcode to be input electronically. This would make it easier to unlock an iPhone by “brute force,” trying thousands or millions of combinations with the speed of a modern computer." This is actually quite reassuring - what this means is that even Apple can't break into an iPhone with a secure passphrase (10+ characters) and disabled Touch ID - which is hackable with a bit of effort to get your fingerprint.
2016年信赢得信任，2021年CSAM政策瞬间毁掉这份信任。
值得注意的是，Tim在2016年如此清楚地理解了问题。凭借那篇文章，苹果和Tim赢得了一群极少信任他人者的信任。而转眼之间，苹果和Tim又把这一切烧光了。
idunnoman查看英文原文
It is remarkable that Tim so clearly understood the problem in 2016. With that one post, Apple and Tim earned trust from a group of people that trust very few. And in an instance, both Apple and Tim have now burned all of it.
苹果2021年CSAM检测只针对iCloud上传且有人工审核，与其它公司持续扫描不同。
有直接来自苹果隐私主管的采访，说明苹果将如何处理，而非像谷歌、微软、Facebook、Twitter等那样做。要点：苹果过去十年没有扫描用户的iCloud在线数据；功能开启后只扫描你尝试上传到iCloud的图片；关闭照片同步就什么都不扫描；若多张图片匹配已知儿童色情图（不止一张），会人工审核再决定是否上报；若多张都不匹配，则什么都不发生。
GeekyBear查看英文原文
There is a story that has information direct from the horses mouth on how Apple will approach this as opposed to how Google, Microsoft, Facebook, Twitter and the rest already do. https://techcrunch.com/2021/08/10/interview-apples-head-of-privacy-details-child-abuse-detection-and-messages-safety-features/ Highlights: Unlike Google, Microsoft, Facebook, and the rest Apple has not been scanning your online data (iCloud) for the past decade. When this is turned on, only images you attempt upload to iCloud will be scanned. If you turn off photo synching to iCloud, nothing will be scanned. If photo scanning shows that many images on your device match known kiddie porn images (not just one), a human will review the data to make sure passing it on to the authorities is called for or if there have been multiple false positives. If multiple images do not match known kiddie porn images, nothing happens.
历次讨论
同类还值得读
非法素数
Illegal prime
维基百科条目，介绍“非法素数”：某些素数之所以被称为“非法”，是因为它们经特定编码后，恰好对应一段被法律禁止传播的数据——最著名的是 DVD 解密程序 DeCSS 的代码，有人把…
安全与隐私上首页 5 次 · 2010–2021en.wikipedia.org编辑精选关于 /dev/urandom 的常见误区
Myths about /dev/urandom
（Thomas Hühn 撰写，2014 年首发并持续更新）逐条反驳关于 /dev/urandom 的常见误解：它与 /dev/random 使用的是同一个 CSPRNG，一旦完…
安全与隐私上首页 5 次 · 2014–20202uo.de编辑精选AES 高级加密标准火柴人图解
A Stick Figure Guide to the Advanced Encryption Standard (AES)
一篇用火柴人漫画形式讲解 AES（高级加密标准）算法的经典科普文章。
安全与隐私上首页 5 次 · 2009–2022moserware.com编辑精选指纹是用户名，不是密码
Fingerprints are Usernames, not Passwords
作者（eCryptfs 维护者、Ubuntu 安全工程师）认为指纹等生物特征是公开、不可更改的标识，应视作用户名而非密码，不能当作秘密凭据用于认证。
安全与隐私上首页 4 次 · 2013–2017blog.dustinkirkland.comHTTPS 连接的最初几毫秒（2009）
The First Few Milliseconds of an HTTPS Connection (2009)
逐毫秒拆解一次 HTTPS 连接建立时发生了什么，重点讲 TLS 握手、证书验证、RSA 签名与密钥协商等机制，面向不熟悉该领域的读者。
安全与隐私上首页 4 次 · 2009–2020moserware.com编辑精选