安全与隐私philzimmermann.com编辑精选
我为什么写 PGP
Why I Wrote PGP (1999)
2013 — 2021，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
PGP 作者 Phil Zimmermann 于 1999 年撰写的文章，讲述他当年为何编写 PGP 加密软件：在政府试图限制加密技术的年代，他把强加密带给普通人，并因此面临刑事调查。文中以“明信片与信封”的类比论证守法公民同样需要隐私。
为什么经久不衰：它既是加密技术史上“密码战争”时代的第一手记录，其关于隐私与加密的论证在斯诺登事件后依然极具现实意义。
HN 评论精选
引用并推崇文中“信封与明信片”的类比：人人都加密，隐私才不显可疑
也许你觉得自己的邮件没什么值得加密的。如果你真是守法公民、没什么可隐瞒的，那为什么寄纸质信件不用明信片？为什么要求警察搜查要有搜查令？如果所有人都用明信片寄信，那么一个用信封保护隐私的人反而会招致怀疑。幸好我们不是活在那种世界，因为人人都用信封。同样，最好所有人都习惯性地加密邮件，这样用加密保护隐私就不会引人怀疑——把它当作一种团结。
noonespecial查看英文原文
Perhaps you think your email is legitimate enough that encryption is unwarranted. If you really are a law-abiding citizen with nothing to hide, then why don't you always send your paper mail on postcards? Why not submit to drug testing on demand? Why require a warrant for police searches of your house? Are you trying to hide something? If you hide your mail inside envelopes, does that mean you must be a subversive or a drug dealer, or maybe a paranoid nut? Do law-abiding citizens have any need to encrypt their email? What if everyone believed that law-abiding citizens should use postcards for their mail? If a nonconformist tried to assert his privacy by using an envelope for his mail, it would draw suspicion. Perhaps the authorities would open his mail to see what he's hiding. Fortunately, we don't live in that kind of world, because everyone protects most of their mail with envelopes. So no one draws suspicion by asserting their privacy with an envelope. There's safety in numbers. Analogously, it would be nice if everyone routinely used encryption for all their email, innocent or not, so that no one drew suspicion by asserting their email privacy with encryption. Think of it as a form of solidarity. I'm seriously thinking of having this printed up on business cards (1st paragraph on the front, 2nd on the back) so I can just whip them out and hand them to people. By the time they've gotten done saying, "Well, if you have nothing to hide..." it'll be in their hands.
源代码以书籍形式出版，巧妙借助言论自由规避出口管制
PGP 传奇中最精彩的故事之一：Zimmermann 与 MIT 出版社合作，把整个 PGP 源代码以机器可读的印刷体出版成书。这让他可以主张这个“危险”的密码系统其实受宪法第一修正案言论自由保护。
nathanallen查看英文原文
One of the best stories from the PGP saga is that Zimmerman worked with MIT Press to have the entire PGP source code published, in machine readable print. This allowed him to make the argument that his scary-dangerous-cryptosystem was in fact protected under the First Amendment as free speech.
反驳“无隐私焦虑论”：加密源于对机构保管数据能力的不信任
对那些信奉“没什么可隐藏就不必担心隐私”的人，我想说：我加密是因为我不信任你们处理我私人信息的能力。政府机构连自己的机密都保不住，更别说我的信息。我锁门不是因为在家造原子弹，而是因为你们防不住小偷。下一次“911”不会是劫机撞楼，而会是外国黑客从集中存储全民数据的数据库里窃取信息。
joering2查看英文原文
To all the people and law enforcement officials that live by the "if you don't have anything to hide, you shouldn't worry about your privacy", I say that's your very own and primitive explanation. I hide/encrypt/lock my stuff because I DO NOT TRUST you in handling my private info and therefore my life. Most government org cannot keep their own stuff private, not to mention my personal info. Same applies to a lock on my house: I do not lock my door because I sit at home and build an atomic bomb and do not wont officials to know about it; I lock my door because you (LE) do a pathetic job at keeping my house safe from burglars. As I keep repeating, next 911 will not come in form of six people stealing our planes, on our airports hitting our buildings; it will come from Chinese/other government hackers stealing our own data, neatly stored and organized in our NSA's locker-rooms. And that's why its a horror idea for anyone to have all information on entire nation, within one database (I know its bit more complicated than that). As the nation and most others based its order on organized information, you can imagine entire country on a full economical lockdown, once all your credit card, all your social security info and all your data leaks out to third parties/pirates. http://en.wikipedia.org/wiki/Nothing_to_hide_argument
讽刺：工具免费易得，大多数人却仍不加密邮件
然而我们中的许多人（包括技术极客）并不使用加密。总有借口：太麻烦、密码提示烦人、朋友不用、“不重要的事不值得”、“他们真想要总能拿到”。我们抱怨 NSA 监听，却懒得加密邮件，尽管工具就在眼前而且是免费的。Mac 用户可以用 GPGTools，真的没有借口。
jwr查看英文原文
…and yet so many of us (yes, even the tech geeks) do not use it. There's always a reason: it's too bothersome, we find the password prompts annoying, our friends don't use it, "it's not worth it for the unimportant stuff", "they'll get me anyway if they really want to". We complain about the NSA snooping, but we can't be bothered to properly encrypt our E-mail, even though the tools are right there, in front of us. For free. If you're on a Mac, use https://gpgtools.org — there is really no excuse, it's so simple and straightforward to use. I'm sure there are even easier solutions on Windows and Linux.
历次讨论
同类还值得读
非法素数
Illegal prime
维基百科条目，介绍“非法素数”：某些素数之所以被称为“非法”，是因为它们经特定编码后，恰好对应一段被法律禁止传播的数据——最著名的是 DVD 解密程序 DeCSS 的代码，有人把…
安全与隐私上首页 5 次 · 2010–2021en.wikipedia.org编辑精选关于 /dev/urandom 的常见误区
Myths about /dev/urandom
（Thomas Hühn 撰写，2014 年首发并持续更新）逐条反驳关于 /dev/urandom 的常见误解：它与 /dev/random 使用的是同一个 CSPRNG，一旦完…
安全与隐私上首页 5 次 · 2014–20202uo.de编辑精选AES 高级加密标准火柴人图解
A Stick Figure Guide to the Advanced Encryption Standard (AES)
一篇用火柴人漫画形式讲解 AES（高级加密标准）算法的经典科普文章。
安全与隐私上首页 5 次 · 2009–2022moserware.com编辑精选指纹是用户名，不是密码
Fingerprints are Usernames, not Passwords
作者（eCryptfs 维护者、Ubuntu 安全工程师）认为指纹等生物特征是公开、不可更改的标识，应视作用户名而非密码，不能当作秘密凭据用于认证。
安全与隐私上首页 4 次 · 2013–2017blog.dustinkirkland.comHTTPS 连接的最初几毫秒（2009）
The First Few Milliseconds of an HTTPS Connection (2009)
逐毫秒拆解一次 HTTPS 连接建立时发生了什么，重点讲 TLS 握手、证书验证、RSA 签名与密钥协商等机制，面向不熟悉该领域的读者。
安全与隐私上首页 4 次 · 2009–2020moserware.com编辑精选