安全与隐私noncombatant.org
安全下载软件几乎不可能
Downloading Software Safely Is Nearly Impossible
2014 — 2015，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
作者指出在 Windows 上安全地下载 PuTTY 这类常用软件几乎不可能：官网域名易混淆、搜索引擎充斥仿冒站点、二进制缺乏代码签名，普通用户极易被诱导下载被植入恶意代码的版本。文章由此引出对软件分发信任链的更广泛讨论。
为什么经久不衰：软件分发信任链问题至今仍未彻底解决，这篇文章对理解供应链安全和普通用户面临的困境依然有启发。
HN 评论精选
以真实技术支持案例说明普通 Windows 用户几乎必然中招仿冒下载站
问题比这篇刻意构造的'无法安全下载 PuTTY'严重得多。举个我技术支持工作中的例子：目标是'下载 Firefox'。用户用的是 IE，而且不识字（看不懂屏幕上的字）。他的电脑早已被 Conduit 等间谍软件和垃圾软件感染。用户没有按我的指示在地址栏输入 https://www.mozilla.org，而是去'搜索'firefox，结果进了 softonic 的仿冒下载页。softonic 的安装器到处装垃圾软件，最后用户在让他逐个阅读已安装程序卸载列表时烦躁地挂断了电话。这就是大多数 Windows 用户面临的危险。
kefka查看英文原文
The problem is much worse than this contrived 'I cant download PuTTY securely'. Lets choose an example, of which I have had my hands in with my tech support job. * Goal: "Download Firefox" First, the user was using IE. And the user is not a tech savvy user (as in, cannot read words on the screen). Turns out, the user's computer was infested with spyware and garbageware. Mainly Conduit and others. Evidently, user "searched" for firefox rather than follow my directions to type in the address bar https://www.mozilla.org . This behavior lead him here: http://firefox.en.softonic.com/ Normally, I would use a remote support tool and just do the cleaning for the user. However, this client comes from another area in which we are not allowed to use the remote support tool. In the end, I tried to have user uninstall the bad-firefox, and attempt to install the good, but the softonic installer installs a ton of crap everywhere. User got very frustrated and hung up when having him read the uninstall programs installed list. * That is the danger to most users, running Windows. EDIT: For the user whom penalized my comment score, why?
Linux 发行版的打包流程同样存在信任链漏洞，并非 Windows 独有问题
如果你觉得自己是安全的：Linux 也一样。是的，好的发行版会对二进制签名，你也可以用内置工具验证。但想想发行版是如何生成这些签名二进制的：1) 打包者从网上随机下载 tarball，常常走 HTTP 且未签名未验证；2) 打包者把同一个 tarball 上传到发行版构建系统（你信任他们，对吧？）；3) 打包者的构建脚本在构建服务器上执行（你信任所有打包者吗？安装包时他们对你的机器有隐式 root 权限）；4) 脚本很可能调用 ./configure 之类，此时下载的源码就有了任意代码执行权限——你验证过吗？我不是在为 WebCrypto 辩护，我自己就是 Linux 用户和打包者，只是很清楚要攻陷整个发行版的用户有多容易。
throwaway812查看英文原文
If you think you're safe: it's the same thing with Linux. Yes, good distros sign their blobs and you can probably verify that with builtin tools. However, consider how distros generate their signed binaries: 1) A packager downloads a random tarball off the internet, often over HTTP and/or unsigned and unverified. 2) The packager uploads the same tarball to the distro build system (you trust them, right?) 3) The packager's script for building the program or library is executed by the build server (you trust all of the packagers, right? they have implicit root access to your machine during pkg install.) 4) The packager's script likely invokes `./configure` or similar. Now even if you trust the packager, the downloaded source has arbitrary code execution. You verified it, right??? (Not trying to advocate for webcrypto. And I'm a Linux user. But I'm also a packager, and I have some awareness as to how one would go about pwning all users of my distro.)
实测表明 Windows 8.1 的 SmartScreen 按哈希/签名识别 PuTTY，篡改版会被拦截
看起来 Windows 8.1 是按哈希或签名对 PuTTY 做了白名单：这里没什么可看的。复现步骤（Windows 8.1，桌面版 IE 11 或 Chrome 33）：1. 从任何可疑来源下载 putty.exe；2. PuTTY 直接运行无提示；3. 上传到 mega.co.nz（极其可疑的来源）再下载回来，照样无提示运行；4. 用十六进制编辑器改一个字节，再上传下载后运行，就会看到全屏红色横幅'Windows 保护了你的电脑'，要求管理员密码才能运行这个可疑二进制。
bcoates查看英文原文
It looks like Windows 8.1 is whitelisting PuTTY by hash or signature: nothing to see here. Repro steps (Windows 8.1, desktop IE 11 or Chrome 33): 1. Download putty.exe from any shady source 2. PuTTY runs without prompting 3. go to mega.co.nz (an extremely shady source), upload your copy of putty.exe 4. download it again 5. this version of putty.exe also runs without prompting 6. open your hex editor of choice, change a byte in a text string 7. upload this tampered version of putty.exe to mega.co.nz 8. download and run it 9. observe full-screen modal red banner: "Windows Protected Your Computer" requesting an Administrator password to run suspicious binaries.
连安全意识强的用户也会被 putty.org 误导，PGP 信任链是比 HTTPS 更可靠的方案
读文章之前我本想仅凭标题写一篇反驳——结果我错了，尤其是因为我自己在玩 Windows 机器时一直从 putty.org 下载 PuTTY，从没想过 putty.org 不是官方来源。我是个非常注重安全的用户，连我都保护不了自己，普通用户更没戏。补充一点：PGP 签名让 HTTPS 对下载二进制本身失去意义，它靠的是信任链，问题在于公钥的分发。公钥必须通过 HTTPS 和/或公钥服务器分发，让其他用户数字签名你的证书来背书——这套体系对 Debian 这类开发者互相认识的流行软件仓库很有效。一旦公钥真实性确立，攻击者除非拿到私钥（比黑掉 web 服务器难得多），否则无法伪造签名二进制。
bad_user查看英文原文
Before reading the article, I wanted to write a rant on why the TFA is wrong, based solely on the title :-) ALAS, I was wrong, especially because I downloaded Putty myself from putty.org, whenever I happened to play with Windows machines, without thinking once that putty.org is not the official source. And I'm a very security conscious user and if I can't protect myself, then normal users don't stand a chance. Just a note - PGP signing renders HTTPS useless for downloading the binaries themselves and works by establishing a chain of trust, the problem is with distributing the public key. It's the public key that must be distributed either over HTTPS and/or through a public key server, letting other users digitally sign your certificate and thus endorse the association of this public key - a system that works great for popular repositories of software (e.g. Debian), in which the participating developers/maintainers know each other. Once the authenticity of the public key is correctly established, there's no way for an attacker to create/forge the signed binary, unless said attacker gets ahold of the private key, which is way more difficult than hacking a web server, as normally private keys don't end up on those servers (so it is more secure than HTTPS). For example, in Ubuntu if you're willing to install packages from PPAs of third-parties, you first need to indicate that you trust the public key with which those packages were signed, otherwise apt-get will refuse to install said packages. A reasonable alternative to PGP signing is S/MIME signing, which is more user-friendly, as it doesn't involve the users vetting scheme, but rather certificates are issued by a certificate authority, just like with HTTPS/SSL. S/MIME is weaker against the NSA, but it does work well for signing stuff and it's more user friendly, because to establish trust, you only have to trust the certificate authority (and of course the developer). Binaries on OS X are also distributed as signed with the developer's key and OS X refuses to install unsigned binaries or binaries signed by unknown developers, unless you force it to. And while I have mixed feelings about the App Store direction in which Apple is taking OS X, I've began to like this restriction, in spite of the money you have to pay yearly to register as a developer (as long as you can download signed binaries straight from the Internet and thus not completely locked into Apple's walled garden, it's all good). Signing binaries and having a user-friendly way to establish trust in the used signing key should be the norm in all operating systems.
PuTTY 作者不重视可追溯分发，社区应自建可信替代下载渠道
这有点傻了，Chris :) PuTTY 是 MIT 许可的。PuTTY 的主要作者对可追溯代码不上心，这很遗憾，因为正如你文章所暗示的，PuTTY 正是可追溯代码的典型案例——它确实是隐蔽替换攻击的一个真实且有利可图的目标。显然，世界不能指望 PuTTY 的作者提供可追溯的下载，需要有人站出来：建一个 HTTPS 站点、固定证书、获得你和 EFF 等人的 PGP 签名背书——鉴于 PuTTY 的 SEO 很糟糕，很容易在 Google 搜索结果里排到第一，提供可靠可追溯的替代下载。这和 WebCrypto 有什么关系我就不懂了。
tptacek查看英文原文
This is silly, Chris. :) PuTTY is MIT licensed. The primary author of PuTTY is unserious about traceable code, which is a shame, because as your essay implies, PuTTY is one of the motivating cases for traceable code. It's an actual lucrative real-world target for surreptitious replacement. Clearly, the world cannot rely on PuTTY's author to provide a traceable download. Someone else needs to step in and do that. That person can set up an HTTPS site, arrange to have their certificates pinned, get PGP-signed endorsements from people like you, the EFF, whatever, and --- given how awful PuTTY's SEO mojo is, easily take the top of the Google SERP for PuTTY with a reliable, traceable alternative. What any of this has to do with WebCrypto is beyond me.
代码签名证书定价过高是 PuTTY 未签名分发的根源，CA 行业需要变革
如果 putty.exe 有代码签名，这一切都不会发生。可惜它没有。代码签名证书贵得离谱，我能找到的最便宜的 CA 报价是每年 73 美元（至少签 3 年）。我可以长篇大论 CA 们如何串通、如何通过定价让所有人更不安全，但那是多余的。Let's Encrypt 值得欢迎，但它不提供代码签名、通配符证书等。整个证书/CA 行业需要变革，Let's Encrypt 远远不够。我主要怪微软、Mozilla 和苹果，因为是它们决定谁有资格当 CA，本可以允许非营利组织和颠覆性初创公司进入这个领域。
Someone1234查看英文原文
None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not. Code signing certificates are insanely expensive. The cheapest one I could find from a CA was $73/year (3 year minimum). I could go on a long rant now about how much CAs are in collusion and how they're making everyone more insecure though their pricing, but that would be redundant as I think "everyone knows that" by now. Let's Encrypt are welcome (when they arrive), but they still don't offer Code Signing, Wildcard Certificates, and so on. The whole certificate/CA industry needs change, Let's Encrypt doesn't go nearly far enough. I blame Microsoft, Mozilla, and Apple primarily as they decide who gets to be a CA, and could allow non-profits and other disruptive startups into the space if they wished.
文章本质是对 PuTTY 分发不透明的合理批评
这其实只是对 PuTTY 分发之糟糕的抱怨（还隐约暗示它可能是某种恶意软件）。我认为这个批评是成立的，我希望 PuTTY（一个 Windows SSH 客户端）的作者能更开放、更透明，但很难把这一点强加于人。
c22查看英文原文
This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. No md5sum, no authenticated package management, no native ssh client. Being concerned about privacy and security and running Windows may be mutually incompatible.
Windows 缺乏验证信任链的原生工具，是其安全困境的根源
这真正凸显的是：Windows 没有内置任何建立可信验证链的工具。没有 md5sum，没有经过认证的包管理，没有原生 ssh 客户端。关心隐私和安全却运行 Windows，可能是互不相容的。
c22查看英文原文
This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. No md5sum, no authenticated package management, no native ssh client. Being concerned about privacy and security and running Windows may be mutually incompatible.
历次讨论
同类还值得读
非法素数
Illegal prime
维基百科条目，介绍“非法素数”：某些素数之所以被称为“非法”，是因为它们经特定编码后，恰好对应一段被法律禁止传播的数据——最著名的是 DVD 解密程序 DeCSS 的代码，有人把…
安全与隐私上首页 5 次 · 2010–2021en.wikipedia.org编辑精选关于 /dev/urandom 的常见误区
Myths about /dev/urandom
（Thomas Hühn 撰写，2014 年首发并持续更新）逐条反驳关于 /dev/urandom 的常见误解：它与 /dev/random 使用的是同一个 CSPRNG，一旦完…
安全与隐私上首页 5 次 · 2014–20202uo.de编辑精选AES 高级加密标准火柴人图解
A Stick Figure Guide to the Advanced Encryption Standard (AES)
一篇用火柴人漫画形式讲解 AES（高级加密标准）算法的经典科普文章。
安全与隐私上首页 5 次 · 2009–2022moserware.com编辑精选指纹是用户名，不是密码
Fingerprints are Usernames, not Passwords
作者（eCryptfs 维护者、Ubuntu 安全工程师）认为指纹等生物特征是公开、不可更改的标识，应视作用户名而非密码，不能当作秘密凭据用于认证。
安全与隐私上首页 4 次 · 2013–2017blog.dustinkirkland.comHTTPS 连接的最初几毫秒（2009）
The First Few Milliseconds of an HTTPS Connection (2009)
逐毫秒拆解一次 HTTPS 连接建立时发生了什么，重点讲 TLS 握手、证书验证、RSA 签名与密钥协商等机制，面向不熟悉该领域的读者。
安全与隐私上首页 4 次 · 2009–2020moserware.com编辑精选