安全与密码学2015arxiv.org
为什么 Johnny 仍然无法加密：评估现代 PGP 客户端的可用性
Why Johnny Still Can't Encrypt: Evaluating the Usability of a Modern PGP Client
进阶 · 约 35 分钟读完前置知识：PGP/公钥加密基础、可用性测试方法、电子邮件安全
导读
论文评估一款现代 PGP 客户端的可用性，探讨为何普通用户仍然难以正确使用 PGP 加密。它延续“Why Johnny Can’t Encrypt”的问题，关注界面和操作流程能否让非专家安全地完成密钥管理与加解密；从标题看，核心结论是可用性仍是 PGP 普及的关键障碍。
HN 关注点：加密工具为何长期难用，以及可用性、元数据泄露和便利性之间的现实权衡。
HN 评论精选
这几条评论里：支持 1 质疑 1 补充 2
补充PGP 的向后兼容和元数据暴露是根本局限，需要新协议，但迁移和 adoption 极难。
向后兼容是致命问题。PGP 的设计目标是给邮件加一个“信封”，同时兼容现有服务器和邮件客户端。斯诺登事件最大的启示之一是元数据的重要性：仅知道谁在何时与谁通信，就常常足以危及当事人。你现在做的事可能合法，但无法预知何时某个专制者上台把它定为非法；数据可能存续一生，必须考虑这一点。因此需要能限制元数据暴露的新邮件传输协议，比如 Dark Mail；我不认为 Signal 隐藏了元数据。但 Dark Mail 需要开发、安全审查和 adoption，还要新服务器与新客户端，Windows 的普及就说明这有多难；如今任何新消息程序还得有 Web 和移动端方案。实践中有人说过，人们隐私的最大改善其实是 Gmail：客户端通过 Google 控制的 SSL 证书连接，Google 推广两步验证和访问令牌，其法律团队会挑战传票；只要不泄露国家安全机密，我认为在更好系统出现前这已够用。
Decade查看英文原文
Backwards compatibility is the killer. The whole design of PGP is to be the envelope to make email private, versus the plaintext postcard that everybody can read. It works with existing servers and existing mail clients. The biggest Snowden revelation is the importance of metadata. Just knowing whom you talk to, when, is frequently enough to compromise the parties involved. You might be doing something legal now, but you can’t tell when some despot takes over and makes your activity illegal. When data can potentially last your lifetime, you need to consider this sort of thing. Illustration: Using Metadata to find Paul Revere. [1] So, we need a new mail transmission protocol that limits the amount of metadata that can be seen. Something like Dark Mail [2]. I don’t think Open Whisper Signal hides the metadata. The problem is that Dark Mail needs to be developed and its security reviewed, and people need to adopt it. It needs new servers and clients, and the prevalence of Windows shows just how difficult that problem is. Also, any new messaging program these days needs a story about web and mobile. In practice, I heard someone say that the biggest improvement in people’s privacy has been use of Gmail. The clients connect to it with SSL certificates controlled by Google; Google promotes 2-factor authentication and access tokens; and Google’s legal team challenges subpoenas. As long as you are not leaking national security secrets, I think this is adequate until a better system is deployed. [1] http://kieranhealy.org/blog/archives/2013/06/09/using-metadata-to-find-paul-revere/ [2] https://darkmail.info
支持可用性应被视为安全特性；没人用的“完美安全”工具无法提升实际安全。
我这样理解：可用性本身可以是一种安全特性。如果你做出“完全安全”的软件，但使用它需要很高技能，用户就会改用更容易但更不安全的东西，那这个意识形态上完美的软件又如何改善了他们的安全？如果为可用性做权衡，你会提高实际安全基线，因为人们真的会用你做的产品。
squidlogic查看英文原文
I think of it like this: usability can be a security feature. If you build a "perfectly secure" piece of software, but it takes a very high level of skill to use it, your users will use something else that is easier to use, but less secure. And then how has your ideologically perfect piece of software helped improve their security? If you make tradeoffs for usability, you will raise the bar because people will actually use what you make.
补充大众采用的两大障碍是密钥抽象不直观，以及多数人不愿为安全牺牲便利。
我认为任何需要 UI 的加密系统要大规模普及都有两大障碍。第一是抽象。对非专家而言，PKI 唯一行得通的隐喻是物理安全。必须把“密钥”是一串字符或一个文件、需要被保护的概念，替换成用户能像保护钥匙或钱包那样理解的抽象。只要“密钥”看起来仍像一个超长密码，人们就会继续按密码对待它，并带上各种糟糕实践；此外还有大量普通人密钥安全问题。我不知道答案，但某种物理令牌是正确起点。第二，归根结底绝大多数人并不关心更好安全与便利之间的权衡。学习曲线再平缓也存在，真正想要或需要更好安全的人有足够动力去学；对其他人来说，这像可选作业。我还要补充：我认识的大多数关心安全的人都能熟练使用大量 API 和软件做各种密码学操作；在我看来门槛其实早已相当低。
jordanpg查看英文原文
I see two major barriers to mass adoption of any crypto system that requires a UI. 1. Abstraction. For the non-expert, the only metaphor that works for PKI is that of physical security. The concept of a "key" as a series of characters or a file that must be protected must be replaced by an abstraction that allows users to protect it in the same way they understand how to protect a key or a wallet. So long as the "key" continues to appear to be an enormous password, people will continue to treat it that way, along with all the crazy worst-practices in the world. Not to mention the huge host of problems that accompanies key security for the layman. I don't know what the answer is, but I do think that a physical token of some sort is the right start. 2. At the end of the day, the vast majority of people are not interested in the trade off between better security and convenience. There is a learning curve, however shallow it can be made, and those that genuinely want or need better security are motivated enough to do the learning. For everyone else, it's like optional homework. I would add to this that most everyone I know who cares about security is quite comfortable with a large array of APIs and software to do all sorts of cryptographic gymnastics. The bar is quite low already -- it has been for some time, IMO.
质疑真正安全的加密与便利服务存在根本冲突，主流采用需要全新范式。
真正安全的加密现在不会、将来也不会对用户友好，因为它意味着只有你知道私钥。这意味着没有“忘记密码”功能，没有强大的云端 AI 分析你的数据并推荐酷东西，没有免费的托管全文搜索，没有可搜索的好友公开目录等等。基本上就没有 Gmail、iCloud、Facebook、Dropbox 这类东西。那需要全新范式；以太坊和比特币等有趣技术并不友好，对普通用户也难以规模化，比如下载整个区块链对多数人不可行。更重要的是，现有方案太便利、运行得太好（多数人不在乎隐私和安全问题）。所以需要一种不仅远优于现有方案、更高效更智能，而且安全且去中心化的技术。短期内不会发生，但希望并非不可能。
patrickaljord查看英文原文
Real secure encryption is and always will be not user friendly because it means only you can know the private key. This means no "Forgot my password" functionalities, no fancy powerful cloud AI analyzing your data and suggesting cool stuff, no free hosted full text search of your data, no open directory of friends to search on etc. So basically, no gmail, icloud, facebook, dropbox etc. It would require a complete new paradigm, sure there are interesting techs such as ethereum and bitcoin but they are not user friendly, and don't scale much to the regular user (downloading the whole blockchain is a no-no to most people for example) but most importantly, current solutions are too convenient and work really well (bar privacy and security issues most don't care about). So you'd need a tech that not only is way better, more efficient and smarter than current ones (gmail, google, facebook, icloud etc) but also secure and decentralized. Not happening any time soon but hopefully not impossible either.
相关资源
从这篇论文所有 HN 讨论帖的全部评论里整理出来的链接。
历次讨论
- 2015Hacker News 讨论帖259 分 · 160 评
同领域还值得读
如何入侵一台已关机的电脑：在 Intel ME 中运行未签名代码
How to hack a turned-off computer, or running unsigned code in Intel ME
这篇 Black Hat 2017 白皮书讨论 Intel Management Engine（ME）的安全问题：如何在 ME 中运行未签名代码，以及攻破处于关机状态的电脑的相关…
安全与密码学2017 · 543 分 · 107 评专业 · 约 40 分钟编辑精选比特币：一种点对点的电子现金系统（2008）
Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
中本聪 2008 年发表的比特币白皮书，提出了无需可信第三方的点对点电子现金系统。
安全与密码学2017 · 536 分 · 394 评入门 · 约 45 分钟编辑精选GPRS 加密算法 GEA-1 的密码分析表明存在故意弱点
Cryptanalysis of GPRS Encryption Algorithms GEA-1 suggest intentional weakness
首次公开了对 GPRS 加密算法 GEA-1 和 GEA-2 的密码分析攻击。
安全与密码学2021 · 487 分 · 107 评专业 · 约 90 分钟编辑精选Signal 消息协议的形式化安全分析
A Formal Security Analysis of the Signal Messaging Protocol
用形式化方法分析 Signal 消息协议（TextSecure）的安全性：作者在多阶段密钥交换模型下，借助自动化证明工具对协议的密钥协商与 Double Ratchet 密钥更新…
安全与密码学2016 · 353 分 · 230 评专业 · 约 120 分钟编辑精选A2：模拟恶意硬件
A2: Analog Malicious Hardware
论文研究如何在芯片设计阶段植入模拟电路形式的恶意硬件后门，使其难以被常规检测发现。
安全与密码学2016 · 315 分 · 94 评专业 · 约 75 分钟编辑精选