Skip to content

User Privacy Protection Cheat Sheet / 用户隐私保护速查表

Introduction / 介绍

This OWASP Cheat Sheet introduces mitigation methods that web developers may utilize in order to protect their users from a vast array of potential threats and aggressions that might try to undermine their privacy and anonymity. This cheat sheet focuses on privacy and anonymity threats that users might face by using online services, especially in contexts such as social networking and communication platforms.

本OWASP速查表介绍了网络开发者可以利用的缓解方法，以保护他们的用户免受各种潜在威胁和攻击，这些威胁和攻击可能会破坏他们的隐私和匿名性。本速查表重点关注用户在使用在线服务时可能面临的隐私和匿名性威胁，尤其是在社交网络和通信平台等环境中。

Guidelines / 指南

Strong Cryptography / 强加密

Any online platform that handles user identities, private information or communications must be secured with the use of strong cryptography. User communications must be encrypted in transit and storage. User secrets such as passwords must also be protected using strong, collision-resistant hashing algorithms with increasing work factors, in order to greatly mitigate the risks of exposed credentials as well as proper integrity control.

任何处理用户身份、私人信息或通信的在线平台都必须使用强加密来确保安全。用户通信必须在传输和存储过程中进行加密。用户的秘密信息，如密码，也必须使用强碰撞抵抗的哈希算法和增加的工作因子进行保护，以极大地降低暴露凭证的风险以及确保适当的完整性控制。

To protect data in transit, developers must use and adhere to TLS/SSL best practices such as verified certificates, adequately protected private keys, usage of strong ciphers only, informative and clear warnings to users, as well as sufficient key lengths. Private data must be encrypted in storage using keys with sufficient lengths and under strict access conditions, both technical and procedural. User credentials must be hashed regardless of whether or not they are encrypted in storage.

为了保护传输中的数据，开发者必须使用并遵守TLS/SSL最佳实践，如验证证书、充分保护的私钥、仅使用强加密算法、向用户提供信息性和清晰的警告以及足够长的密钥长度。私有数据必须在存储时使用足够长度的密钥和严格的技术和程序访问条件进行加密。无论用户凭证是否在存储时加密，都必须对其进行哈希处理。

For detailed guides about strong cryptography and best practices, read the following OWASP references:

有关强加密和最佳实践的详细指南，请阅读以下OWASP参考：

  1. Cryptographic Storage Cheat Sheet （加密存储速查表）.
  2. Authentication Cheat Sheet （身份验证备忘单）.
  3. Transport Layer Security Cheat Sheet （传输层安全性速查表）.
  4. Guide to Cryptography) （密码学指南）.
  5. Testing for TLS/SSL.

Support HTTP Strict Transport Security / 支持HTTP严格传输安全

HTTP Strict Transport Security (HSTS) is an HTTP header set by the server indicating to the user agent that only secure (HTTPS) connections are accepted, prompting the user agent to change all insecure HTTP links to HTTPS, and forcing the compliant user agent to fail-safe by refusing any TLS/SSL connection that is not trusted by the user.

HTTP严格传输安全（HSTS）是服务器设置的一个HTTP头部，指示用户代理只接受安全（HTTPS）连接，提示用户代理将所有不安全的HTTP链接更改为HTTPS，并强制符合规定的用户代理通过拒绝用户不信任的任何TLS/SSL连接来启用安全模式。

HSTS has average support on popular user agents, such as Mozilla Firefox and Google Chrome. Nevertheless, it remains very useful for users who are in consistent fear of spying and Man in the Middle Attacks.

HSTS在流行的用户代理（如Mozilla Firefox和Google Chrome）上具有平均支持率。尽管如此，它对于持续担心间谍活动和中间人攻击的用户来说仍然非常有用。

If it is impractical to force HSTS on all users, web developers should at least give users the choice to enable it if they wish to make use of it.

如果无法强制所有用户使用HSTS，那么网站开发者至少应该允许用户选择是否启用它，以便他们可以使用它。

For more details regarding HSTS, please visit:

有关HSTS的更多详细信息，请访问：

  1. HTTP Strict Transport Security in Wikipedia) （维基百科中的HTTP严格传输安全）.
  2. IETF for HSTS RFC.
  3. OWASP Appsec Tutorial Series - Episode 4: Strict Transport Security) （OWASP Appsec教程系列 - 第四集：严格传输安全）.

Digital Certificate Pinning / 数字证书固定

Certificate Pinning is the practice of hardcoding or storing a predefined set of information (usually hashes) for digital certificates/public keys in the user agent (be it web browser, mobile app or browser plugin) such that only the predefined certificates/public keys are used for secure communication, and all others will fail, even if the user trusted (implicitly or explicitly) the other certificates/public keys.

证书固定是指将预定义的一组信息（通常是哈希值）硬编码或存储在用户代理（无论是网页浏览器、移动应用还是浏览器插件）中的做法，这样只有预定义的证书/公钥才会被用于安全通信，其他所有证书/公钥都将失败，即使用户信任（隐式或显式）了其他证书/公钥。

Some advantages for pinning are:

固定证书的一些优点包括：

  • In the event of a CA compromise, in which a compromised CA trusted by a user can issue certificates for any domain, allowing evil perpetrators to eavesdrop on users.
    中文：在CA被泄露的情况下，即用户信任的CA泄露后可以颁发任何域名的证书，允许恶意行为者监听用户通信。
  • In environments where users are forced to accept a potentially-malicious root CA, such as corporate environments or national PKI schemes.
    中文：在用户被迫接受可能恶意根CA的环境中，例如企业环境或国家PKI方案中。
  • In applications where the target demographic may not understand certificate warnings, and is likely to just allow any invalid certificate.
    中文：在目标受众可能不理解证书警告，并且可能会接受任何无效证书的应用程序中。

For details regarding certificate pinning, please refer to the following:

有关证书固定的详细信息，请参阅以下内容：

  1. OWASP Certificate Pinning Cheat Sheet （OWASP证书固定速查表）.
  2. Public Key Pinning Extension for HTTP RFC) （HTTP的公钥固定扩展RFC）.
  3. Securing the SSL channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs, by Tobias Gondrom) （保护SSL通道免受中间人攻击：未来技术 - HTTP严格传输安全和证书固定，由Tobias Gondrom撰写）.

Panic Modes / 恐慌模式

A panic mode is a mode that threatened users can refer to when they fall under direct threat to disclose account credentials.

恐慌模式是一种当用户直接面临泄露账户凭证威胁时可以参考的模式。

Giving users the ability to create a panic mode can help them survive these threats, especially in tumultuous regions around the world. Unfortunately many users around the world are subject to types of threats that most web developers do not know of or take into account.

赋予用户创建恐慌模式的能力可以帮助他们应对这些威胁，尤其是在全球动荡的地区。遗憾的是，全球许多用户都面临着大多数网络开发者不知道或未考虑到的威胁类型。

Examples of panic modes are modes where distressed users can delete their data upon threat, log into fake inboxes/accounts/systems, or invoke triggers to backup/upload/hide sensitive data.

恐慌模式的例子包括，当用户感到压力时，可以删除他们的数据、登录到虚假的邮箱/账户/系统，或者触发备份/上传/隐藏敏感数据的操作。

The appropriate panic mode to implement differs depending on the application type. A disk encryption software such as VeraCrypt might implement a panic mode that starts up a fake system partition if the user entered their distressed password.

要实施的恐慌模式取决于应用程序类型。例如，VeraCrypt这样的磁盘加密软件可能会在用户输入压力密码时启动一个虚假的系统分区作为恐慌模式。

Email providers might implement a panic mode that hides predefined sensitive emails or contacts, allowing reading innocent email messages only, usually as defined by the user, while preventing the panic mode from overtaking the actual account.

电子邮件提供商可能会实施一种恐慌模式，隐藏预定义的敏感电子邮件或联系人，只允许阅读无辜的电子邮件消息，通常由用户定义，同时防止恐慌模式接管实际账户。

An important note about panic modes is that they must not be easily discoverable, if at all. An adversary inside a victim's panic mode must not have any way, or as few possibilities as possible, of finding out the truth. This means that once inside a panic mode, most non-sensitive normal operations must be allowed to continue (such as sending or receiving email), and that further panic modes must be possible to create from inside the original panic mode (If the adversary tried to create a panic mode on a victim's panic mode and failed, the adversary would know they were already inside a panic mode, and might attempt to hurt the victim).

关于恐慌模式的一个重要注意事项是，它们必须不易被发现，如果可能的话。受害者的恐慌模式内部，对手必须没有找到真相的任何方式，或者尽可能少的方式。这意味着一旦进入恐慌模式，大多数非敏感的正常操作必须允许继续进行（如发送或接收电子邮件），并且必须从原始恐慌模式内部创建进一步的恐慌模式（如果对手试图在受害者的恐慌模式上创建恐慌模式并失败，对手就会知道他们已经处于恐慌模式内部，并可能试图伤害受害者）。

Another solution would be to prevent panic modes from being generated from the user account, and instead making it a bit harder to spoof by adversaries. For example it could be only created Out Of Band, and adversaries must have no way to know a panic mode already exists for that particular account.

另一个解决方案是防止从用户账户生成恐慌模式，而是使其对对手来说更难伪造。例如，它可能只能通过非绑定方式创建，并且对手必须没有知道该特定账户已经存在恐慌模式的方式。

The implementation of a panic mode must always aim to confuse adversaries and prevent them from reaching the actual accounts/sensitive data of the victim, as well as prevent the discovery of any existing panic modes for a particular account.

恐慌模式的实现必须始终旨在迷惑对手，防止他们到达受害者的实际账户/敏感数据，以及防止发现特定账户的任何现有恐慌模式。

For more details regarding VeraCrypt's hidden operating system mode, please refer to:

有关VeraCrypt隐藏操作系统模式的更多详细信息，请参阅：

Remote Session Invalidation / 远程会话失效

In case user equipment is lost, stolen or confiscated, or under suspicion of cookie theft; it might be very beneficial for users to able to see view their current online sessions and disconnect/invalidate any suspicious lingering sessions, especially ones that belong to stolen or confiscated devices. Remote session invalidation can also helps if a user suspects that their session details were stolen in a Man-in-the-Middle attack.

如果用户设备丢失、被盗或被没收，或者在怀疑cookie被盗的情况下；用户能够查看当前在线会话并断开/使任何可疑的持续会话失效，特别是属于被盗或被没收设备的会话，可能会非常有用。如果用户怀疑他们的会话详情在中间人攻击中被窃取，远程会话失效也可能有所帮助。

For details regarding session management, please refer to:

有关会话管理的详细信息，请参阅：

Allow Connections from Anonymity Networks / 允许匿名网络连接

Anonymity networks, such as the Tor Project, give users in tumultuous regions around the world a golden chance to escape surveillance, access information or break censorship barriers. More often than not, activists in troubled regions use such networks to report injustice or send uncensored information to the rest of the world, especially mediums such as social networks, media streaming websites and email providers.

匿名网络，如Tor项目，为全球动荡地区的用户提供了一个逃离监控、获取信息或突破审查障碍的绝佳机会。很多时候，麻烦地区的活动家使用这样的网络来报告不公或向世界其他地方发送未审查的信息，特别是社交媒体、媒体流网站和电子邮件提供商等媒介。

Web developers and network administrators must pursue every avenue to enable users to access services from behind such networks, and any policy made against such anonymity networks need to be carefully re-evaluated with respect to impact on people around the world.

网络开发人员和网络管理员必须竭尽全力，使用户能够从这些网络中访问服务，并且针对此类匿名网络的任何政策都需要仔细重新评估其对全球各地人民的影响。

If possible, application developers should try to integrate or enable easy coupling of their applications with these anonymity networks, such as supporting SOCKS proxies or integration libraries (e.g. OnionKit for Android).

如果可能的话，应用开发者应尝试集成或启用与这些匿名网络的简单耦合，例如支持SOCKS代理或集成库（例如Android的OnionKit）。

For more information about anonymity networks, and the user protections they provide, please refer to:

有关匿名网络及其提供用户保护的信息，请参阅：

  1. The Tor Project) （Tor项目）.
  2. I2P Network) （I2P网络）.
  3. OnionKit: Boost Network Security and Encryption in your Android Apps) （OnionKit：增强Android应用中的网络安全和加密）.

Prevent IP Address Leakage / 防止IP地址泄露

Preventing leakage of user IP addresses is of great significance when user protection is in scope. Any application that hosts external third-party content, such as avatars, signatures or photo attachments; must take into account the benefits of allowing users to block third-party content from being loaded in the application page.

在用户保护范围内，防止用户IP地址泄露具有重要意义。任何托管外部第三方内容的应用程序，如头像、签名或照片附件；必须考虑允许用户阻止第三方内容在应用程序页面中加载的好处。

If it was possible to embed third-party, external domain images, for example, in a user's feed or timeline; an adversary might use it to discover a victim's real IP address by hosting it on their domain and watch for HTTP requests for that image.

如果可以嵌入第三方、外部域名的图片，例如，在用户的动态或时间轴中；攻击者可能会通过在其域上托管它并监视对该图片的HTTP请求来发现受害者的真实IP地址。

Many web applications need user content to operate, and this is completely acceptable as a business process; however web developers are advised to consider giving users the option of blocking external content as a precaution. This applies mainly to social networks and forums, but can also apply to web-based email, where images can be embedded in HTML-formatted emails.

许多Web应用程序需要用户内容才能运行，这完全是一个正常的业务流程；然而，建议Web开发人员考虑给用户提供阻止外部内容的选项作为预防措施。这主要适用于社交网络和论坛，但也可能适用于基于Web的电子邮件，其中图片可以嵌入到HTML格式的电子邮件中。

A similar issue exists in HTML-formatted emails that contain third-party images, however most email clients and providers block loading of third-party content by default; giving users better privacy and anonymity protection.

在包含第三方图片的HTML格式电子邮件中也存在类似问题，然而，大多数电子邮件客户端和服务提供商默认阻止加载第三方内容；这为用户提供更好的隐私和匿名保护。

Honesty & Transparency / 诚信与透明度

If the web application cannot provide enough legal or political protections to the user, or if the web application cannot prevent misuse or disclosure of sensitive information such as logs, the truth must be told to the users in a clear understandable form, so that users can make an educated choice about whether or not they should use that particular service.

如果网络应用无法为用户提供足够的法律或政治保护，或者无法防止对日志等敏感信息的滥用或泄露，那么必须以清晰易懂的形式向用户告知真相，以便用户可以做出是否使用该特定服务的明智选择。

If it doesn't violate the law, inform users if their information is being requested for removal or investigation by external entities.

如果这不违反法律，应通知用户他们的信息是否被外部实体请求删除或调查。

Honesty goes a long way towards cultivating a culture of trust between a web application and its users, and it allows many users around the world to weigh their options carefully, preventing harm to users in various contrasting regions around the world.

诚信对于在网站应用和用户之间培养信任文化大有裨益，并允许全球许多用户仔细权衡他们的选择，防止世界各地不同地区的用户受到伤害。

More insight regarding secure logging can be found at:

有关安全日志的更多信息可以在以下链接找到：

References / 参考