{"topic":{"id":4818,"title":"搜狗输入法被曝严重加密漏洞：用户隐私和数据面临巨大风险","slug":"topic","categoryId":4,"createdAt":"2023-08-11 10:37:35.415801","bumpedAt":"2023-09-09 08:34:24.566805","views":515,"postsCount":9,"highestPostNumber":9,"likeCount":0,"closed":false,"pinned":false,"pinnedGlobally":false,"pinnedAt":null,"pinnedUntil":null,"isBanner":false,"excerpt":"搜狗记录了用户几乎所有的键盘操作，然后发送到云端，选用的是 HTTP 非加密端口，而不是 HTTPS。其使用私有的、非标准加密方式，等同于用户的所有键盘操作都在网络上明文传输。 https://citizenlab.ca/2023/08/vulnerabilities-in-sogou-keyboard-encryption/ 以下是 AI Summary: 内容总结：Citizen Lab 对腾讯的搜狗输入法进行了详细的技术分析，发现…","deletedAt":null,"isAnonymous":false,"category":{"id":4,"name":"谈笑风生","slug":"general","color":"25AAE2"},"author":{"id":1047,"username":"anonymous_coward_old","name":"Anonymous Coward Old","avatarUrl":"/uploads/image/43/32/4332638c11248b8ff07033c11de0759a55205facfbec85e14458245a91991faf.avif"},"tags":[]},"posts":[{"id":9036,"postNumber":1,"raw":"搜狗记录了用户几乎所有的键盘操作，然后发送到云端，选用的是 HTTP 非加密端口，而不是 HTTPS。其使用私有的、非标准加密方式，等同于用户的所有键盘操作都在网络上明文传输。\n\nhttps://citizenlab.ca/2023/08/vulnerabilities-in-sogou-keyboard-encryption/\n\n以下是 AI Summary:\n\n内容总结：Citizen Lab 对腾讯的搜狗输入法进行了详细的技术分析，发现其自定义的“EncryptWall”加密系统存在严重的安全缺陷。这些缺陷可能使攻击者能够解密用户的敏感数据，从而对用户的隐私和安全构成威胁。\n\n技术细节：\n\n自定义加密的问题：搜狗输入法使用了一个名为“EncryptWall”的自定义加密系统。而历史上，自定义加密往往比经过时间检验的标准加密方法更容易出现漏洞。\n\n数据传输暴露：由于“EncryptWall”的加密缺陷，所有通过搜狗输入法发送的数据，包括用户的按键输入，都可能在网络传输中被解密。\n \n敏感信息泄露：这意味着用户的私人对话、密码、支付信息等都可能被窃取。对于那些使用搜狗输入法进行在线购物或银行交易的用户，这种风险尤为严重。\n\n尽管搜狗在得知这些漏洞后迅速发布了修复版本，但这一事件强调了软件开发中使用经过广泛验证的标准加密方法的重要性，以及对用户隐私和数据的尊重和保护的必要性。","cooked":"

搜狗记录了用户几乎所有的键盘操作，然后发送到云端，选用的是 HTTP 非加密端口，而不是 HTTPS。其使用私有的、非标准加密方式，等同于用户的所有键盘操作都在网络上明文传输。

\n\n

以下是 AI Summary:

内容总结：Citizen Lab 对腾讯的搜狗输入法进行了详细的技术分析，发现其自定义的“EncryptWall”加密系统存在严重的安全缺陷。这些缺陷可能使攻击者能够解密用户的敏感数据，从而对用户的隐私和安全构成威胁。

技术细节：

自定义加密的问题：搜狗输入法使用了一个名为“EncryptWall”的自定义加密系统。而历史上，自定义加密往往比经过时间检验的标准加密方法更容易出现漏洞。

数据传输暴露：由于“EncryptWall”的加密缺陷，所有通过搜狗输入法发送的数据，包括用户的按键输入，都可能在网络传输中被解密。

敏感信息泄露：这意味着用户的私人对话、密码、支付信息等都可能被窃取。对于那些使用搜狗输入法进行在线购物或银行交易的用户，这种风险尤为严重。

尽管搜狗在得知这些漏洞后迅速发布了修复版本，但这一事件强调了软件开发中使用经过广泛验证的标准加密方法的重要性，以及对用户隐私和数据的尊重和保护的必要性。

\n","createdAt":"2023-08-11 10:37:35.571195","updatedAt":"2023-08-11 14:23:27.320657","replyToPostNumber":null,"replyCount":0,"likeCount":0,"wordCount":438,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":2,"publicVersion":2,"deletedAt":null,"isAnonymous":false,"user":{"id":1047,"username":"anonymous_coward_old","name":"Anonymous Coward Old","avatarUrl":"/uploads/image/43/32/4332638c11248b8ff07033c11de0759a55205facfbec85e14458245a91991faf.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":9039,"postNumber":2,"raw":"中国人用的输入法\r\n活该","cooked":"

中国人用的输入法
\n活该

\n","createdAt":"2023-08-11 11:15:08.06028","updatedAt":"2023-08-11 11:15:08.06028","replyToPostNumber":null,"replyCount":0,"likeCount":0,"wordCount":10,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":1047,"username":"anonymous_coward_old","name":"Anonymous Coward Old","avatarUrl":"/uploads/image/43/32/4332638c11248b8ff07033c11de0759a55205facfbec85e14458245a91991faf.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":9040,"postNumber":3,"raw":"一般都用微软自带的输入法，只能希望微软不在乎我这点数据 (可能也有云端联想，Ubuntu 也用原生的。小米的输入法搞了个隐私模式，不知道有没有用","cooked":"

一般都用微软自带的输入法，只能希望微软不在乎我这点数据 (可能也有云端联想，Ubuntu 也用原生的。小米的输入法搞了个隐私模式，不知道有没有用

\n","createdAt":"2023-08-11 11:30:03.485952","updatedAt":"2023-08-11 11:30:03.485952","replyToPostNumber":null,"replyCount":0,"likeCount":0,"wordCount":64,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":1047,"username":"anonymous_coward_old","name":"Anonymous Coward Old","avatarUrl":"/uploads/image/43/32/4332638c11248b8ff07033c11de0759a55205facfbec85e14458245a91991faf.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":9041,"postNumber":4,"raw":"你国人还有隐私？","cooked":"

你国人还有隐私？

\n","createdAt":"2023-08-11 11:49:16.339866","updatedAt":"2023-08-11 11:49:16.339866","replyToPostNumber":null,"replyCount":0,"likeCount":0,"wordCount":8,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":1047,"username":"anonymous_coward_old","name":"Anonymous Coward Old","avatarUrl":"/uploads/image/43/32/4332638c11248b8ff07033c11de0759a55205facfbec85e14458245a91991faf.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":9044,"postNumber":5,"raw":"搜狗输入法不行，🐶都不用。","cooked":"

搜狗输入法不行，🐶都不用。

\n","createdAt":"2023-08-11 13:43:56.956056","updatedAt":"2024-03-17 13:05:07.340858","replyToPostNumber":null,"replyCount":0,"likeCount":0,"wordCount":12,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":1047,"username":"anonymous_coward_old","name":"Anonymous Coward Old","avatarUrl":"/uploads/image/43/32/4332638c11248b8ff07033c11de0759a55205facfbec85e14458245a91991faf.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":9048,"postNumber":6,"raw":"这样啊，一直在用的。","cooked":"

这样啊，一直在用的。

\n","createdAt":"2023-08-11 14:01:35.398518","updatedAt":"2023-08-11 14:01:35.398518","replyToPostNumber":null,"replyCount":0,"likeCount":0,"wordCount":10,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":346,"username":"hoist","name":null,"avatarUrl":"/uploads/image/0d/cd/0dcdf69d213b6798002779ad4b729567cd4d889ee4a56c07a8c4454e8b563219.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":9053,"postNumber":7,"raw":"免费泄露的数据都够盒一个人了，这种还需要点技术的都用不上，更不用说花钱找内鬼盒 :savoring_food:","cooked":"

免费泄露的数据都够盒一个人了，这种还需要点技术的都用不上，更不用说花钱找内鬼盒 😋

\n","createdAt":"2023-08-11 14:29:09.382964","updatedAt":"2023-08-11 14:29:09.382964","replyToPostNumber":null,"replyCount":0,"likeCount":0,"wordCount":40,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":1083,"username":"anonymous138","name":"anonymous138","avatarUrl":null,"admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":9054,"postNumber":8,"raw":"实名 = 裸奔，very droll","cooked":"

实名 = 裸奔，very droll

\n","createdAt":"2023-08-11 15:05:40.453855","updatedAt":"2023-08-11 15:05:40.453855","replyToPostNumber":null,"replyCount":0,"likeCount":0,"wordCount":7,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":1047,"username":"anonymous_coward_old","name":"Anonymous Coward Old","avatarUrl":"/uploads/image/43/32/4332638c11248b8ff07033c11de0759a55205facfbec85e14458245a91991faf.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":11030,"postNumber":9,"raw":"亏搜狗这个公司创始人王小川新搞的百川智能还打算造中国版的 OpenAI。看来很缺数据呀。","cooked":"

亏搜狗这个公司创始人王小川新搞的百川智能还打算造中国版的 OpenAI。看来很缺数据呀。

\n","createdAt":"2023-09-09 08:34:24.566805","updatedAt":"2023-09-09 08:34:24.566805","replyToPostNumber":null,"replyCount":0,"likeCount":0,"wordCount":37,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":1047,"username":"anonymous_coward_old","name":"Anonymous Coward Old","avatarUrl":"/uploads/image/43/32/4332638c11248b8ff07033c11de0759a55205facfbec85e14458245a91991faf.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}}],"hasMore":false,"lastReadPostNumber":1,"hasUrlPostNumber":false}