210.3.150.178 来自 2025年1月22日 (三) 08:08

2025-01-22T08:08:46Z

新页面

{{更新|time=2025-01-22T08:06:43+00:00|reason=已停止更新 https://www.eff.org/deeplinks/2021/09/https-actually-everywhere}}
{{noteTA
|G1 = IT
|G2 = FL
}}
{{Infobox software
| name = HTTPS Everywhere
| logo = HTTPS Everywhere icon.svg
| logo_size = 150px
| developer = [[Tor项目]]和[[电子前哨基金会]]
| released = 
| latest release version = 2022.05.11
| latest release date = {{Start date and age|2022|05|11|df=yes}}<ref name=changelog>{{cite web |url=https://www.eff.org/files/Changelog.txt |title=Changelog.txt |publisher=EFF |date=2020-11-17 |accessdate=2020-11-17 |language=en |archive-date=2016-08-29 |archive-url=https://web.archive.org/web/20160829063735/https://www.eff.org/files/Changelog.txt |dead-url=no }}</ref>
| programming language = [[JavaScript]]
| genre = [[瀏覽器擴充功能]]
| license = [[GNU GPL]] v3+（大部分代码兼容v2）<ref>[https://www.eff.org/https-everywhere/development HTTPS Everywhere Development] {{Wayback|url=https://www.eff.org/https-everywhere/development |date=20170512130438 }} Electronic Frontier Foundation {{en}}</ref>
}}
'''HTTPS Everywhere'''是一个[[自由软件|自由]]且[[开放源代码|开源]]的[[瀏覽器擴充功能]]，支持[[Google Chrome]]、[[Firefox|Mozilla Firefox]]和[[Opera電腦瀏覽器|Opera]]，由非营利组织[[Tor项目]]和[[电子前哨基金会]]（EFF）共同开发<ref>{{Cite web|url=https://www.eff.org/https-everywhere|title=HTTPS Everywhere | Electronic Frontier Foundation|accessdate=2014-04-14|publisher=Eff.org|language=en|archive-date=2011-06-05|archive-url=https://web.archive.org/web/20110605022218/https://www.eff.org/https-everywhere|dead-url=no}}</ref>。该插件会在网站支持的情况下自动转用更安全的[[超文本传输安全协议|HTTPS]]连接，减少使用[[超文本传输协议|HTTP]]的情况<ref>{{Cite web|url=http://www.h-online.com/news/item/HTTPS-Everywhere-reaches-2-0-comes-to-Chrome-as-beta-1445615.html|title=HTTPS Everywhere reaches 2.0, comes to Chrome as beta - The H Open: News and Features|accessdate=2014-04-14|date=2012-02-29|publisher={{tsl|en|H-online.com}}|language=en|archive-date=2014-06-05|archive-url=https://web.archive.org/web/20140605051849/http://www.h-online.com/news/item/HTTPS-Everywhere-reaches-2-0-comes-to-Chrome-as-beta-1445615.html|dead-url=no}}</ref>。

== 开发 ==
[[Google]]转向HTTPS给了开发者灵感<ref>{{Cite web|url=http://www.h-online.com/open/news/item/Automatic-web-encryption-almost-everywhere-1025472.html|title=Automatic web encryption (almost) everywhere - The H Open Source: News and Features|accessdate=2014-04-15|date=2010-06-18|publisher={{tsl|en|H-online.com}}|archiveurl=https://web.archive.org/web/20100623004449/http://www.h-online.com/open/news/item/Automatic-web-encryption-almost-everywhere-1025472.html|archivedate=2010-06-23|language=en|dead-url=no}}</ref>，从而开发出使浏览器优先使用HTTPS的HTTPS Everywhere<ref>{{Cite web |url=http://www.nytimes.com/2011/02/17/technology/personaltech/17basics.html?src=me&ref=general |title=Kate Murphy: New hacking tools pose bigger threats to Wi-Fi users. |accessdate=2017-02-24 |archive-date=2017-08-21 |archive-url=https://web.archive.org/web/20170821125905/http://www.nytimes.com/2011/02/17/technology/personaltech/17basics.html?src=me&ref=general |dead-url=no }}</ref>。HTTPS Everywhere的部分代码基于[[NoScript]]对[[HTTP严格传输安全]]的实现，但在设计上比NoScript更易用<ref>{{Cite web|url=https://www.eff.org/https-everywhere/|title=HTTPS Everywhere | Electronic Frontier Foundation|accessdate=2014-06-04|publisher=Eff.org|language=en|archive-date=2014-06-05|archive-url=https://web.archive.org/web/20140605052902/https://www.eff.org/https-everywhere/|dead-url=no}}</ref>。EFF网站上对用户提供有关向HTTPS Everywhere添加HTTPS规则集方面的指导<ref>{{Cite web|url=https://www.eff.org/https-everywhere/rulesets|title=HTTPS Everywhere Rulesets | Electronic Frontier Foundation|accessdate=2014-05-19|date=2014-01-24|publisher=Eff.org|language=en|archive-date=2014-06-03|archive-url=https://web.archive.org/web/20140603144520/https://www.eff.org/https-everywhere/rulesets|dead-url=no}}</ref>，以及默认支持网站列表<ref>{{Cite web|url=https://www.eff.org/https-everywhere/atlas/|title=HTTPS Everywhere Atlas|accessdate=2014-05-24|work=eff.org|language=en|archive-date=2014-05-21|archive-url=https://web.archive.org/web/20140521071435/https://www.eff.org/https-everywhere/atlas/|dead-url=no}}</ref>。

=== 平台支持 ===
HTTPS Everywhere的Firefox公测版发布于2010年<ref>{{Cite web|url=http://www.cnet.com/news/firefox-add-on-encrypts-sessions-with-facebook-twitter/|title=Firefox add-on encrypts sessions with Facebook, Twitter|accessdate=2014-04-14|date=2010-06-18|last=Mills|first=Elinor|publisher=[[CNET]]|language=en|archive-date=2014-05-30|archive-url=https://web.archive.org/web/20140530104421/http://www.cnet.com/news/firefox-add-on-encrypts-sessions-with-facebook-twitter/|dead-url=no}}</ref>，1.0版发布于2011年<ref>{{Cite web|url=https://www.wired.com/2011/08/firefox-security-tool-https-everywhere-hits-1-0/|title=Firefox Security Tool HTTPS Everywhere Hits 1.0 | Webmonkey|accessdate=2014-04-14|author=Scott Gilbertson|date=2011-08-05|publisher=WIRED|language=en|archive-date=2014-06-05|archive-url=https://web.archive.org/web/20140605061143/http://www.wired.com/2011/08/firefox-security-tool-https-everywhere-hits-1-0/|dead-url=no}}</ref>。适用于Google Chrome的测试版在2012年12月发布<ref name="SSLObservatory">{{Cite web|url=https://www.eff.org/deeplinks/2012/02/https-everywhere-decentralized-ssl-observatory|title=HTTPS Everywhere & the Decentralized SSL Observatory | Electronic Frontier Foundation|accessdate=2014-06-04|date=2012-02-29|publisher=Eff.org|language=en|archive-date=2014-06-06|archive-url=https://web.archive.org/web/20140606221244/https://www.eff.org/deeplinks/2012/02/https-everywhere-decentralized-ssl-observatory|dead-url=no}}</ref>。[[Android]]设备适用的版本在2014年发布<ref>{{Cite web|url=https://www.engadget.com/2014/02/05/firefox-for-android-https-everywhere/|title=Browsing on your Android phone just got safer, thanks to the EFF|accessdate=2014-04-14|date=2014-01-27|last=Brian|first=Matt|publisher=Engadget.com|language=en|archive-date=2014-10-22|archive-url=https://web.archive.org/web/20141022054139/http://www.engadget.com/2014/02/05/firefox-for-android-https-everywhere/|dead-url=no}}</ref>。

== SSL Observatory ==
SSL Observatory是HTTPS Everywhere自2.0.1版新增的一项功能，通过分析[[公開金鑰認證|公开密钥认证]]来判断[[数字证书认证机构|证书颁发机构]]是否已变得不可信<ref>{{Cite web|url=http://www.infoworld.com/t/encryption/eff-builds-system-warn-certificate-breaches-173602|title=EFF builds system to warn of certificate breaches | Encryption|accessdate=2014-04-14|date=2011-09-21|last=Lemos|first=Robert|publisher={{tsl|en|InfoWorld}}|language=en|archive-date=2014-06-02|archive-url=https://web.archive.org/web/20140602200129/http://www.infoworld.com/t/encryption/eff-builds-system-warn-certificate-breaches-173602|dead-url=no}}</ref>，以及用户是否可能受到[[中间人攻击]]<ref>{{Cite web|url=http://www.zdnet.com/blog/networking/new-https-everywhere-web-browser-extension-released/2077|title=New 'HTTPS Everywhere' Web browser extension released|accessdate=2014-04-14|date=2012-02-28|last=Vaughan|first=Steven J.|publisher=[[ZDNet]]|language=en|archive-date=2014-04-04|archive-url=https://web.archive.org/web/20140404183624/http://www.zdnet.com/blog/networking/new-https-everywhere-web-browser-extension-released/2077|dead-url=no}}</ref>。2013年，[[ICANN]]安全与稳定咨询委员会（SSAC）注意到SSL Observatory使用的数据集经常将一个组织下属的中间证书机构当作不同实体对待，使证书机构总数看起来过高。SSAC批评SSL Observatory，称其可能少统计了很多内部名称证书，还提到它使用的是2010年的数据集。<ref>{{Cite web|url=http://www.icann.org/en/groups/ssac/documents/sac-057-en.pdf|title=1 SSAC Advisory on Internal Name Certificates|date=2013-03-15|publisher=[[ICANN]] Security and Stability Advisory Committee (SSAC)|language=en|accessdate=2017-02-24|archive-date=2014-03-23|archive-url=https://web.archive.org/web/20140323024133/http://www.icann.org/en/groups/ssac/documents/sac-057-en.pdf|dead-url=no}}</ref>

== 评价 ==
有两项研究建议将HTTPS Everywhere的功能植入Android浏览器<ref>{{Cite journal|title=Why Eve and Mallory love Android: An analysis of Android SSL (in)security|url=https://www.cs.ucsb.edu/~koc/ns/docs/articles/p50.pdf|last=Fahl|first=Sascha|publisher=ACM, 2012|display-authors=etal|language=en|deadurl=yes|archiveurl=https://wayback.archive-it.org/all/20130108040246/http://cs.ucsb.edu/~koc/ns/docs/articles/p50.pdf|archivedate=2013-01-08|journal=|access-date=2017-02-24}}</ref><ref>{{Cite book|title=Proceeding of the 11th annual international conference on Mobile systems, applications, and services - Mobi ''Sys'' '13|last=Davis|first=B.|last2=Chen|first2=H.|year=2013|isbn=9781450316729|pages=181|chapter=Retro ''Skeleton''|doi=10.1145/2462456.2464462|language=en}}</ref>。2012年，Eric Phetteplace称该插件“可能是对{{tsl|en|Firesheep}}式攻击最好的各平台通用应对手段”<ref>Kern, M. Kathleen, and Eric Phetteplace. "Hardening the browser." {{tsl|en|Reference & User Services Quarterly}} 51.3 (2012): 210-214. http://eprints.rclis.org/16837/ {{Wayback|url=http://eprints.rclis.org/16837/ |date=20170118130513 }} {{en}}</ref>。2011年，Vincent Toubiana和Vincent Verdot指出HTTPS Everywhere插件的一些不足，包括支持HTTPS服务的列表需要维护，以及部分服务在尚未准备好HTTPS的情况下被重定向至HTTPS，使插件用户无法正常访问服务<ref>{{Cite arXiv|title=Show Me Your Cookie And I Will Tell You Who You Are|last=Toubiana|last2=Verdot|first1=Vincent|first2=Vincent|date=2011|eprint=1108.5864|class=cs.CR|language=en}}</ref>。

== 参见 ==
* [[傳輸層安全協議|传输层安全协议]]（TLS） - 在计算机网络中提供通信安全的加密协议
* [[隐私獾]]- EFF开发的免费浏览器插件，用于阻止第三方跟踪行为。
* {{tsl|en|Switzerland (software)|Switzerland (软件)}} – EFF开发的开源网络监控工具
* [[Let's Encrypt]] – 免费的自动化X.509证书机构，为简化网站TLS加密的设置与维护而创建

== 参考文献 ==
{{reflist|30em}}

== 外部链接 ==
* {{Official|https://www.eff.org/https-everywhere}}{{en}}
* [https://gitweb.torproject.org/https-everywhere.git 版本库]{{Wayback|url=https://gitweb.torproject.org/https-everywhere.git |date=20170424102054 }}{{en}}

{{Tor project}}
{{TLS和SSL}}

[[Category:Firefox 附加组件]]
[[Category:Opera浏览器]]
[[Category:保密通信]]
[[Category:Tor (匿名網絡)]]
[[Category:用JavaScript編程的自由軟體]]
[[Category:Google Chrome扩展]]
[[Category:電子前哨基金會]]

HTTPS Everywhere - 版本历史

210.3.150.178 来自 2025年1月22日 (三) 08:08