Encoding is not encryption
Cyber security Lesson 8 1:43 English narration · English + 中文 subtitles burned in
Chapters
Transcript
People say "encoded" when they mean "encrypted", and the two are not the same thing.
人们常常把"编码"说成"加密"，但这两件事不是一回事。
Encoding changes the FORMAT of data so it can be stored or sent.
编码改变的是数据的"格式"，好让它能被存储或传输。
It is not secret — look at the lane on the left, there is no key anywhere in it.
它不是秘密——看看左边这条流程，里面根本没有钥匙。
Encryption changes data so that only someone with the key can read it.
加密改变数据，使得只有拿着密钥的人才读得懂。
That is the whole difference.
差别就在这里。
The famous encoding is base64.
最有名的编码是 base64。
It rewrites bytes using sixty-four safe characters, which is how an image gets carried inside an email.
它用 64 个安全字符重写字节， 这就是一张图片能被塞进邮件里的原因。
Encode "hello" and you get something that certainly looks scrambled.
把 "hello" 编码一下，你会得到一串看上去确实很乱的东西。
Now decode it — no key is needed, and the text comes straight back.
现在把它解码——不需要任何密钥，文本原样回来了。
Anyone with the string has the text.
谁拿到这串字符，谁就拿到了原文。
This is not a vocabulary quibble, it is a real bug.
这不是咬文嚼字，这是实实在在的漏洞。
If a website says it protects your password with base64, your password is not protected at all.
如果一个网站说它用 base64 保护你的密码， 那你的密码根本没有被保护。
Real protection is one of two things: encryption, with a key, for data you must read back; or hashing, one-way, for passwords you never read back.
真正的保护只有两种： 带密钥的加密，用于你还需要读回来的数据； 或者单向的哈希，用于你永远不需要读回来的密码。
Encoding is just a costume.
编码只是一件戏服。
Four things to take with you.
带走四点。
One: encoding changes the format, and it is not secret.
第一：编码改变的是格式，它不是秘密。
Two: base64 reverses in one line, with no key.
第二：base64 一行代码就能还原，不需要密钥。
Three: encryption needs a key, so only the holder reads it.
第三：加密需要密钥，所以只有持钥的人读得懂。
Four: calling encoding "encryption" is a real security bug.
第四：把编码叫成"加密"是一个真实的安全漏洞。
Now encode a string in the task below.
现在去下面的题里给一个字符串做编码。