[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9ThI5P1hxd_41tfY0QlNBj-FqkbJnA7B0kWxw6dQktQ":3},{"item":4,"related":44},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":36,"sourceUrl":37,"status":38,"seoTitle":7,"seoDescription":9,"canonicalUrl":35,"isFeatured":39,"sno":40,"sortOrder":41,"publishedAt":42,"updatedAt":43,"createdAt":43},"fe387259-8b2d-4a4e-b6d5-8ad61b6f7d31","article","Oblivious HTTP：怎样让中继不知道你请求的具体内容？","oblivious-http-relay-gateway-privacy","Oblivious HTTP 将客户端 IP 与请求内容分交给中继和网关处理，减少单一角色同时掌握两类信息的机会。本文讲解端到端路径、串通与元数据风险，以及它并非完整匿名网络的原因。","使用在线服务时，服务端往往能从请求内容知道你在查什么，也能从连接地址知道请求来自哪里。若把这两类信息交给不同角色处理，就有机会减少单一服务方掌握的用户信息。Oblivious HTTP（OHTTP，隐匿式 HTTP）正是这样一种请求转发模式：客户端把加密请求交给中继，再由网关解密并转发到目标服务。\n\n客户端先把 HTTP 请求封装并加密，使只有目标网关能够解开内容。它把密文发给 relay（中继）；中继看到客户端的网络地址和数据包大小等传输元信息，却看不到加密后的具体请求。中继再把密文转给 gateway（网关）；网关能看到请求内容并向服务端发起请求，但在正常部署中并不直接看到客户端的原始 IP 地址。\n\n隐私收益来自角色分离：中继知道“谁连来了”，却不知道“具体问了什么”；网关知道“具体请求了什么”，却不直接知道“是谁发起的”。如果两者由不同运营者管理、彼此不串通，单方能关联的信息就会减少。OHTTP 适合需要隐藏客户端来源的少量 HTTP 请求，例如某些配置获取、匿名测量或隐私敏感的服务查询。\n\n然而，它不是完整匿名网络。中继和网关仍可能看到时间、请求大小、流量模式等元数据；目标服务也会看到网关发来的请求，可能通过账户登录、Cookie 或请求内容识别用户。若中继与网关串通，或都由同一方控制，信息分割的意义会减弱。客户端还要信任网关正确处理请求，并考虑重放防护、限流和滥用控制。\n\nOHTTP 的设计更像“盲转信封”：中继只知道寄件人地址，网关负责拆信并送达，但希望寄件人不直接暴露给收件方。要让这种隐私成立，不能让信封尺寸或送达时间过于独特；实际部署可能需要批处理、填充、缓存或其他策略，降低元数据关联风险。\n\n所以，OHTTP 不是让整个浏览过程都变匿名，也不是 VPN 的替代品。它把某个请求的 IP 信息与内容信息拆分给两个服务角色，减少单点观察能力。评估它时，应询问谁运营中继和网关、请求是否带有个人标识、元数据保留多久，以及两方是否可能共享日志。\n\n来源：[IETF RFC 9458：Oblivious HTTP](https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9458.html)","\u002Fuploads\u002F2026-10-13\u002Fccf6785f-0f75-487e-81f8-820a5c56d5d7.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"a202d639-99a6-488a-a712-4d4c6ffd7e15","开发","dev",{"id":32,"name":33,"slug":34},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse",null,"Internet Engineering Task Force","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9458.html","published",false,56,0,"2026-10-13T00:00:00.000Z","2026-10-13T02:13:57.371Z",[45,54,63],{"id":46,"type":6,"title":47,"slug":48,"summary":49,"coverUrl":50,"authorName":14,"sno":51,"publishedAt":52,"createdAt":53},"9ccde95c-d754-4808-91f7-488f392e3eeb","你的品牌在AI眼里到底存不存在？这套系统说了算","automated-geo-monitoring-system","靠手动抽查来验证GEO效果，本质上是在跟概率玩游戏。赢一次，不代表能一直赢。","\u002Fuploads\u002F2026-08-07\u002Fdf111c0d-f14a-4b2a-8347-141e96b71654.jpg",1,"2026-08-07T00:00:00.000Z","2026-08-07T04:31:30.843Z",{"id":55,"type":6,"title":56,"slug":57,"summary":58,"coverUrl":59,"authorName":14,"sno":60,"publishedAt":61,"createdAt":62},"9865c835-21fc-4f74-b154-19c054173557","fscrypt：只给手机里的某个文件夹加密，系统怎么做到？","linux-fscrypt-file-based-encryption","Linux fscrypt 在支持的文件系统中为目录树、文件内容和文件名提供文件级加密。它与整盘加密保护的范围不同，也不会隐藏所有文件系统元数据；本文从解锁密钥说到备份与恢复的边界。","\u002Fuploads\u002F2026-10-17\u002Fdec803fe-0da3-4a9e-8ffc-47427cf599d6.jpg",41,"2026-10-17T00:00:00.000Z","2026-10-17T03:08:37.641Z",{"id":64,"type":6,"title":65,"slug":66,"summary":67,"coverUrl":68,"authorName":14,"sno":69,"publishedAt":42,"createdAt":70},"56d3ebcb-170a-4f96-9134-ae85fb65542b","DANE\u002FTLSA：DNSSEC 能否帮助验证网站的 TLS 证书？","dane-tlsa-dnssec-tls-authentication","DANE 使用 DNS 中的 TLSA 记录发布与 TLS 服务证书或公钥相关的约束，并依赖 DNSSEC 验证记录来源。本文解释它如何补充信任路径，以及为什么它不等于所有网站都能抛弃 CA。","\u002Fuploads\u002F2026-10-13\u002F8c7d9bf5-62c6-47d4-b8eb-c4db7a21fa61.jpg",42,"2026-10-13T02:13:55.563Z"]