如何保护 WinForms 应用程序内的 HTTP 流量免遭嗅探
用于保护 WinForms 应用程序内的 HTTP 流量免遭嗅探的方法有哪些。
我想确保使用 Fiddler 等嗅探应用程序的人无法直接看到源自 WebRequest 的所有 HTTP 流量。
除了使用 HTTPS 之外，还有其他方法可以从不可嗅探的 WinForms 应用程序发送 Web 流量吗？
What are the methods used to secure HTTP traffic inside a WinForms application from sniffing.
I want to ensure that all HTTP traffic originating from say the WebRequest is not directly visible to someone using a sniffing application such as Fiddler.
Apart from using HTTPS are there any alternatives for sending web traffic out of a WinForms application that is unsniffable?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
您可以创建到网络服务器的 VPN 连接，然后通过该连接路由流量吗？
您可以创建一个到服务器的 SSH 连接，该服务器具有到网络服务器的 VPN 隧道，然后通过 SHH 路由所有流量，然后通过 VPN？
You could create a VPN connection to the webserver, and then route the traffic over that?
You could create a SSH connection to a server that has a VPN tunnel to the webserver, then route all the traffic via SHH, then the VPN?
您可以加密您的有效负载，但如果您想要整个传输安全，则可以使用 HTTPS。
You can encrypt your payload but if you want the whole transmission secure HTTPS is the way to do it.
如果您使用 WCF 作为 WinForms 应用程序背后的通信工具，那么此 MSDN 系列 可能有用。它非常详细地描述了一系列替代安全选项。
If you are using WCF as the communication tool behind your WinForms application then this MSDN series could be usesful. It describes a range of alternative security options in a good level of detail.
当然，仅使用 HTTPS 是不够的。您还必须确保 HTTPS 管道另一端的服务器是您期望的具有正确证书的服务器。
否则，使用 Fiddler（或类似工具）的人可以使用他们自己的自签名证书响应您的 HTTPS 请求。
Fiddler 有一个功能，它充当客户端和 HTTPS 连接的服务器之间的代理。它使用自己的自签名证书与客户端通信，然后使用 HTTPS 与远程服务器通信，代理它们之间的数据并允许用户查看数据的纯文本。如果客户端不检查另一端的证书是否正确，它永远不知道连接实际上并不安全。
是的，您需要使用 HTTPS/SSL 或某种其他形式的加密，因为在本地计算机上具有管理员权限的人可以看到您通过网络发送的任何数据，没有其他方法可以对他们隐藏这些数据。
Just using HTTPS isn't enough of course. You have to also have to make sure that the server at the other end of the HTTPS pipe is the server you expect with the correct certificate.
Otherwise someone using Fiddler (or something similar) can respond to your HTTPS requests with their own self signed certificate.
Fiddler has a feature where it acts as a proxy between the client and the HTTPS connected server. It uses its own self signed certificate to talk to the client and then uses HTTPS to talk to the remote server, proxying the data between them and allowing the user to see the plain text of the data. If the client isn't checking that the certificate at the other end is the right one, it never knows that the connection isn't actually secure.
And yes, you need to use HTTPS/SSL or some other form of encryption, as someone with admin rights on the local machine can see any data you send over the network, there is no other way of hiding it from them.