通过 SFTP 存储敏感信息是否比通过 SOAP 更不安全？
通过 SFTP 传输的文件是否比通过 SOAP 传输到数据库的相同数据安全性较低？
Is a file transferred via SFTP any less secure than the same data transferred via SOAP into a database?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
SFTP 非常安全。 “SFTP”中的“S”甚至代表安全。当然，这并不意味着通过 SFTP 传输的文件一定是安全的 - 只是如果安全性出现问题，您可能会责怪 SFTP 之外的其他原因。 SFTP 不会是薄弱环节。您仍然可能会使用弱密码、丢失证书、让特勤局突袭您的数据中心等等。
但是，SOAP 与安全性无关。 SOAP 请求是一个事物，它可以是安全的，也可以是不安全的，具体取决于它的发送方式。如果您通过 HTTP 发送 SOAP，那么它是极其不安全的。如果您通过 HTTPS 发送它，它可能相对安全，具体取决于您对 CA 的信任程度。使用 SOAP over HTTP 就像将 UPS 包裹留在家门口一样。很方便，但有人可以走过来拿走。
这样想：SOAP 是钱，HTTPS 是装甲车。除非有时装甲车由中国政府驾驶到完全不同的地点，除非你有适当的规则来防止这种情况发生。 （例如，Google Chrome 浏览器对特定域上的 CA 使用白名单。）
摘要：
正确获取证书是唯一困难的部分。
SFTP is very secure. The "S" in "SFTP" even stands for secure. That doesn't mean that a file transferred via SFTP is necessarily secure, of course -- just that if something goes wrong with the security, you probably have something else to blame other than SFTP. SFTP won't be the weak link. You could still have a weak password, lose your certificate, have the secret service raid your data center, etc.
However, SOAP has nothing to do with security. A SOAP request is a thing which can be secure or insecure depending on how it's sent. If you send SOAP over HTTP, it is incredibly insecure. If you send it over HTTPS, it can be relatively secure depending on how much you trust your CA. Using SOAP over HTTP is like leaving your UPS package on the doorstep. It's convenient but someone could walk by and take it.
Think about it this way: SOAP is the money, HTTPS is the armored car. Except sometimes the armored car is driven by the Chinese government to a completely different location, unless you have a rule in place to prevent that from happening. (Google Chrome, for example, uses a whitelist for CAs on specific domains.)
Summary:
Getting your certificates right is the only hard part about this.