[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"article-how-to-choose-password-manager":3,"related-how-to-choose-password-manager":31},{"id":4,"slug":5,"title":6,"summary":7,"cover_image":8,"tags":9,"status":13,"source":14,"source_url":8,"source_name":8,"published_at":15,"created_at":16,"updated_at":17,"view_count":18,"content":19,"faq":20,"seo_title":8,"seo_description":8,"canonical_url":8,"noindex":30},"art_01KZRQKJ4WF9DJTVJ29G70HY5M","how-to-choose-password-manager","密码管理器怎么选:三个问题就能筛掉大部分","市面上的密码管理器差别很大,但对比表往往列的是功能数量。真正决定安全性的是三个结构性问题,问完基本就能排除掉不合适的。",null,[10,11,12],"密码管理器","零知识","自托管","published","manual","2026-07-29T15:52:40.764473","2026-07-29T15:52:40.757528","2026-08-11T15:41:28.293196",6,"挑密码管理器时,功能对比表帮助有限 —— 它们列的大多是「支持 XX 平台」「支持 XX 导入」这类可以后补的东西。\n\n真正决定这个工具是否值得托付的,是三个结构性问题。\n\n## 问题一:你的密钥在谁手上\n\n这是唯一一个不能妥协的问题。\n\n如果服务方能在你不参与的情况下解开你的密码库,那么:服务方被入侵 = 你的密码泄露;服务方被要求配合 = 你的密码被交出;服务方内部有人越权 = 同上。\n\n零知识(Zero-Knowledge)架构的含义是:加密和解密都在你的设备上完成,服务方只经手密文。判断方法很简单 —— **如果你忘了主密码,他们能帮你恢复吗?** 能,就说明他们有钥匙。\n\n## 问题二:数据存在哪,谁能决定\n\n云端同步方便,但方便的代价是你的密文躺在别人的服务器上。即使是零知识架构,这也意味着:\n\n- 服务停了,你的同步就断了\n- 服务涨价,你没有太多选择\n- 密文长期暴露在一个已知位置,给了攻击者无限的离线破解时间\n\n自托管的价值不在于\"更安全的加密\",而在于**你决定数据放哪**。\n\n## 问题三:出事之后你能不能拿回数据\n\n这一条最容易被忽略,但它是长期成本。\n\n导出格式是不是开放的?能不能直接读?厂商倒闭了、你不想用了,数据能不能完整带走?\n\n只支持导出到自家格式,或者干脆不支持导出的,不要考虑 —— 那不是密码管理器,那是人质。\n\n## 功能层面只有一条硬指标\n\n自动填充必须真的好用。\n\n这听起来像体验问题,其实是安全问题:填充不好用,用户就会去复制粘贴;复制粘贴多了,就会为了省事把密码设简单;密码简单了,前面所有加密都白搭。\n\n安全性最终是由**最省事的那条路径**决定的。",[21,24,27],{"q":22,"a":23},"零知识架构怎么验证?","问一个问题:忘了主密码能不能找回。能找回就说明服务方持有密钥,那就不是零知识。真正的零知识架构下,主密码丢失意味着数据永久无法解开。",{"q":25,"a":26},"自托管是不是比云服务更安全?","不必然。自托管的核心价值是你决定数据放在哪、由谁保管,以及不会因为厂商倒闭而失去访问。安全性还是取决于加密实现本身。",{"q":28,"a":29},"为什么导出功能这么重要?","它决定你能不能离开。不支持开放格式导出的产品,等于把你的数据扣作了留下的筹码。",false,{"items":32},[33,46,59],{"id":34,"slug":35,"title":36,"summary":37,"cover_image":8,"tags":38,"status":13,"source":14,"source_url":8,"source_name":8,"published_at":42,"created_at":43,"updated_at":44,"view_count":45},"art_01KZRQKJ4XSSJ8T388699QF086","password-reuse-is-the-real-risk","真正的风险不是弱密码,是复用","把密码设复杂能挡住暴力破解,但挡不住复用带来的连锁失守。这两件事经常被混为一谈。",[39,40,41],"密码安全","撞库","弱密码","2026-07-30T02:00:30.125049","2026-07-30T02:00:30.128649","2026-08-13T22:38:28.540987",4,{"id":47,"slug":48,"title":49,"summary":50,"cover_image":8,"tags":51,"status":13,"source":14,"source_url":8,"source_name":8,"published_at":55,"created_at":56,"updated_at":57,"view_count":58},"art_01KZRQKJ4V4GSFPZ3VQGX80JQE","what-to-do-after-a-breach","又一起大规模数据泄露:这次该做什么、不该做什么","每次大规模泄露之后,网上都会冒出一堆建议。有些有用,有些纯属仪式感。这篇按优先级排一遍,并说清楚每一条为什么排在那个位置。",[52,53,54],"数据泄露","应急响应","二次验证","2026-07-29T15:52:40.750729","2026-07-29T15:52:40.742509","2026-08-14T12:56:21.829877",3,{"id":60,"slug":61,"title":62,"summary":63,"cover_image":8,"tags":64,"status":13,"source":14,"source_url":8,"source_name":8,"published_at":65,"created_at":66,"updated_at":67,"view_count":68},"art_01KZRQKJ4S9170FB3P29A32W1C","worst-passwords-2026","2026 年最常用密码榜单:123456 又是第一","连续第 11 年,123456 稳坐榜首。这份榜单真正值得看的不是名次,而是它揭示的东西:人类的记忆力从来不是密码安全的可靠地基。",[39,41,40],"2026-07-29T15:52:40.735008","2026-07-29T15:52:40.724675","2026-08-13T17:42:37.407916",12]