[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"article-what-to-do-after-a-breach":3,"related-what-to-do-after-a-breach":31},{"id":4,"slug":5,"title":6,"summary":7,"cover_image":8,"tags":9,"status":13,"source":14,"source_url":8,"source_name":8,"published_at":15,"created_at":16,"updated_at":17,"view_count":18,"content":19,"faq":20,"seo_title":8,"seo_description":8,"canonical_url":8,"noindex":30},"art_01KZRQKJ4V4GSFPZ3VQGX80JQE","what-to-do-after-a-breach","又一起大规模数据泄露:这次该做什么、不该做什么","每次大规模泄露之后,网上都会冒出一堆建议。有些有用,有些纯属仪式感。这篇按优先级排一遍,并说清楚每一条为什么排在那个位置。",null,[10,11,12],"数据泄露","应急响应","二次验证","published","manual","2026-07-29T15:52:40.750729","2026-07-29T15:52:40.742509","2026-08-14T12:56:21.829877",3,"每次有大规模数据泄露上新闻,社交媒体上就会出现一批建议。问题是这些建议很少排优先级 —— 而在这种时候,**顺序比清单本身重要**。\n\n## 先确认你是否受影响\n\n不要凭感觉。去 Have I Been Pwned 按邮箱查,或者看服务方的官方通告。泄露范围通常分几档:\n\n- 只泄露了邮箱 —— 影响是垃圾邮件和钓鱼增加\n- 泄露了密码哈希 —— 取决于哈希算法,bcrypt 慢哈希和 MD5 完全是两回事\n- 泄露了明文密码 —— 最坏情况,立刻按下面处理\n\n## 改密码的正确顺序\n\n**先改邮箱密码**,不是先改被泄露那个网站的。\n\n理由是邮箱是所有账号的找回入口。如果攻击者已经进了你的邮箱,你在别处改一百次密码都没用 —— 他可以一个个重置回来。\n\n顺序:邮箱 → 有支付能力的账号 → 用了同一个密码的所有账号 → 泄露的那个网站本身。\n\n## 开二次验证,但别用短信\n\n如果这个账号支持二次验证,现在就开。但优先级是:\n\n1. 硬件密钥(YubiKey 这类)\n2. TOTP 验证码 App\n3. 短信验证码\n\n短信排最后是因为 SIM 卡劫持是成熟攻击手法 —— 攻击者说服运营商把你的号码转到他的卡上,短信就到他手里了。有总比没有强,但别当成终点。\n\n## 不用做的事\n\n**不用注销账号。** 数据已经泄露了,注销不会让它从攻击者手里消失。\n\n**不用换邮箱。** 成本极高,收益接近零。\n\n**不用买\"暗网监控\"服务。** 大部分只是替你查了一遍公开的泄露数据库,这件事你自己就能免费做。\n\n## 事后:把这次当成一次审计\n\n泄露事件的唯一价值,是它逼你面对一个平时会拖延的问题:你到底有多少账号在用同一个密码。\n\n趁这个机会把它清一遍。用工具生成、用工具保存,别再用脑子。",[21,24,27],{"q":22,"a":23},"发现自己在泄露名单里,第一件事做什么?","先改邮箱密码,不是先改泄露网站的密码。邮箱是所有账号的找回入口,它不安全,别处改了也会被重置回来。",{"q":25,"a":26},"短信验证码到底安不安全?","比没有强,但弱于 TOTP 和硬件密钥。SIM 卡劫持是成熟手法,攻击者可以把你的号码转走。能选就别选短信。",{"q":28,"a":29},"需要注销被泄露的账号吗?","通常不需要。数据已经流出去了,注销不会让它消失。把密码改掉、开二次验证更有意义。",false,{"items":32},[33,46,59],{"id":34,"slug":35,"title":36,"summary":37,"cover_image":8,"tags":38,"status":13,"source":14,"source_url":8,"source_name":8,"published_at":42,"created_at":43,"updated_at":44,"view_count":45},"art_01KZRQKJ4XSSJ8T388699QF086","password-reuse-is-the-real-risk","真正的风险不是弱密码,是复用","把密码设复杂能挡住暴力破解,但挡不住复用带来的连锁失守。这两件事经常被混为一谈。",[39,40,41],"密码安全","撞库","弱密码","2026-07-30T02:00:30.125049","2026-07-30T02:00:30.128649","2026-08-13T22:38:28.540987",4,{"id":47,"slug":48,"title":49,"summary":50,"cover_image":8,"tags":51,"status":13,"source":14,"source_url":8,"source_name":8,"published_at":55,"created_at":56,"updated_at":57,"view_count":58},"art_01KZRQKJ4WF9DJTVJ29G70HY5M","how-to-choose-password-manager","密码管理器怎么选:三个问题就能筛掉大部分","市面上的密码管理器差别很大,但对比表往往列的是功能数量。真正决定安全性的是三个结构性问题,问完基本就能排除掉不合适的。",[52,53,54],"密码管理器","零知识","自托管","2026-07-29T15:52:40.764473","2026-07-29T15:52:40.757528","2026-08-11T15:41:28.293196",6,{"id":60,"slug":61,"title":62,"summary":63,"cover_image":8,"tags":64,"status":13,"source":14,"source_url":8,"source_name":8,"published_at":65,"created_at":66,"updated_at":67,"view_count":68},"art_01KZRQKJ4S9170FB3P29A32W1C","worst-passwords-2026","2026 年最常用密码榜单:123456 又是第一","连续第 11 年,123456 稳坐榜首。这份榜单真正值得看的不是名次,而是它揭示的东西:人类的记忆力从来不是密码安全的可靠地基。",[39,41,40],"2026-07-29T15:52:40.735008","2026-07-29T15:52:40.724675","2026-08-13T17:42:37.407916",12]