[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"article-worst-passwords-2026":3,"related-worst-passwords-2026":31},{"id":4,"slug":5,"title":6,"summary":7,"cover_image":8,"tags":9,"status":13,"source":14,"source_url":8,"source_name":8,"published_at":15,"created_at":16,"updated_at":17,"view_count":18,"content":19,"faq":20,"seo_title":8,"seo_description":8,"canonical_url":8,"noindex":30},"art_01KZRQKJ4S9170FB3P29A32W1C","worst-passwords-2026","2026 年最常用密码榜单:123456 又是第一","连续第 11 年,123456 稳坐榜首。这份榜单真正值得看的不是名次,而是它揭示的东西:人类的记忆力从来不是密码安全的可靠地基。",null,[10,11,12],"密码安全","弱密码","撞库","published","manual","2026-07-29T15:52:40.735008","2026-07-29T15:52:40.724675","2026-08-13T17:42:37.407916",12,"连续第 11 年,`123456` 稳坐最常用密码榜首。这不是新闻,新闻是它**依然**是第一。\n\n## 榜单看点不在名次\n\n每年这份榜单一出,评论区就是清一色的\"这些人怎么这么懒\"。但把责任推给用户是最省事也最没用的解释。\n\n真正的问题是:一个普通人现在要管理 **80 到 120 个账号**。指望人脑为每个账号记住一串不重复的随机字符,这个要求从一开始就不成立。\n\n## 弱密码的真实代价\n\n弱密码本身不可怕,可怕的是**复用**。攻击链条是这样的:\n\n1. 某个小网站被拖库,你的邮箱和密码明文泄露\n2. 攻击者拿这对凭据去撞你的邮箱、网盘、支付账号\n3. 只要有一处复用,整条数字身份就塌了\n\n这叫撞库(credential stuffing),是目前性价比最高的攻击方式 —— 不需要任何漏洞,只需要你在两个地方用了同一个密码。\n\n## 能立刻做的三件事\n\n**第一,先查你有没有已经泄露的密码。** Have I Been Pwned 这类服务可以按邮箱查。查出来的立刻改。\n\n**第二,把复用切断。** 不需要一次改完 120 个。按重要性排序:邮箱 > 支付 > 社交 > 其余。邮箱是所有账号的找回入口,它一旦失守,别的都是连带。\n\n**第三,别再试图用脑子记。** 生成 + 保存交给工具,你只需要记住一个主密码。\n\n## 为什么\"好记又安全\"是个伪命题\n\n常见的建议是用一句话的首字母加数字符号。这类方案的问题在于:一旦你把规则告诉了自己,你就会在所有账号上复用这个规则。规则本身成了新的单点。\n\n真正随机的密码之所以安全,恰恰因为它不可记忆 —— 这不是缺点,是它的定义。",[21,24,27],{"q":22,"a":23},"2026 年最常用的密码是什么?","123456,连续第 11 年位居榜首。紧随其后的是 123456789、password 和 qwerty 这类键盘序列。",{"q":25,"a":26},"用一个复杂密码在所有网站上不行吗?","不行。任何一个网站泄露,这个密码就在所有网站上失效了。复杂度解决的是暴力破解,解决不了复用带来的连锁失守。",{"q":28,"a":29},"密码多长才算安全?","随机生成的情况下 16 位以上基本可以排除暴力破解。但长度只在随机的前提下有意义,「Password123456789」再长也是弱密码。",false,{"items":32},[33,43,56],{"id":34,"slug":35,"title":36,"summary":37,"cover_image":8,"tags":38,"status":13,"source":14,"source_url":8,"source_name":8,"published_at":39,"created_at":40,"updated_at":41,"view_count":42},"art_01KZRQKJ4XSSJ8T388699QF086","password-reuse-is-the-real-risk","真正的风险不是弱密码,是复用","把密码设复杂能挡住暴力破解,但挡不住复用带来的连锁失守。这两件事经常被混为一谈。",[10,12,11],"2026-07-30T02:00:30.125049","2026-07-30T02:00:30.128649","2026-08-13T22:38:28.540987",4,{"id":44,"slug":45,"title":46,"summary":47,"cover_image":8,"tags":48,"status":13,"source":14,"source_url":8,"source_name":8,"published_at":52,"created_at":53,"updated_at":54,"view_count":55},"art_01KZRQKJ4WF9DJTVJ29G70HY5M","how-to-choose-password-manager","密码管理器怎么选:三个问题就能筛掉大部分","市面上的密码管理器差别很大,但对比表往往列的是功能数量。真正决定安全性的是三个结构性问题,问完基本就能排除掉不合适的。",[49,50,51],"密码管理器","零知识","自托管","2026-07-29T15:52:40.764473","2026-07-29T15:52:40.757528","2026-08-11T15:41:28.293196",6,{"id":57,"slug":58,"title":59,"summary":60,"cover_image":8,"tags":61,"status":13,"source":14,"source_url":8,"source_name":8,"published_at":65,"created_at":66,"updated_at":67,"view_count":68},"art_01KZRQKJ4V4GSFPZ3VQGX80JQE","what-to-do-after-a-breach","又一起大规模数据泄露:这次该做什么、不该做什么","每次大规模泄露之后,网上都会冒出一堆建议。有些有用,有些纯属仪式感。这篇按优先级排一遍,并说清楚每一条为什么排在那个位置。",[62,63,64],"数据泄露","应急响应","二次验证","2026-07-29T15:52:40.750729","2026-07-29T15:52:40.742509","2026-08-14T12:56:21.829877",3]