[{"data":1,"prerenderedAt":173},["ShallowReactive",2],{"blog:vpn-and-password-security":3},{"zh-CN":4,"en":94},{"blocks":5,"faq":78},[6,9,11,15,17,19,21,24,26,28,31,50,52,55,57,59,62,71,74,76],{"type":7,"html":8},"p","账号被盗，很多人第一反应是去查网络是不是不安全，其实多数时候跟连的是哪条线路没什么关系。真正的原因几乎总是同一个：一个密码用在了好几个地方，其中一个网站的数据库泄露了，剩下用同一个密码的账号跟着一起遭殃。",{"type":7,"html":10},"聊 VPN 安全，很多人只想到网络这一层，但账号安全从来是两条独立的防线：VPN 管的是数据在传输路径上会不会被偷看，密码和验证方式管的是账号本身会不会被人冒用登录。这篇专讲后面这一条，讲清楚 VPN 能管到哪一步、密码这一环具体该怎么补上，也讲清楚账号已经出问题时，有哪几个信号能提前发现。",{"type":12,"id":13,"html":14},"h2","bp-why","账号被盗，多数时候和网络没关系",{"type":7,"html":16},"绝大多数「账号被盗」的真实过程是这样的：某个不知名的小网站数据库被攻破，用户名和密码成对泄露到网上，攻击者拿着这批密码去尝试登录邮箱、社交、支付账号——如果你在那个小网站和其他重要账号用了同一个密码，尝试就会成功。这个过程叫「撞库」，跟你当时用不用 VPN、网络稳不稳定完全无关。",{"type":7,"html":18},"换句话说，攻击者手上拿到的不是「破解」出来的密码，而是本来就是你自己设置、只是用在了不止一个地方的密码。密码复用才是账号安全里最大的单一风险来源，比任何网络层面的问题都更常见，也比想象中更容易中招——谁都很难保证自己十年来注册的几十个网站里没有一个用过重复的密码。",{"type":7,"html":20},"更麻烦的是，这类数据库泄露往往不是立刻就被拿去用，可能是几个月甚至几年后才被打包转卖，账号看起来「一直没事」，不代表用过的那个密码没在某个泄露列表里躺着，等着某一天被人拿出来试一遍。",{"type":12,"id":22,"html":23},"bp-boundary","VPN 保护的是这一段，密码保护的是那一段",{"type":7,"html":25},"VPN 加密处理的是设备到节点这一段传输路径上的内容，防的是路上偷看流量的人。\u003Ca href=\"\u002Fblog\u002Fvpn-encryption-basics\u002F\">VPN 加密入门\u003C\u002Fa>那篇讲得更细——但那一层从头到尾都不涉及「密码会不会被撞库撞中」这件事，加密再强，密码重复使用的风险照样存在，两者是完全独立的防线。",{"type":7,"html":27},"反过来想也一样：密码设置得再好，也管不住公共 Wi-Fi 上传输内容被偷看的问题，这是 VPN 那一层该负责的事。把两条防线分清楚，才知道遇到具体问题该往哪个方向查，而不是笼统地觉得「用了 VPN 应该就安全了」，结果账号还是栽在一个用了五年的旧密码上——很多人把「用了 VPN」和「账号安全」划上等号，恰恰是这种误解让密码这一环长期被忽略。",{"type":12,"id":29,"html":30},"bp-habits","让密码这一环更结实的几个习惯",{"type":32,"items":33},"steps",[34,38,42,46],{"title":35,"body":36},"每个账号一个独立密码，尤其是邮箱",[37],"重要账号不共用密码，这一条比密码本身多复杂更重要。邮箱尤其特殊——大多数「忘记密码」流程都靠邮箱找回，邮箱一旦被攻破，等于给了别人重置所有其他账号的钥匙，邮箱密码理应是最独特、最不外传的一个。支付类账号的密码同理应该单独设置，一旦和某个普通网站共用，风险等级完全不对等。",{"title":39,"body":40},"用密码管理工具，别用脑子硬记",[41],"脑子里能可靠记住的独特密码撑不了几个账号，多数人到第五六个就开始重复。密码管理工具生成和存放这些密码，只需要记住一个主密码，是目前大多数人能坚持做到「每个账号都不一样」的现实办法，比死记硬背靠谱得多。常见的密码管理工具通常还带一个「检查重复密码」的功能，装上以后第一件事就是跑一遍这个检查，一次性看清楚自己到底有多少账号在共用密码。",{"title":43,"body":44},"两步验证能开就开",[45],"两步验证多一步确实麻烦，但撞库撞中密码之后，两步验证通常是最后一道能拦住登录的关卡。选哪种方式很关键，下一节会展开讲，先记住一句话：开了比没开好，选对方式比只是开了更好。邮箱、支付、社交这几类账号最该优先开，不必强求所有账号一次都补齐。",{"title":47,"body":48},"定期看看账号有没有在已知泄露名单里",[49],"网上有工具可以查询自己的邮箱是不是出现在已知的数据泄露名单里，查到了不代表账号已经被登录，但值得把对应的密码换掉，尤其是如果那个密码还在别处用着。查到自己的邮箱在泄露名单里不用慌，这类工具只是拿邮箱去比对已经公开的泄露记录，本身不会因为查询这一步而暴露你的密码。",{"type":51},"downloads",{"type":12,"id":53,"html":54},"bp-2fa","两步验证，选对方式比开不开更重要",{"type":7,"html":56},"两步验证的方式不止一种，安全程度也不一样。短信验证码最方便，但依赖手机信号和运营商通道，出境、换号、信号不好的时候容易掉链子——\u003Ca href=\"\u002Fblog\u002Fprotect-accounts-when-travelling\u002F\">出境前后账号安全怎么做\u003C\u002Fa>那篇专门讲了这种情况怎么应对。短信这条通道还有另一个弱点：号码本身有被转移的风险，一旦运营商被骗把号码转到别人手机上，绑定短信的两步验证就跟着失效了。",{"type":7,"html":58},"验证器 App 生成的动态码在设备本地完成，不依赖信号，也不依赖运营商，是更稳的选择。唯一要注意的是把验证器数据备份好，或者在两台设备上同步——手机丢了，如果验证器只装在那一台上，账号找回会变得很麻烦，注册时给的那几个恢复码这时候就是唯一的退路，提前存好比事后着急有用得多。两台设备同步这一步花不了三分钟，却是最容易被跳过的一步，多数人是在真的丢了手机之后才想起来去查该怎么办。",{"type":12,"id":60,"html":61},"bp-signals","这些信号说明账号可能已经出问题了",{"type":63,"items":64},"list",[65,66,67,68,69,70],"收到不是自己触发的「登录验证码」或者「重置密码」邮件，即使没有点开、没有输入，这本身就说明有人拿着你的账号信息在尝试，密码换掉比观察等待更稳妥。","常用账号突然要求重新登录，或者提示「检测到异常登录」，先别急着当成误报，顺手查一眼登录设备列表。","朋友反馈收到你账号发出的、你自己没发过的消息或者链接，这类情况社交、邮箱账号都常见，通常是账号已经被人登录过一次的信号。","密码突然登录不上，且没有主动重置过，比起「记错了密码」，先考虑账号是不是被人抢先改过密码，越早处理越容易找回。","密码管理工具突然提示某个密码「最近出现在一次已知泄露事件里」，这类提示比自己去查更及时，看到了就该立刻换掉对应账号的密码。","如果收到假冒官方客服的私信索要密码或者验证码，本身就是一次撞库之外的攻击，\u003Ca href=\"\u002Fblog\u002Fphishing-and-fake-vpn-sites\u002F\">钓鱼网站和山寨 VPN 官网怎么认\u003C\u002Fa>那篇讲了具体怎么识别这类套路。",{"type":12,"id":72,"html":73},"bp-final","总结",{"type":7,"html":75},"VPN 管的是网络这一段，账号会不会被盗，几乎总是密码这一环出的问题——大多数事故的起点是同一个密码用在了不止一个地方。把邮箱密码单独设置、用密码管理工具、两步验证选验证器 App 而不是短信，这三件事做到，能挡住大部分真实发生的账号事故。都不算复杂，麻烦的地方只在于要真的去做，而不是知道却一直往后拖。",{"type":7,"html":77},"\u003Ca href=\"\u002Fsecurity\u002F\">快橙\u003C\u002Fa>对传输内容做加密，执行无日志政策，处理的是网络这一层的安全；账号这一层，还是要靠上面这几个习惯。\u003Ca href=\"\u002Forder\u002F\">注册\u003C\u002Fa>后每天有免费试用时长，网络这一段可以先测起来，密码这一环，从今天就能开始补。",[79,82,85,88,91],{"q":80,"a":81},"密码要多复杂才算够安全？","长度比复杂符号更重要，一句无意义但够长的短语通常比「字母+数字+符号」硬凑的八位密码更难被撞库撞中。真正决定安全程度的还是每个账号是不是用了独立的密码，复杂度只是第二位的因素。",{"q":83,"a":84},"密码管理工具本身安全吗，会不会更容易一次性泄露？","比每个网站都用同一个密码安全。主流工具在设计上做到即使服务商的服务器被攻破，储存的密码数据没有主密码也无法还原，跟「一处泄露、全部完蛋」不是一回事。",{"q":86,"a":87},"两步验证的短信验证码和 App 验证码有什么区别？","短信依赖手机信号和运营商通道，出境或者换号时容易收不到；验证器 App 在设备本地生成动态码，不依赖信号，也不受号码转移影响，稳定性更高。",{"q":89,"a":90},"快橙的无日志政策能不能保护我的密码？","不能，无日志政策管的是连接记录不留存，不涉及密码本身。密码安全靠你自己的设置习惯和账号那一端的验证方式，两者是分开的两件事。",{"q":92,"a":93},"收到「有新设备登录」的通知，是不是一定被盗号了？","不一定，换了新手机或者重装了 App 都会触发这类通知。但如果这台设备你不认识，或者同时发现别的异常，就该马上换密码，不要抱着「再观察一下」的心态。",{"blocks":95,"faq":157},[96,98,100,102,104,106,108,110,112,114,116,134,135,137,139,141,143,151,153,155],{"type":7,"html":97},"When an account gets compromised, the first instinct is usually to check whether the network was unsafe, but that's rarely the actual cause. The real reason is almost always the same one: a password reused across more than one place, and one of those places had its database leaked — every other account still using that same password goes down with it.",{"type":7,"html":99},"Ask about VPN security and most people think only of the network layer, but account security has always been two separate lines of defense: a VPN handles whether data gets seen in transit, while passwords and verification handle whether someone else can log in as you. This guide covers the second line specifically — where a VPN's job ends, and exactly how to shore up the password side, along with the signs an account may already be compromised.",{"type":12,"id":13,"html":101},"Why accounts get compromised has little to do with the network",{"type":7,"html":103},"The real sequence behind most "account got hacked" stories looks like this: some obscure site's database gets breached, usernames and passwords leak out in pairs, and whoever has that list tries them against email, social, and payment accounts. If you reused that same password anywhere that matters, the attempt succeeds. This is called credential stuffing, and it has nothing to do with whether you were connected to a VPN or how stable the network was at the time.",{"type":7,"html":105},"Put another way, what an attacker holds isn't a password they "cracked" — it's a password you set yourself, just used in more than one place. Reuse is the single biggest source of account risk there is, more common than any network-side problem, and easier to fall into than it sounds; it's hard for anyone to be certain that not one of the dozens of sites they've signed up for over the years shares a password with something that actually matters.",{"type":7,"html":107},"What makes it worse: a database leak usually isn't put to use right away. It can sit for months or years before being bundled and resold, so an account looking fine so far doesn't mean the password that was reused isn't already sitting on some breach list, waiting for someone to eventually try it.",{"type":12,"id":22,"html":109},"What a VPN covers, and what passwords cover",{"type":7,"html":111},"VPN encryption handles the content on the leg between your device and the node, defending against whoever might be watching the traffic along the way. \u003Ca href=\"\u002Fen\u002Fblog\u002Fvpn-encryption-basics\u002F\">The basics of VPN encryption\u003C\u002Fa> covers that in more depth — but none of it touches whether a password gets caught in credential stuffing. However strong the encryption is, the risk from a reused password is exactly the same, because the two are entirely separate lines of defense.",{"type":7,"html":113},"The reverse holds too: no password, however good, does anything about content being visible on public Wi-Fi — that's squarely the VPN's job. Keeping the two lines separate is what tells you which direction to look when something actually goes wrong, instead of assuming "I'm using a VPN, so I should be fine" right up until an account falls to a five-year-old password. That exact mix-up — treating "using a VPN" as equivalent to "account security handled" — is a large part of why the password side gets neglected for so long.",{"type":12,"id":29,"html":115},"Habits that make passwords hold up",{"type":32,"items":117},[118,122,126,130],{"title":119,"body":120},"A separate password for every account, especially email",[121],"Not sharing passwords across accounts that matter beats making any single password more complex. Email is the special case — most "forgot password" flows recover through it, so a compromised inbox hands over the keys to reset everything else. It deserves to be the one password that's the most unique and the least reused anywhere. The same logic applies to payment accounts: sharing a password with some ordinary site puts it at a completely different risk level than it should be.",{"title":123,"body":124},"Use a password manager instead of relying on memory",[125],"Memory alone can't reliably hold up more than a few genuinely unique passwords — most people start repeating by the fifth or sixth account. A password manager generates and stores them instead, leaving one master password to remember, which is the realistic way most people actually manage a different password for every account, rather than a habit kept up through memory alone. Most mainstream tools also include a duplicate-password check — running it once, right after installing, shows exactly how many accounts have been sharing a password all along.",{"title":127,"body":128},"Turn on two-factor wherever it's offered",[129],"The extra step is genuinely annoying, but once a reused password gets caught in credential stuffing, two-factor is usually the last thing standing between that and an actual login. Which method matters a lot, covered in the next section — for now, the short version: turned on beats not turned on, and the right method beats merely having it turned on. Email, payment, and social accounts are the ones worth covering first; there's no need to tackle every account at once.",{"title":131,"body":132},"Check occasionally whether an account shows up in a known breach",[133],"There are tools online that check whether your email address appears on a known data-breach list. Showing up doesn't mean the account has actually been logged into, but it's worth changing that password anyway, especially if it's still in use somewhere else. Finding your email on one of these lists isn't a reason to panic — the tool is just matching an email address against already-public breach records, which doesn't expose your password in the process.",{"type":51},{"type":12,"id":53,"html":136},"Two-factor: which method matters more than whether it's on",{"type":7,"html":138},"Two-factor comes in more than one form, and they're not equally safe. SMS codes are the most convenient, but they depend on phone signal and a carrier's network, which tends to fail right when traveling, switching numbers, or dealing with a weak signal — \u003Ca href=\"\u002Fen\u002Fblog\u002Fprotect-accounts-when-travelling\u002F\">keeping accounts safe before and after you travel\u003C\u002Fa> covers exactly how to handle that case. SMS carries a second weakness too: the number itself can be ported. If someone tricks a carrier into moving your number to another phone, two-factor tied to that number stops working right along with it.",{"type":7,"html":140},"An authenticator app generates its codes entirely on the device, independent of signal and independent of any carrier, which makes it the steadier choice. The one thing worth doing is backing up the authenticator data, or setting it up on a second device — losing the one phone that held the only copy makes account recovery genuinely difficult, and the handful of recovery codes issued at signup become the only way back in. Setting that up takes three minutes and is exactly the step most people skip, usually remembering it only after actually losing the phone.",{"type":12,"id":60,"html":142},"Signs an account may already be compromised",{"type":63,"items":144},[145,146,147,148,149,150],"A login code or password-reset email arrives that you didn't trigger — even without clicking or entering anything, that alone means someone already has enough of your account information to try. Changing the password beats waiting to see what happens next.","A familiar account suddenly demands a fresh login, or flags "unusual activity" — don't dismiss it as a false alarm; check the device list while you're there.","A friend mentions getting a message or link from your account that you never sent. This shows up on social and email accounts alike, and it usually means the account has already been logged into once by someone else.","A password stops working with no reset requested on your end — before assuming you misremembered it, consider that someone else may have changed it first, and act quickly if so.","A password manager flags that one of your passwords "recently showed up in a known breach" — that kind of alert beats checking manually, and it's worth changing the password the moment it appears.","A message from someone posing as official support asks for a password or a verification code — that's a different kind of attack from credential stuffing, and \u003Ca href=\"\u002Fen\u002Fblog\u002Fphishing-and-fake-vpn-sites\u002F\">how to spot phishing sites and fake VPN storefronts\u003C\u002Fa> covers exactly how to tell those apart from the real thing.",{"type":12,"id":72,"html":152},"In summary",{"type":7,"html":154},"A VPN handles the network side; whether an account gets compromised almost always comes down to the password side instead — most incidents trace back to the same password used in more than one place. Give email its own password, use a password manager, and pick an authenticator app over SMS for two-factor — those three habits alone stop most of the account incidents that actually happen. None of it is complicated; the only hard part is actually doing it instead of knowing it and putting it off.",{"type":7,"html":156},"\u003Ca href=\"\u002Fen\u002Fsecurity\u002F\">FastOrange\u003C\u002Fa> encrypts content in transit and runs a no-logs policy, handling the network side of things; the account side still depends on the habits above. \u003Ca href=\"\u002Fen\u002Forder\u002F\">Signing up\u003C\u002Fa> gets free trial time every day, so the network side is easy to start testing right away — the password side can start today too.",[158,161,164,167,170],{"q":159,"a":160},"How complex does a password actually need to be?","Length matters more than a pile of special characters — a long, meaningless phrase usually resists credential-stuffing better than an eight-character password forced into "letter+number+symbol." What actually decides how safe you are is whether every account has its own password; complexity is a distant second factor.",{"q":162,"a":163},"Is a password manager itself safe? Doesn't it create one point of failure?","It's safer than reusing one password everywhere. Mainstream tools are built so that even if the provider's own servers were breached, the stored passwords can't be recovered without the master password — that's a different situation from one leak wiping out everything.",{"q":165,"a":166},"What's the difference between SMS codes and an authenticator app for two-factor?","SMS depends on phone signal and your carrier, so it's prone to missing codes abroad or after switching numbers. An authenticator app generates codes locally on the device, independent of signal and immune to number-porting, which makes it the steadier option.",{"q":168,"a":169},"Does FastOrange's no-logs policy protect my passwords?","No. A no-logs policy is about not retaining connection records — it has nothing to do with passwords themselves. Password security comes down to your own habits and how verification is set up on the account's side; the two are entirely separate matters.",{"q":171,"a":172},"A "new device login" alert showed up. Does that mean the account's been hacked?","Not necessarily — a new phone or a reinstalled app triggers the same alert. But if the device listed isn't one you recognize, or something else looks off at the same time, change the password right away rather than waiting to see what happens.",1793918312075]