[{"data":1,"prerenderedAt":166},["ShallowReactive",2],{"blog:vpn-encryption-basics":3},{"zh-CN":4,"en":91},{"blocks":5,"faq":75},[6,9,11,13,17,19,26,29,31,33,35,37,40,42,44,46,49,56,59,61,63,66,68,71,73],{"type":7,"html":8},"p","「加密」这个词经常被当成一个万能的安全标签，好像用了就什么都安全了。实际上它只负责一件很具体的事：让数据在传输路径上的内容，变成路上偷看的人读不懂的样子。它不负责你的账号安全，也不负责你的设备安全——这两件事经常被混在一起理解，但完全是两条独立的防线。",{"type":7,"html":10},"这篇讲清楚加密具体覆盖了传输路径上的哪一段、挡住的是什么，以及哪些问题它根本管不到，帮你把「加密」这个词具体拆开来看，而不是当成一句笼统的安心话。不会出现具体的算法名称或者密钥长度——公开去比较这些参数意义不大，真正该弄清楚的是加密这件事本身覆盖的范围。",{"type":7,"html":12},"判断加密对某个场景有没有用，先问自己一句：担心的是「内容被看到」，还是「身份或账号被记录」——这两个问题的答案往往不一样，用同一个词去回答两个不同的问题，才是「加密」听起来含糊的真正原因。",{"type":14,"id":15,"html":16},"h2","bp-scope","加密到底在保护哪一段",{"type":7,"html":18},"把一次连接拆成三段来看会更清楚，加密真正起作用的只有中间这一段：",{"type":20,"items":21,"ordered":25},"list",[22,23,24],"设备到 App 自己——这一段通常是设备操作系统本身的责任，跟 VPN 要处理的加密关系不大。","App 到节点——这是 VPN 加密真正起作用的一段。数据离开设备之后被包进一层加密，路上任何中间环节，包括你连的 Wi-Fi 和运营商，能看到有数据在流动、流向哪里，但读不懂具体内容。","节点到目的网站——如果目的网站本身用的是加密连接（地址栏那把锁的标志），这一段本来就有自己的保护，两层加密叠在一起；如果目的网站本身不用加密，VPN 也没办法替它补上这一层，这是目的网站自己该负责的部分，跟你用不用 VPN 没关系。",true,{"type":14,"id":27,"html":28},"bp-https","HTTPS 和 VPN，解决的不是同一个问题",{"type":7,"html":30},"地址栏那把锁代表的 HTTPS，和 VPN 的加密，经常被当成同一件事的两种叫法，实际上它们保护的范围完全不重合，缺哪一个都会露出一块没被盖住的地方。",{"type":7,"html":32},"HTTPS 保护的是设备和某一个网站之间的这一段内容，不管有没有用 VPN，只要网站本身支持，这段内容路上都读不出来。但它只管这一个网站，同一时间打开的其他没有用 HTTPS 的网站不会跟着被保护，而且它从来不负责隐藏「正在访问哪个网站」这件事——所在的网络通常都能看到打开的是哪个域名，只是看不懂域名下面具体传的内容。",{"type":7,"html":34},"VPN 加密管的是另一段：设备到节点之间，不管接下来要打开的是哪个网站、那个网站自己有没有用 HTTPS，这一段本身先被包了一层，本地网络看到的只是流向节点的一团加密流量，看不出实际访问的是哪个域名。这正好补上 HTTPS 管不到的那一块——「访问的是谁」这件事本身。",{"type":7,"html":36},"两者一起用而不是互相替代，原因也在这里：只开 HTTPS，本地网络看不懂内容，但看得出访问的是哪个域名；只开 VPN、访问的网站本身不用 HTTPS，节点到网站这一段就成了唯一没盖住的地方，前面提到「节点到目的网站」那一段说的正是这种情况。两个各管一段，叠在一起才算完整覆盖。",{"type":14,"id":38,"html":39},"bp-protects","加密具体挡住了什么",{"type":7,"html":41},"挡住的是「内容」，不是「有没有在传输」这件事本身——路上的任何一方都能看到有加密流量经过，只是读不懂里面具体是什么。这一层在使用公共 Wi-Fi 的时候意义最大：机场、咖啡馆这类免密码或者共享密码的热点，同一个网络下的其他设备，理论上能看到未加密流量的内容，加了这一层之后，看到的只是一段读不出内容的数据，跟看一段乱码没什么区别。",{"type":7,"html":43},"换个角度说，这一层保护的价值不取决于「有没有人正在看」，而是「万一有人在看，看到的是什么」。日常大多数时候确实没人盯着某个公共 Wi-Fi，但这一层的意义就在于不用去赌这件事发生的概率。",{"type":45},"downloads",{"type":14,"id":47,"html":48},"bp-limits","加密不负责什么",{"type":20,"items":50},[51,52,53,54,55],"不负责账号安全——密码强度、要不要开二次验证，是另一条完全独立的防线，跟传输链路上有没有加密没关系。","不负责目的网站认不认得出「是你」——登录了哪个账号、填了什么表单，那个网站自己记录得清清楚楚，加密只保护送过去的这一路，送到之后网站怎么处理是它自己的事。","不负责让设备本身更安全——设备中毒、丢失、被别人拿去解锁，这些都跟传输链路上的加密没有关系。","不负责替你隐藏「正在用 VPN」这件事本身——网络管理员通常能看到有加密流量经过、流向哪个节点，只是看不懂内容，这和「完全隐身」不是一回事。","不负责完全抹掉流量的行为特征——内容被加密之后读不出来，但连接的时间点、数据包的大小和节奏，理论上仍然可能透露出一点「大概在做什么类型的事」，这和「内容被看懂」是两个不同层次的问题，混在一起讨论容易得出错误的安全感。",{"type":14,"id":57,"html":58},"bp-myth","一个常见的误解",{"type":7,"html":60},"常见的说法是「用了加密就绝对安全」，这句话把「读不懂内容」和「绝对安全」划了等号，但两者不是一回事。举个例子：加密能防住路上偷看内容的人，防不住你自己把账号密码填进一个钓鱼网站——那个场景里，数据一样是加密传输的，问题出在信任了错误的目的地，不是加密这一层失效了。",{"type":7,"html":62},"同样的道理也适用于设备本身：手机中了木马、被偷偷装了监控软件，那些软件读取的是设备上本来就能看到的内容，跟传输路径上有没有加密完全无关。加密解决的是「路上」的问题，解决不了「两端」本身已经出问题的情况。",{"type":14,"id":64,"html":65},"bp-stable","现在该怎么看待这件事",{"type":7,"html":67},"判断加密对自己有没有用，先想清楚具体场景。担心的是「公共 Wi-Fi 下别人偷看我的流量内容」，加密直接解决这个问题；担心的是「账号会不会被盗」或者「设备丢了怎么办」，那要靠密码管理和设备本身的安全设置，加密帮不上忙。\u003Ca href=\"\u002Fsecurity\u002F\">快橙\u003C\u002Fa> 对传输中的内容做加密处理，配合无日志政策一起，处理的是「内容会不会被看懂」和「记录会不会被留存」这两个问题，但账号和设备这两端，还是要靠你自己的使用习惯。无日志政策具体承诺了什么、又管不到哪些事，\u003Ca href=\"\u002Fblog\u002Fwhat-is-a-no-logs-policy\u002F\">无日志政策到底意味着什么\u003C\u002Fa> 那篇有更详细的拆解。想先知道 VPN 整体解决的是什么问题，\u003Ca href=\"\u002Fblog\u002Fwhat-is-a-vpn\u002F\">VPN 是什么\u003C\u002Fa> 从更基础的地方讲起。",{"type":14,"id":69,"html":70},"bp-final","总结",{"type":7,"html":72},"加密保护的是数据在「设备到节点」这一段传输路径上的内容，不让路上偷看的人读懂里面是什么；它不负责账号安全，不负责设备安全，也不负责隐藏「正在用 VPN」这件事本身。分清这几件事，才知道加密到底解决了你担心的哪个问题。",{"type":7,"html":74},"如果担心的正是公共网络下内容被偷看这一类问题，加密这一层已经覆盖了；如果担心的是账号或设备本身，那要另外花心思，加密解决不了这两端的问题，混着谈只会让人误以为一层保护就够用。\u003Ca href=\"\u002Forder\u002F\">快橙\u003C\u002Fa> 处理传输内容的加密和无日志政策，注册后每天有免费试用时长，先用起来感受一下，再决定要不要长期用。",[76,79,82,85,88],{"q":77,"a":78},"VPN 加密能不能防止网站知道我是谁？","不能。你登录哪个账号、填了什么表单，目的网站自己记录得清清楚楚。加密保护的是送过去这一路的内容，不管送到之后网站怎么处理。",{"q":80,"a":81},"用了加密，我的账号还会被盗吗？","会。账号安全靠的是密码强度和有没有开二次验证，这是完全独立的一条防线，加密不负责这件事。",{"q":83,"a":84},"加密会不会让网速变慢很多？","现代加密对速度的影响很小，日常感觉到的卡顿多数来自线路本身或者节点距离，不是加密运算这一步。",{"q":86,"a":87},"网络管理员能看出我在用 VPN 吗？","通常能看到有加密流量经过、流向哪个方向，只是读不懂里面具体的内容。这和「完全隐身」不是一回事。",{"q":89,"a":90},"快橙的加密具体保护了什么？","保护设备和节点之间传输内容，配合无日志政策一起，处理「内容会不会被看懂」和「记录会不会被留存」这两个问题。账号和设备本身的安全，还是要靠你自己的使用习惯。",{"blocks":92,"faq":150},[93,95,97,99,101,103,108,110,112,114,116,118,120,122,124,125,127,134,136,138,140,142,144,146,148],{"type":7,"html":94},""Encryption" gets treated like an all-purpose safety label, as if using it makes everything safe. In reality it does one very specific job: turning the content of your data in transit into something unreadable to anyone watching along the way. It doesn't cover your account's security, and it doesn't cover your device's security — the two get lumped in together constantly, but they're completely separate lines of defense.",{"type":7,"html":96},"Here's exactly which stretch of the trip encryption covers, what it blocks, and which problems it simply doesn't reach — meant to take the word "encryption" apart into something specific, rather than treat it as one vague, reassuring word. There won't be a specific algorithm name or key length in here: comparing those numbers in public doesn't tell you much that matters. What's actually worth understanding is the scope of what encryption covers in the first place.",{"type":7,"html":98},"Before deciding whether encryption matters for a given situation, ask one question first: is the worry "my content being seen," or "my identity or account being recorded" — the answers to those two are often different, and answering both with the same word is exactly why "encryption" ends up sounding vague.",{"type":14,"id":15,"html":100},"Which stretch of the trip encryption actually covers",{"type":7,"html":102},"Split one connection into three stretches, and encryption only does real work on the middle one:",{"type":20,"items":104,"ordered":25},[105,106,107],"Device to the app itself — this stretch is usually the responsibility of the device's own operating system, and has little to do with the encryption a VPN handles.","App to the node — this is where VPN encryption actually does its job. Once data leaves the device it's wrapped in a layer of encryption; anything in between, including the Wi-Fi you're on and your carrier, can see that data is moving and roughly where, but can't read what's inside it.","Node to the destination site — if the destination site itself uses an encrypted connection (the lock icon in the address bar), that stretch already has its own protection, stacked on top; if the destination site doesn't use encryption, a VPN has no way to add that layer on its behalf — that's the destination site's own responsibility, regardless of whether you're using a VPN.",{"type":14,"id":27,"html":109},"HTTPS and a VPN solve different problems",{"type":7,"html":111},"The lock icon in the address bar, HTTPS, and a VPN's encryption get treated as two names for the same thing. They actually protect completely different, non-overlapping ground, and leaving either one out leaves a gap the other one doesn't cover.",{"type":7,"html":113},"HTTPS protects the stretch between the device and one specific site. As long as that site supports it, that content is unreadable along the way, VPN or no VPN. But it only covers that one site — other sites open at the same time that don't use HTTPS aren't protected the same way, and it never hides which site is being visited in the first place. The network in use can usually still see which domain is being opened, just not what's actually being sent to it.",{"type":7,"html":115},"VPN encryption covers a different stretch: device to node. Regardless of which site comes next, or whether that site itself uses HTTPS, this stretch is wrapped in its own layer first, so the local network only sees a block of encrypted traffic headed to the node, with no visibility into which domain is actually being reached. That fills in exactly what HTTPS doesn't cover: the question of which site is being visited at all.",{"type":7,"html":117},"That's the reason to run both rather than treat one as a substitute for the other: with only HTTPS, the local network can't read the content but can still see the domain; with only a VPN, if the destination site itself doesn't use HTTPS, the stretch from node to that site becomes the one part left uncovered — exactly the case described earlier as "node to destination site." Each one covers a different stretch, and only stacked together do they cover the whole trip.",{"type":14,"id":38,"html":119},"What encryption actually blocks",{"type":7,"html":121},"It blocks "content," not the fact that something is being transmitted at all — anyone along the way can still see that encrypted traffic is passing through, they just can't read what's inside it. This matters most on public Wi-Fi: at an airport or coffee shop, on a password-free or shared-password hotspot, other devices on the same network could, in principle, see the content of unencrypted traffic. With this layer added, what they see instead is a block of unreadable data, no different from looking at gibberish.",{"type":7,"html":123},"Put another way, the value of this layer doesn't depend on "whether someone is actually watching" — it's about "what they'd see if they were." Most of the time nobody is actually watching a given public Wi-Fi network, but the point of this layer is exactly that you don't have to bet on those odds.",{"type":45},{"type":14,"id":47,"html":126},"What encryption doesn't cover",{"type":20,"items":128},[129,130,131,132,133],"Account security — password strength and whether extra verification is on are a completely separate line of defense, unrelated to whether the transit link is encrypted.","Whether the destination site recognizes "you" — whatever account you log into and whatever you type into a form is recorded by that site in full; encryption only protects the trip there, not what the site does once it arrives.","Making the device itself more secure — malware, a lost device, someone else unlocking it — none of that has anything to do with encryption on the transit link.","Hiding the fact that you're "using a VPN" at all — a network administrator can usually see that encrypted traffic is passing through and which node it's headed to, just not the content. That's not the same thing as being completely invisible.","Fully erasing behavioral patterns in the traffic — the content itself becomes unreadable once encrypted, but the timing of connections and the size and rhythm of data packets can, in principle, still hint at "roughly what kind of thing is happening." That's a different layer of the problem from "can the content be read," and blurring the two leads to a false sense of security.",{"type":14,"id":57,"html":135},"A common misunderstanding",{"type":7,"html":137},"A common line is "encryption means I'm completely safe," which treats "unreadable content" and "completely safe" as the same thing — they aren't. Take an example: encryption stops someone along the way from reading your content, but it does nothing to stop you from typing your own account password into a phishing site. In that scenario, the data is still encrypted in transit; the problem is trusting the wrong destination, not encryption failing at its own job.",{"type":7,"html":139},"The same logic applies to the device itself: a phone infected with malware, or with spyware quietly installed on it, is reading content the device could already see on its own — that has nothing to do with whether the transit link is encrypted. Encryption solves problems "on the way." It doesn't solve problems that already exist at either end.",{"type":14,"id":64,"html":141},"How to think about this now",{"type":7,"html":143},"Deciding whether encryption matters for you starts with naming the actual scenario. Worried about "someone on public Wi-Fi seeing the content of my traffic" — encryption directly handles that. Worried about "my account getting stolen" or "what happens if I lose my device" — that comes down to password management and the device's own security settings, and encryption can't help there. \u003Ca href=\"\u002Fen\u002Fsecurity\u002F\">FastOrange\u003C\u002Fa> encrypts content in transit and pairs that with a no-logs policy, together handling whether content can be read and whether a record gets kept — but the account and the device are still down to your own habits. For exactly what a no-logs policy promises and what it doesn't reach, \u003Ca href=\"\u002Fen\u002Fblog\u002Fwhat-is-a-no-logs-policy\u002F\">what a no-logs policy actually means\u003C\u002Fa> breaks that down in more depth. To start from an even more basic question of what a VPN solves in the first place, \u003Ca href=\"\u002Fen\u002Fblog\u002Fwhat-is-a-vpn\u002F\">what a VPN is\u003C\u002Fa> covers that from the ground up.",{"type":14,"id":69,"html":145},"In summary",{"type":7,"html":147},"Encryption protects the content of data on the stretch between your device and the node, keeping anyone watching along the way from reading what's inside — it doesn't cover account security, doesn't cover device security, and doesn't hide the fact that you're using a VPN in the first place. Keeping these apart is what tells you which of your actual worries encryption solves.",{"type":7,"html":149},"If what you're worried about is content being read on a public network, this layer already covers it. If what you're worried about is your account or your device, that takes separate attention — encryption doesn't reach either end, and treating it as one blanket layer of protection is exactly what leads people astray. \u003Ca href=\"\u002Fen\u002Forder\u002F\">FastOrange\u003C\u002Fa> handles encryption of content in transit along with a no-logs policy, and every registered account gets free trial time daily — try it first, then decide whether it's worth keeping long term.",[151,154,157,160,163],{"q":152,"a":153},"Can VPN encryption stop a site from knowing who I am?","No. Whatever account you log into and whatever you type into a form is recorded by that site itself, in full. Encryption protects the content on the way there — it has no say in what the site does with it once it arrives.",{"q":155,"a":156},"Can my account still get stolen if I'm using encryption?","Yes. Account security comes down to password strength and whether extra verification is turned on — a completely separate line of defense that encryption has no part in.",{"q":158,"a":159},"Does encryption slow the connection down a lot?","Modern encryption has very little impact on speed. The lag people actually notice day to day almost always comes from the route itself or the distance to the node, not the encryption step.",{"q":161,"a":162},"Can a network administrator tell I'm using a VPN?","Usually, yes — they can see that encrypted traffic is passing through and roughly where it's headed, just not what's inside it. That's not the same thing as being completely invisible.",{"q":164,"a":165},"What does FastOrange's encryption specifically protect?","It protects the content moving between your device and the node, paired with a no-logs policy — together they handle whether content can be read and whether a record gets kept. The security of your account and your device still comes down to your own habits.",1793918312075]