七個(gè)專(zhuān)業(yè)步驟，保障你的信息安全

There are more reasons than ever to understand how to protect your personal information.

現(xiàn)在比過(guò)去任何時(shí)候都更需要搞清楚如何保護(hù)你的個(gè)人信息。

Major hacks seem ever more frequent. Investigators believe that a set of top-secret National Security Agency hacking tools were offered to online bidders this summer.

大規(guī)模的黑客襲擊似乎比以前更加頻繁了。調(diào)查人員相信，一系列絕密?chē)?guó)家安全機(jī)構(gòu)黑客工具在今年夏天被提供給了網(wǎng)上的競(jìng)拍者。

And many of those worried about expanded government surveillance by the N.S.A. and other agencies have taken steps to secure their communications.

他們中有許多人對(duì)美國(guó)國(guó)家安全局(NSA)和其他政府機(jī)構(gòu)不斷擴(kuò)大的監(jiān)控感到擔(dān)憂，開(kāi)始采取措施，保障自身的通信安全。

In a recent Medium post, Quincy Larson, the founder of Free Code Camp, an open-source community for learning to code, detailed the reasons it might be useful for people to make their personal data more difficult for attackers to access.

學(xué)習(xí)編程的開(kāi)源社區(qū)自由編程營(yíng)(Free Code Camp)創(chuàng)始人昆西·拉森(Quincy Larson)最近在Medium網(wǎng)站發(fā)表了一篇文章，詳細(xì)解釋了為何人們將個(gè)人數(shù)據(jù)變得更難讓襲擊者獲得是有益的。

“When I use the term ‘attacker’ I mean anyone trying to access your data whom you haven’t given express permission to,” he wrote. “Whether it’s a hacker, a corporation, or even a government.”

“這里的‘襲擊者’，是指任何未經(jīng)你的允許試圖獲取你的數(shù)據(jù)的人，”他寫(xiě)道。“不管它是黑客、企業(yè)，還是政府。”

In an interview, Mr. Larson walked us through some of the basic steps he recommended. We added a few of our own, based on additional interviews.

在接受采訪時(shí)，拉森給我介紹了一些他推薦的基本步驟。我們基于其他采訪又增添了幾條自己的建議。

We encourage you to write back with feedback on this article. If the instructions are too vague, the apps aren’t working for you or you have additional questions, we want to hear about it. Send an email to [email protected].

我們鼓勵(lì)你就這篇文章寫(xiě)下反饋發(fā)給我們。如果你覺(jué)得文字說(shuō)明不夠清楚，應(yīng)用不起作用，或有其他疑問(wèn)，我們也很樂(lè)于知道。請(qǐng)發(fā)郵件到[email protected]。

Now, let’s encrypt.

現(xiàn)在，讓我們開(kāi)始加密。

1. Download Signal, or Start Using WhatsApp to send text messages.

1.下載Signal，或使用WhatsApp發(fā)送短信。

Encryption is a fancy computer-person word for scrambling your data until no one can understand what it says without a key. But encrypting is more complex than just switching a couple of letters around.

加密是一個(gè)高大上的計(jì)算機(jī)術(shù)語(yǔ)，意思是對(duì)你的數(shù)據(jù)加以處理，直到?jīng)]有密鑰就沒(méi)有人能理解它為止。但加密絕不僅僅是調(diào)換幾個(gè)字母那么簡(jiǎn)單。

Mr. Larson said that by some estimates, with the default encryption scheme that Apple uses, “you’d have to have a supercomputer crunching day and night for years to be able to unlock a single computer.”

拉爾森說(shuō)，據(jù)估計(jì)，使用蘋(píng)果的默認(rèn)加密方案，“你必須有一臺(tái)超級(jí)計(jì)算機(jī)晝夜不停的運(yùn)轉(zhuǎn)很多年，才能解鎖一臺(tái)計(jì)算機(jī)。”

He said that the best way to destroy data was not to delete it, because it could potentially be resurrected from a hard drive, but to encode it in “a secure form of cryptography.”

他說(shuō)，銷(xiāo)毀數(shù)據(jù)的最佳方法是不刪除數(shù)據(jù)，而是以“加密安全形式”進(jìn)行編碼，因?yàn)閯h除的數(shù)據(jù)可以從硬盤(pán)驅(qū)動(dòng)器里恢復(fù)。

Signal is one of the most popular apps for those who want to protect their text messaging. It is free and extremely easy to use. And unlike Apple’s iMessage, which is also encrypted, the code it uses to operate is open-source.

如果你想保護(hù)自己的短信，Signal是人氣最高的此類(lèi)應(yīng)用之一。它是免費(fèi)的，非常容易使用。蘋(píng)果的iMessage雖然也是能加密，但Signal使用的代碼是開(kāi)源的，這和iMessage不同。

“You can be sure by looking at the code that they’re not doing anything weird with your data,” Mr. Larson said.

“看一看代碼，你就能確定他們沒(méi)有對(duì)你的數(shù)據(jù)做過(guò)奇怪的事情，”拉爾森說(shuō)。

“In general, the idea behind the app is to make privacy and communication as simple as possible,” said Moxie Marlinspike, the founder of Open Whisper Systems, the organization that developed Signal.

“總的來(lái)說(shuō)，這個(gè)應(yīng)用的想法是讓隱私保護(hù)和交流盡可能地簡(jiǎn)單，”開(kāi)發(fā)出Signal的公司開(kāi)放耳語(yǔ)系統(tǒng)(Open Whisper Systems)的創(chuàng)始人莫克西·馬林斯派克(Moxie Marlinspike)說(shuō)。

That means that the app allows you to use emojis, send pictures and enter group texts.

這意味著該應(yīng)用允許你使用顏文字、發(fā)送圖片和群發(fā)文字。

One bit of friction: You do have to persuade your friends to join the service too, if you want to text them. The app makes that easy to do.

有一個(gè)不利因素：如果想給朋友們發(fā)訊息，就必須說(shuō)服他們也加入該服務(wù)使用者的行列。但它讓這個(gè)過(guò)程變得很容易。

WhatsApp, the popular chat tool, uses Signal’s software to encrypt its messaging. And in Facebook Messenger and Google’s texting app Allo, you can turn on an option that encrypts your messages.

很受歡迎的聊天工具WhatsApp使用Signal的軟件為自己的通訊信息加密。在Facebook Messenger和谷歌(Google)的通訊應(yīng)用程序Allo中，你可以啟用為訊息加密的選項(xiàng)。

Here’s how to do that on Facebook. Here’s how to do it on Allo.

點(diǎn)擊這里查看如何在Facebook上這樣做。點(diǎn)擊這里查看如何在Allo上這樣做。

Mr. Marlinspike said that the presidential election had sparked a lot of interested in Signal, leading to a “substantial increase in users.”

馬林斯派克說(shuō)，總統(tǒng)選舉激發(fā)了很多人對(duì)Signal的興趣，導(dǎo)致“用戶數(shù)量大幅增加”。

When asked to speculate why that was, Mr. Marlinspike simply said, “Donald Trump is about to be in control of the most powerful, invasive and least accountable surveillance apparatus in the world.”

被問(wèn)及個(gè)中原因時(shí)，馬林斯派克簡(jiǎn)單地說(shuō)道，“唐納德·特朗普(Donald Trump)即將控制世界上最具影響力和侵略性、且最不可能被問(wèn)責(zé)的監(jiān)控機(jī)構(gòu)。”

To download Signal, click here for iOS, or here for Android.

點(diǎn)擊這里下載iOS版Signal，或者點(diǎn)擊這里下載安卓版Signal。

2. Protect your computer’s hard drive with FileVault orBitLocker.

2. 用FileVault或者BitLocker保護(hù)你的電腦硬件。

Your phone may be the device that lives in your pocket, but Mr. Larson described the computer as the real gold mine for personal information.

你或許總是把手機(jī)帶在身邊，但馬林斯派克認(rèn)為電腦才是真正的個(gè)人信息金礦。

Even if your data were password protected, someone who gained access to your computer “would have access to all your files if they were unencrypted.”

即便你的數(shù)據(jù)受到密碼保護(hù)，某個(gè)進(jìn)入你電腦的人還是“可以看到你的所有文件，如果它們沒(méi)有被加密的話”。

Luckily, both Apple and Windows offer means of automatic encryption that simply need to be turned on.

幸運(yùn)的是，蘋(píng)果和Windows都提供了自動(dòng)加密工具，只需啟用即可。

Here’s the link to do that for Apple computers. Here’s the one for Windows computers.

點(diǎn)擊這里為蘋(píng)果電腦加密。點(diǎn)擊這里為使用Windows的電腦加密。

3. The way you handle your passwords is probably wrong and bad.

3. 你處理密碼的方式可能是錯(cuò)誤而糟糕的。

You know this by now. Changing your passwords frequently is one of the simplest things you can do to protect yourself from digital invasion.

現(xiàn)在你已經(jīng)知道了這一點(diǎn)。為了保護(hù)自己免遭數(shù)碼入侵，你能做的最簡(jiǎn)單的事情之一就是常常更換密碼。

But making up new combinations all the time is a hassle.

不過(guò)，不停地創(chuàng)建新的密碼是一件麻煩事。

Mr. Larson recommends password managers, which help store many passwords, with one master password. He said that he uses LastPass, but knows plenty of people who use 1Password and KeePass, and that he doesn’t have a strong reason to recommend one over another.

拉爾森推薦使用可以幫助保存很多密碼，且只需記住一個(gè)主密碼的密碼管理器。他說(shuō)自己用的是LastPass，但知道很多人都在用1Password和KeePass，而他沒(méi)有什么強(qiáng)有力的理由來(lái)建議大家選擇某一種而非另外兩種。

Not every security expert trusts password managers. Some noted that LastPass itself got hacked last year.

并非每個(gè)安全專(zhuān)家都信任密碼管理器。一些專(zhuān)家指出，LastPass本身去年就遭到了入侵。

So that means you may want to write them down in one secure location, perhaps a Post-it note at home. It seems more far-fetched that a hacker would bother to break into your home for a Post-it note than find a way into your computer.

因此你或許想要把密碼寫(xiě)在一個(gè)秘密的地方，也許是家里的一張即時(shí)貼上。黑客更加沒(méi)有可能為了設(shè)法進(jìn)入你的電腦而費(fèi)事闖進(jìn)你家尋找一張即時(shí)貼。

If you take that route, we suggest setting a weekly or biweekly calendar reminder to change your passwords.

如果你采用這種方法，我們建議你在日歷中設(shè)定每周一次或者每?jī)芍芤淮蔚母鼡Q密碼任務(wù)提醒。

As far as making passwords up goes: Don’t be precious about it. Use a random word (an object near you while you’re hunched over your Post-it) and a combination of numbers. If you’re writing passwords down, you don’t have to worry about making them memorable.

至于密碼的創(chuàng)建，建議你不要過(guò)分講究。使用一個(gè)隨機(jī)的詞(例如當(dāng)你湊近即時(shí)貼的時(shí)候，身旁的一個(gè)物件)再加上一組數(shù)字。如果你會(huì)把密碼寫(xiě)下來(lái)，就不必?fù)?dān)心如何才能讓它們便于記憶了。

4. Protect your email and other accounts with two-factor authentication.

4. 用兩步驗(yàn)證保護(hù)你的電子郵箱以及其他賬號(hào)。

When you turn this step on, anyone trying to sign in to your email from new devices will have to go through a secondary layer of security: a code to access the inbox that is sent to your phone via text message. (Though sadly, not through Signal.)

當(dāng)你啟用這一功能時(shí)，任何試圖在陌生設(shè)備上登陸你的郵箱的人，都必須通過(guò)兩步驗(yàn)證：用以進(jìn)入郵箱的驗(yàn)證碼會(huì)通過(guò)短信發(fā)送到你的手機(jī)上。(遺憾的是，不是通過(guò)Signal。)

Here’s the link for turning on two-factor authentication for Gmail accounts. 點(diǎn)擊這里查看如何為Gmail帳號(hào)啟用兩步驗(yàn)證。

Here’s the one for Yahoo accounts, and here’s one you can use for Outlook accounts.

點(diǎn)擊這里查看如何為雅虎(Yahoo)帳號(hào)啟用兩步驗(yàn)證;點(diǎn)擊這里查看如何為Outlook帳號(hào)啟用兩步驗(yàn)證。

You can also set two-factor authentication for social media accounts and other sites. But email is the most important account, since many sites use email for password recovery, a fact that has been exploited by hackers. Once they have access to your email, they can get access to banking, social media, data backups and work accounts.

你還可以為社交媒體賬號(hào)以及其他網(wǎng)站設(shè)置兩步驗(yàn)證。但電子郵箱才是最重要的賬號(hào)，因?yàn)楹芏嗑W(wǎng)站都用電子郵箱進(jìn)行密碼恢復(fù)，黑客們已經(jīng)在利用這一點(diǎn)了。他們一旦進(jìn)入你的郵箱，就可以攻克你的銀行、社交媒體、數(shù)據(jù)備份和工作賬號(hào)。

5. Use a browser plug-in called HTTPS Everywhere.

5. 使用一個(gè)名叫HTTPS Everywhere的瀏覽器插件。

Mr. Marlinspike recommended this plug-in, developed by the Electronic Frontier Foundation, a digital security organization. It ensures that you are accessing the secure form of websites, meaning that your connection to the site will be encrypted, and that you will be protected from various forms of surveillance and hacking.

馬林斯派克推薦的這個(gè)插件是由數(shù)字安全機(jī)構(gòu)電子前哨基金會(huì)(Electronic Frontier Foundation)開(kāi)發(fā)的。它能確保你以安全的方式訪問(wèn)網(wǎng)站。這意味著你對(duì)網(wǎng)站的訪問(wèn)會(huì)被加密，從而保護(hù)你免遭各種形式的監(jiān)控和入侵。

Download HTTPS Everywhere for Chrome here. For Firefox here.

點(diǎn)擊這里下載Chrome版HTTPS Everywhere。點(diǎn)擊這里下載火狐(Firefox)版HTTPS Everywhere。

Here’s a list of FAQ’s about the plug-in, including whether it is available for other browsers.

點(diǎn)擊這里查看關(guān)于該插件的常見(jiàn)問(wèn)題解答，包括它是否適用于其他瀏覽器。

And this is a good time to note that you should always be aware whether the Wi-Fi network you’re using is secure. Public networks — and even private networks without security keys — often are not.

借此機(jī)會(huì)還要指出，你應(yīng)該時(shí)時(shí)警惕自己使用的Wi-Fi網(wǎng)絡(luò)是否安全。公共網(wǎng)絡(luò)——乃至沒(méi)有安全密匙的私人網(wǎng)絡(luò)——通常并不安全。

6. Remember that incognito mode isn’t always private.

6. 切記，隱身模式并非總能保護(hù)隱私。

You may be in such a hurry to use this feature, available on Chrome, Safari and Firefox, among other browsers, that you do not heed its clear warning.

你或許急匆匆地使用了這個(gè)在Chrome、Safari、火狐以及其他一些瀏覽器上都能見(jiàn)到的功能，卻沒(méi)有注意到它發(fā)出的明確警告。

On Chrome, the second paragraph of the “incognito” home screen is clear.

在Chrome上打開(kāi)介紹“隱身”模式的頁(yè)面，第二段寫(xiě)得清清楚楚。

“You aren’t invisible,” it says. “Going incognito doesn’t hide your browsing from your employer, your internet service provider, or the websites you visit.”

“您的活動(dòng)并非無(wú)法被察覺(jué)，”那上面說(shuō)。“使用隱身模式后，您的雇主、您的互聯(lián)網(wǎng)服務(wù)提供商或者您訪問(wèn)的網(wǎng)站本身，還是可以查看您的網(wǎng)站訪問(wèn)活動(dòng)記錄。”

Mr. Larson recommended Tor in his article, a browser that allows for private web activity. But we’re not going to recommend that here, mostly because Tor is relatively slow and clunky at the moment.

拉爾森在他的文章中推薦了Tor，一款讓人得以進(jìn)行私密網(wǎng)絡(luò)活動(dòng)的瀏覽器。但我們?cè)谶@里不會(huì)做這樣的推薦，主要原因是Tor目前較為緩慢和笨重。

“I’ll be honest, I don’t use it very often,” Mr. Larson said.

“說(shuō)老實(shí)話，我并沒(méi)有非常頻繁地使用它，”拉爾森說(shuō)。

He said that he suspected other browsers would start adding ways to browse more securely.

他說(shuō)他預(yù)計(jì)其他瀏覽器也會(huì)著手添加能讓人更安全地瀏覽網(wǎng)頁(yè)的功能。

“Apple is very security conscious,” he said. “I wouldn’t be surprised if they started to incorporate Tor-like features into Safari.”

“蘋(píng)果的安全意識(shí)非常強(qiáng)，”他說(shuō)。“如果他們開(kāi)始把類(lèi)似于Tor的功能融入Safari，我一點(diǎn)兒也不會(huì)感到驚訝。”

7. Do sensitive searches in DuckDuckGo.

7. 用DuckDuckGo進(jìn)行較為敏感的搜索。

Mr. Larson said that if people were paranoid about Google, he would strongly encourage them to use DuckDuckGo, an alternative search engine.

拉爾森說(shuō)，如果有人對(duì)谷歌極度不放心，他會(huì)強(qiáng)烈推薦他們使用另一款搜索引擎DuckDuckGo。

He said however, that he personally, was not paranoid.

不過(guò)他說(shuō)，他本人對(duì)谷歌并無(wú)成見(jiàn)。

“Google is built on the hacker ethic and they have put principle above profits in some aspects,” he said.

“谷歌的創(chuàng)建以黑客倫理為基礎(chǔ)，他們?cè)谀承┓矫媸前言瓌t置于利潤(rùn)之上的，”他說(shuō)。

But he also acknowledged that he meets “people all the time who are extremely skeptical of any large software organization and I think that’s reasonable.” There are trade-offs. Google’s search results are more useful and accurate than competitors’ precisely because of the ways it collects and analyzes information about its customers’ searches.

但他也承認(rèn)，他“常常”遇到“對(duì)所有大型軟件組織都心懷疑慮的人，而且我覺(jué)得他們持這種態(tài)度也是合情合理的”。有利就有弊。與競(jìng)爭(zhēng)對(duì)手相比，谷歌的搜索結(jié)果更有用，也更準(zhǔn)確，但這恰恰是因?yàn)樗鼤?huì)搜集并分析與用戶的搜索活動(dòng)有關(guān)的信息。

A Bonus: Cover your webcam with tape.

附贈(zèng)錦囊一枚：用膠帶蓋住攝像頭。

That way, if someone has found a way to compromise your computer, they cannot spy on you through its camera.

這樣一來(lái)，即便有人得以入侵你的電腦，也無(wú)法通過(guò)電腦上的攝像頭窺視你。

And yes, this happens.

沒(méi)錯(cuò)，這種事情不是沒(méi)發(fā)生過(guò)。

Happy encryption.

祝加密愉快。