七個專業(yè)步驟，保障你的信息安全

There are more reasons than ever to understand how to protect your personal information.

現(xiàn)在比過去任何時候都更需要搞清楚如何保護你的個人信息。

Major hacks seem ever more frequent. Investigators believe that a set of top-secret National Security Agency hacking tools were offered to online bidders this summer.

大規(guī)模的黑客襲擊似乎比以前更加頻繁了。調查人員相信，一系列絕密國家安全機構黑客工具在今年夏天被提供給了網(wǎng)上的競拍者。

And many of those worried about expanded government surveillance by the N.S.A. and other agencies have taken steps to secure their communications.

他們中有許多人對美國國家安全局(NSA)和其他政府機構不斷擴大的監(jiān)控感到擔憂，開始采取措施，保障自身的通信安全。

In a recent Medium post, Quincy Larson, the founder of Free Code Camp, an open-source community for learning to code, detailed the reasons it might be useful for people to make their personal data more difficult for attackers to access.

學習編程的開源社區(qū)自由編程營(Free Code Camp)創(chuàng)始人昆西·拉森(Quincy Larson)最近在Medium網(wǎng)站發(fā)表了一篇文章，詳細解釋了為何人們將個人數(shù)據(jù)變得更難讓襲擊者獲得是有益的。

“When I use the term ‘attacker’ I mean anyone trying to access your data whom you haven’t given express permission to,” he wrote. “Whether it’s a hacker, a corporation, or even a government.”

“這里的‘襲擊者’，是指任何未經(jīng)你的允許試圖獲取你的數(shù)據(jù)的人，”他寫道。“不管它是黑客、企業(yè)，還是政府。”

In an interview, Mr. Larson walked us through some of the basic steps he recommended. We added a few of our own, based on additional interviews.

在接受采訪時，拉森給我介紹了一些他推薦的基本步驟。我們基于其他采訪又增添了幾條自己的建議。

We encourage you to write back with feedback on this article. If the instructions are too vague, the apps aren’t working for you or you have additional questions, we want to hear about it. Send an email to [email protected].

我們鼓勵你就這篇文章寫下反饋發(fā)給我們。如果你覺得文字說明不夠清楚，應用不起作用，或有其他疑問，我們也很樂于知道。請發(fā)郵件到[email protected]。

Now, let’s encrypt.

現(xiàn)在，讓我們開始加密。

1. Download Signal, or Start Using WhatsApp to send text messages.

1.下載Signal，或使用WhatsApp發(fā)送短信。

Encryption is a fancy computer-person word for scrambling your data until no one can understand what it says without a key. But encrypting is more complex than just switching a couple of letters around.

加密是一個高大上的計算機術語，意思是對你的數(shù)據(jù)加以處理，直到?jīng)]有密鑰就沒有人能理解它為止。但加密絕不僅僅是調換幾個字母那么簡單。

Mr. Larson said that by some estimates, with the default encryption scheme that Apple uses, “you’d have to have a supercomputer crunching day and night for years to be able to unlock a single computer.”

拉爾森說，據(jù)估計，使用蘋果的默認加密方案，“你必須有一臺超級計算機晝夜不停的運轉很多年，才能解鎖一臺計算機。”

He said that the best way to destroy data was not to delete it, because it could potentially be resurrected from a hard drive, but to encode it in “a secure form of cryptography.”

他說，銷毀數(shù)據(jù)的最佳方法是不刪除數(shù)據(jù)，而是以“加密安全形式”進行編碼，因為刪除的數(shù)據(jù)可以從硬盤驅動器里恢復。

Signal is one of the most popular apps for those who want to protect their text messaging. It is free and extremely easy to use. And unlike Apple’s iMessage, which is also encrypted, the code it uses to operate is open-source.

如果你想保護自己的短信，Signal是人氣最高的此類應用之一。它是免費的，非常容易使用。蘋果的iMessage雖然也是能加密，但Signal使用的代碼是開源的，這和iMessage不同。

“You can be sure by looking at the code that they’re not doing anything weird with your data,” Mr. Larson said.

“看一看代碼，你就能確定他們沒有對你的數(shù)據(jù)做過奇怪的事情，”拉爾森說。

“In general, the idea behind the app is to make privacy and communication as simple as possible,” said Moxie Marlinspike, the founder of Open Whisper Systems, the organization that developed Signal.

“總的來說，這個應用的想法是讓隱私保護和交流盡可能地簡單，”開發(fā)出Signal的公司開放耳語系統(tǒng)(Open Whisper Systems)的創(chuàng)始人莫克西·馬林斯派克(Moxie Marlinspike)說。

That means that the app allows you to use emojis, send pictures and enter group texts.

這意味著該應用允許你使用顏文字、發(fā)送圖片和群發(fā)文字。

One bit of friction: You do have to persuade your friends to join the service too, if you want to text them. The app makes that easy to do.

有一個不利因素：如果想給朋友們發(fā)訊息，就必須說服他們也加入該服務使用者的行列。但它讓這個過程變得很容易。

WhatsApp, the popular chat tool, uses Signal’s software to encrypt its messaging. And in Facebook Messenger and Google’s texting app Allo, you can turn on an option that encrypts your messages.

很受歡迎的聊天工具WhatsApp使用Signal的軟件為自己的通訊信息加密。在Facebook Messenger和谷歌(Google)的通訊應用程序Allo中，你可以啟用為訊息加密的選項。

Here’s how to do that on Facebook. Here’s how to do it on Allo.

點擊這里查看如何在Facebook上這樣做。點擊這里查看如何在Allo上這樣做。

Mr. Marlinspike said that the presidential election had sparked a lot of interested in Signal, leading to a “substantial increase in users.”

馬林斯派克說，總統(tǒng)選舉激發(fā)了很多人對Signal的興趣，導致“用戶數(shù)量大幅增加”。

When asked to speculate why that was, Mr. Marlinspike simply said, “Donald Trump is about to be in control of the most powerful, invasive and least accountable surveillance apparatus in the world.”

被問及個中原因時，馬林斯派克簡單地說道，“唐納德·特朗普(Donald Trump)即將控制世界上最具影響力和侵略性、且最不可能被問責的監(jiān)控機構。”

To download Signal, click here for iOS, or here for Android.

點擊這里下載iOS版Signal，或者點擊這里下載安卓版Signal。

2. Protect your computer’s hard drive with FileVault orBitLocker.

2. 用FileVault或者BitLocker保護你的電腦硬件。

Your phone may be the device that lives in your pocket, but Mr. Larson described the computer as the real gold mine for personal information.

你或許總是把手機帶在身邊，但馬林斯派克認為電腦才是真正的個人信息金礦。

Even if your data were password protected, someone who gained access to your computer “would have access to all your files if they were unencrypted.”

即便你的數(shù)據(jù)受到密碼保護，某個進入你電腦的人還是“可以看到你的所有文件，如果它們沒有被加密的話”。

Luckily, both Apple and Windows offer means of automatic encryption that simply need to be turned on.

幸運的是，蘋果和Windows都提供了自動加密工具，只需啟用即可。

Here’s the link to do that for Apple computers. Here’s the one for Windows computers.

點擊這里為蘋果電腦加密。點擊這里為使用Windows的電腦加密。

3. The way you handle your passwords is probably wrong and bad.

3. 你處理密碼的方式可能是錯誤而糟糕的。

You know this by now. Changing your passwords frequently is one of the simplest things you can do to protect yourself from digital invasion.

現(xiàn)在你已經(jīng)知道了這一點。為了保護自己免遭數(shù)碼入侵，你能做的最簡單的事情之一就是常常更換密碼。

But making up new combinations all the time is a hassle.

不過，不停地創(chuàng)建新的密碼是一件麻煩事。

Mr. Larson recommends password managers, which help store many passwords, with one master password. He said that he uses LastPass, but knows plenty of people who use 1Password and KeePass, and that he doesn’t have a strong reason to recommend one over another.

拉爾森推薦使用可以幫助保存很多密碼，且只需記住一個主密碼的密碼管理器。他說自己用的是LastPass，但知道很多人都在用1Password和KeePass，而他沒有什么強有力的理由來建議大家選擇某一種而非另外兩種。

Not every security expert trusts password managers. Some noted that LastPass itself got hacked last year.

并非每個安全專家都信任密碼管理器。一些專家指出，LastPass本身去年就遭到了入侵。

So that means you may want to write them down in one secure location, perhaps a Post-it note at home. It seems more far-fetched that a hacker would bother to break into your home for a Post-it note than find a way into your computer.

因此你或許想要把密碼寫在一個秘密的地方，也許是家里的一張即時貼上。黑客更加沒有可能為了設法進入你的電腦而費事闖進你家尋找一張即時貼。

If you take that route, we suggest setting a weekly or biweekly calendar reminder to change your passwords.

如果你采用這種方法，我們建議你在日歷中設定每周一次或者每兩周一次的更換密碼任務提醒。

As far as making passwords up goes: Don’t be precious about it. Use a random word (an object near you while you’re hunched over your Post-it) and a combination of numbers. If you’re writing passwords down, you don’t have to worry about making them memorable.

至于密碼的創(chuàng)建，建議你不要過分講究。使用一個隨機的詞(例如當你湊近即時貼的時候，身旁的一個物件)再加上一組數(shù)字。如果你會把密碼寫下來，就不必擔心如何才能讓它們便于記憶了。

4. Protect your email and other accounts with two-factor authentication.

4. 用兩步驗證保護你的電子郵箱以及其他賬號。

When you turn this step on, anyone trying to sign in to your email from new devices will have to go through a secondary layer of security: a code to access the inbox that is sent to your phone via text message. (Though sadly, not through Signal.)

當你啟用這一功能時，任何試圖在陌生設備上登陸你的郵箱的人，都必須通過兩步驗證：用以進入郵箱的驗證碼會通過短信發(fā)送到你的手機上。(遺憾的是，不是通過Signal。)

Here’s the link for turning on two-factor authentication for Gmail accounts. 點擊這里查看如何為Gmail帳號啟用兩步驗證。

Here’s the one for Yahoo accounts, and here’s one you can use for Outlook accounts.

點擊這里查看如何為雅虎(Yahoo)帳號啟用兩步驗證;點擊這里查看如何為Outlook帳號啟用兩步驗證。

You can also set two-factor authentication for social media accounts and other sites. But email is the most important account, since many sites use email for password recovery, a fact that has been exploited by hackers. Once they have access to your email, they can get access to banking, social media, data backups and work accounts.

你還可以為社交媒體賬號以及其他網(wǎng)站設置兩步驗證。但電子郵箱才是最重要的賬號，因為很多網(wǎng)站都用電子郵箱進行密碼恢復，黑客們已經(jīng)在利用這一點了。他們一旦進入你的郵箱，就可以攻克你的銀行、社交媒體、數(shù)據(jù)備份和工作賬號。

5. Use a browser plug-in called HTTPS Everywhere.

5. 使用一個名叫HTTPS Everywhere的瀏覽器插件。

Mr. Marlinspike recommended this plug-in, developed by the Electronic Frontier Foundation, a digital security organization. It ensures that you are accessing the secure form of websites, meaning that your connection to the site will be encrypted, and that you will be protected from various forms of surveillance and hacking.

馬林斯派克推薦的這個插件是由數(shù)字安全機構電子前哨基金會(Electronic Frontier Foundation)開發(fā)的。它能確保你以安全的方式訪問網(wǎng)站。這意味著你對網(wǎng)站的訪問會被加密，從而保護你免遭各種形式的監(jiān)控和入侵。

Download HTTPS Everywhere for Chrome here. For Firefox here.

點擊這里下載Chrome版HTTPS Everywhere。點擊這里下載火狐(Firefox)版HTTPS Everywhere。

Here’s a list of FAQ’s about the plug-in, including whether it is available for other browsers.

點擊這里查看關于該插件的常見問題解答，包括它是否適用于其他瀏覽器。

And this is a good time to note that you should always be aware whether the Wi-Fi network you’re using is secure. Public networks — and even private networks without security keys — often are not.

借此機會還要指出，你應該時時警惕自己使用的Wi-Fi網(wǎng)絡是否安全。公共網(wǎng)絡——乃至沒有安全密匙的私人網(wǎng)絡——通常并不安全。

6. Remember that incognito mode isn’t always private.

6. 切記，隱身模式并非總能保護隱私。

You may be in such a hurry to use this feature, available on Chrome, Safari and Firefox, among other browsers, that you do not heed its clear warning.

你或許急匆匆地使用了這個在Chrome、Safari、火狐以及其他一些瀏覽器上都能見到的功能，卻沒有注意到它發(fā)出的明確警告。

On Chrome, the second paragraph of the “incognito” home screen is clear.

在Chrome上打開介紹“隱身”模式的頁面，第二段寫得清清楚楚。

“You aren’t invisible,” it says. “Going incognito doesn’t hide your browsing from your employer, your internet service provider, or the websites you visit.”

“您的活動并非無法被察覺，”那上面說。“使用隱身模式后，您的雇主、您的互聯(lián)網(wǎng)服務提供商或者您訪問的網(wǎng)站本身，還是可以查看您的網(wǎng)站訪問活動記錄。”

Mr. Larson recommended Tor in his article, a browser that allows for private web activity. But we’re not going to recommend that here, mostly because Tor is relatively slow and clunky at the moment.

拉爾森在他的文章中推薦了Tor，一款讓人得以進行私密網(wǎng)絡活動的瀏覽器。但我們在這里不會做這樣的推薦，主要原因是Tor目前較為緩慢和笨重。

“I’ll be honest, I don’t use it very often,” Mr. Larson said.

“說老實話，我并沒有非常頻繁地使用它，”拉爾森說。

He said that he suspected other browsers would start adding ways to browse more securely.

他說他預計其他瀏覽器也會著手添加能讓人更安全地瀏覽網(wǎng)頁的功能。

“Apple is very security conscious,” he said. “I wouldn’t be surprised if they started to incorporate Tor-like features into Safari.”

“蘋果的安全意識非常強，”他說。“如果他們開始把類似于Tor的功能融入Safari，我一點兒也不會感到驚訝。”

7. Do sensitive searches in DuckDuckGo.

7. 用DuckDuckGo進行較為敏感的搜索。

Mr. Larson said that if people were paranoid about Google, he would strongly encourage them to use DuckDuckGo, an alternative search engine.

拉爾森說，如果有人對谷歌極度不放心，他會強烈推薦他們使用另一款搜索引擎DuckDuckGo。

He said however, that he personally, was not paranoid.

不過他說，他本人對谷歌并無成見。

“Google is built on the hacker ethic and they have put principle above profits in some aspects,” he said.

“谷歌的創(chuàng)建以黑客倫理為基礎，他們在某些方面是把原則置于利潤之上的，”他說。

But he also acknowledged that he meets “people all the time who are extremely skeptical of any large software organization and I think that’s reasonable.” There are trade-offs. Google’s search results are more useful and accurate than competitors’ precisely because of the ways it collects and analyzes information about its customers’ searches.

但他也承認，他“常常”遇到“對所有大型軟件組織都心懷疑慮的人，而且我覺得他們持這種態(tài)度也是合情合理的”。有利就有弊。與競爭對手相比，谷歌的搜索結果更有用，也更準確，但這恰恰是因為它會搜集并分析與用戶的搜索活動有關的信息。

A Bonus: Cover your webcam with tape.

附贈錦囊一枚：用膠帶蓋住攝像頭。

That way, if someone has found a way to compromise your computer, they cannot spy on you through its camera.

這樣一來，即便有人得以入侵你的電腦，也無法通過電腦上的攝像頭窺視你。

And yes, this happens.

沒錯，這種事情不是沒發(fā)生過。

Happy encryption.

祝加密愉快。