什么是“撞库”攻击？
What is a 'credential stuffing' (password spraying) attack?
撞库是坏人拿别处泄露的“账号+密码”清单，去其他网站批量试登录，因为很多人各网站用同一密码。对付它最好的办法是每个网站用不同密码。
Credential stuffing uses leaked 'account+password' lists to try logging into other sites, since many reuse passwords. The fix is a unique password per site.
难度 专业 · 适合 高中(15-18)
CC BY 4.0 · 已核验 · Verified 2026-11-06
来源 · Source
美国国家标准与技术研究院（NIST）SP 800-63B
NIST SP 800-63B
独立核验依据 · Independent verification: 核验依据 1 NIST SP 800-63B · DOI 10.6028/NIST.SP.800-63b
#撞库 #密码复用 #攻击
什么是社交工程诈骗？
What is social engineering fraud?
社交工程是骗子不攻电脑、而是“骗人”：装成客服、警察或熟人，利用害怕或贪心让你自己交出验证码、转账。识破的关键是——官方不会要你的密码和验证码。
Social engineering tricks the person, not the machine: scammers pose as support, police or friends and exploit fear or greed to get codes or transfers. Rule: real officials never ask for your password or code.
难度 专业 · 适合 高中(15-18)
CC BY 4.0 · 来源待核验 · Source pending review
来源 · Source
出处备注：本题原挂出处与答案内容不符，已撤回；具体书目待补，暂不展示来源。
本题原挂出处与答案内容不符，已撤回；具体书目待补。
Previous citation withdrawn as unsupported for this answer; a specific source is pending.
#社交工程 #诈骗 #心理
什么是钓鱼网站或钓鱼邮件？
What is a phishing website or email?
骗子做一个长得像真银行的假网站或假邮件，骗你输入账号密码。它们常催促你“立刻点击”，网址也常是拼错的假域名。看准网址、不随便点链接就能避开。
Scammers fake a bank's site or email to steal your login. They rush you to 'click now' and use misspelled domains. Check the URL and don't click blind links.
难度 专业 · 适合 高中(15-18)
CC BY 4.0 · 来源待核验 · Source pending review
来源 · Source
出处备注：本题原挂出处与答案内容不符，已撤回；具体书目待补，暂不展示来源。
本题原挂出处与答案内容不符，已撤回；具体书目待补。
Previous citation withdrawn as unsupported for this answer; a specific source is pending.
#钓鱼 #诈骗 #邮件
什么是 SIM 卡交换攻击？
What is a SIM swap attack?
骗子先套取到你的运营商信息，骗营业厅把你的号码转到他的 SIM 卡上。这样你收不到验证码，他就能用短信验证码登录你的账号。给运营商设个额外密码可防此类攻击。
Scammers trick the carrier into moving your number to their SIM, so you stop getting codes and they log in via SMS. A carrier-side PIN adds protection.
难度 专业 · 适合 高中(15-18)
CC BY 4.0 · 已核验 · Verified 2026-11-04
来源 · Source
Awale, Gupta，《Awareness of Sim Swap Attack》,International Journal of Trend in Scientific Research and De,2019 (DOI: 10.31142/ijtsrd23982)
Awale, Gupta, 'Awareness of Sim Swap Attack', International Journal of Trend in Scientific Research and De, 2019, DOI: 10.31142/ijtsrd23982
独立核验依据 · Independent verification: 核验依据 1 Crossref DOI 10.31142/ijtsrd23982
#SIM交换 #验证码 #诈骗
什么是 VPN，它能保护我什么？
What is a VPN and what does it protect?
VPN 把你的上网数据先加密送到远方服务器再上网，别人更难偷看你在家或公共 WiFi 上的内容，也能隐藏你的真实位置。但它不是万能，别用它干坏事。
A VPN encrypts your traffic and routes it through a remote server, so others can't easily see what you do on home or public WiFi and your location is hidden. It's not a free pass for anything illegal.
难度 专业 · 适合 初中(12-15)
CC BY 4.0 · 已核验 · Verified 2026-08-23
来源 · Source
Kurose & Ross,《Computer Networking: A Top-Down Approach》第8版,Pearson,2021
J. F. Kurose and K. W. Ross, Computer Networking, 8th ed., Pearson, 2021
#VPN #加密 #隐私
什么样的密码比较安全？
What makes a password strong?
又长又乱最好：用 12 位以上、混合大小写字母、数字和符号，且每个网站不同。比起“Password123”，一句只有你知道的话（如“猫咪爱吃2只虾!”）更难被猜中。最好用密码管理器。
Long and random wins: 12+ characters mixing case, numbers and symbols, unique per site. A personal sentence like 'CatsEat2Shrimp!' beats 'Password123'. A password manager helps.
难度 专业 · 适合 初中(12-15)
CC BY 4.0 · 已核验 · Verified 2026-11-06
来源 · Source
美国国家标准与技术研究院（NIST）SP 800-63B
NIST SP 800-63B
独立核验依据 · Independent verification: 核验依据 1 NIST SP 800-63B · DOI 10.6028/NIST.SP.800-63b
#密码 #强度 #安全
为什么在公共 WiFi 上不要登录网银？
Why avoid online banking on public WiFi?
公共 WiFi 可能被同网的人偷看传输内容，尤其在没加密时。银行账户和密码一旦被截获就危险，所以尽量用手机流量或 VPN。
On public WiFi others on the same network may see your traffic, especially if unencrypted. Bank details intercepted that way are dangerous—use mobile data or a VPN.
难度 进阶 · 适合 初中(12-15)
CC BY 4.0 · 已核验 · Verified 2026-08-23
来源 · Source
Kurose & Ross,《Computer Networking: A Top-Down Approach》第8版,Pearson,2021
J. F. Kurose and K. W. Ross, Computer Networking, 8th ed., Pearson, 2021
#公共WiFi #银行 #加密
网站为什么必须用加盐的慢哈希存密码，而不是直接存 SHA-256？
Why must sites store passwords with a salted slow hash instead of a plain SHA-256?
SHA-256 的设计目标就是快，现代 GPU 每秒能算上百亿次，攻击者拿到数据库后可以用字典和彩虹表快速反推弱口令；不加盐时相同密码的哈希值完全相同，一张预计算表就能同时打穿所有用户。盐是每个用户独立的随机值，与密码一起参与哈希，使预计算失效并让相同密码呈现不同结果。更关键的是改用专门抗硬件破解的慢函数：Argon2id 与 scrypt 通过可调的内存开销抵御 GPU 和 ASIC，bcrypt 与 PBKDF2 靠高迭代次数拖慢每次尝试，OWASP 与 NIST 都建议随硬件进步定期上调参数。
SHA-256 is built for speed — a modern GPU computes tens of billions per second — so once a database leaks, attackers brute-force weak passwords with dictionaries and rainbow tables; without a salt, identical passwords hash identically and one precomputed table cracks every account at once. A salt is a per-user random value hashed together with the password, which invalidates precomputation and makes identical passwords look different. The decisive step is switching to a function deliberately slow against dedicated hardware: Argon2id and scrypt impose tunable memory cost that frustrates GPUs and ASICs, while bcrypt and PBKDF2 rely on high iteration counts, and both OWASP and NIST advise raising the parameters as hardware improves.
难度 进阶 · 适合 高中(15-18)
CC BY 4.0 · 来源待核验 · Source pending review
来源 · Source
出处备注：著录仅给书名，无版次与年份；同一书名常对应多个版次，不臆测具体版本。
OWASP Cheat Sheet Series《Password Storage》；NIST Special Publication 800-63B《Digital Identity Guidelines: Authentication and Lifecycle Management》
OWASP Cheat Sheet Series, "Password Storage"; NIST Special Publication 800-63B, "Digital Identity Guidelines: Authentication and Lifecycle Management"
#密码存储 #加盐 #Argon2 #慢哈希
旧手机卖掉或送人前，要做哪些事？
What should you do before selling or giving away an old phone?
先退出所有账号、关闭“查找我的手机”，再恢复出厂设置把数据清空。有重要的就先备份到云盘或电脑。这样别人就看不到你的照片和聊天。
Sign out of all accounts, turn off 'find my phone', then factory-reset to wipe data. Back up what matters to cloud or PC first. Then others can't see your photos or chats.
难度 进阶 · 适合 初中(12-15)
CC BY 4.0 · 来源待核验 · Source pending review
来源 · Source
出处备注：本题原挂出处与答案内容不符，已撤回；具体书目待补，暂不展示来源。
本题原挂出处与答案内容不符，已撤回；具体书目待补。
Previous citation withdrawn as unsupported for this answer; a specific source is pending.
#旧手机 #清除 #隐私
收到“中奖”“验证码”之类的短信该怎么做？
What should you do with 'you won' or 'verification code' text messages?
别点里面的链接、别回短信、别填信息。正规机构不会用短信问你要银行卡号。拿不准就自己打开官方 App 查，而不是点短信里的网址。
Don't click links, reply, or fill in info. Legit organizations won't ask for your card by text. When unsure, open the official app yourself instead of the SMS link.
难度 进阶 · 适合 大众
CC BY 4.0 · 来源待核验 · Source pending review
来源 · Source
出处备注：本题原挂出处与答案内容不符，已撤回；具体书目待补，暂不展示来源。
本题原挂出处与答案内容不符，已撤回；具体书目待补。
Previous citation withdrawn as unsupported for this answer; a specific source is pending.
#短信 #诈骗 #防骗
两步验证（2FA）是什么，为什么重要？
What is two-factor authentication (2FA) and why does it matter?
两步验证是在密码之外再加一道关，比如手机验证码或指纹。就算密码被偷，坏人没有第二步也进不去，账号安全大大提升。
2FA adds a second check beyond your password, like a phone code or fingerprint. Even if your password leaks, the thief can't get in without step two.
难度 进阶 · 适合 大众
CC BY 4.0 · 已核验 · Verified 2026-11-06
来源 · Source
美国国家标准与技术研究院（NIST）SP 800-63B
NIST SP 800-63B
独立核验依据 · Independent verification: 核验依据 1 NIST SP 800-63B · DOI 10.6028/NIST.SP.800-63b
#两步验证 #安全 #账号
怎么判断一个链接是不是骗子发的？
How can you tell if a link was sent by a scammer?
把鼠标停在链接上看真实网址，留意奇怪的拼写字母或陌生域名。短链接要先确认来源，不确定就别点，直接去官网输入地址。
Hover to see the real URL; watch for typos or odd domains. Short links need a trusted source—if unsure, don't click; type the official site yourself.
难度 进阶 · 适合 小学高段(9-12)
CC BY 4.0 · 来源待核验 · Source pending review
来源 · Source
出处备注：本题原挂出处与答案内容不符，已撤回；具体书目待补，暂不展示来源。
本题原挂出处与答案内容不符，已撤回；具体书目待补。
Previous citation withdrawn as unsupported for this answer; a specific source is pending.
#链接 #钓鱼 #识别
App 里的“隐私设置”是做什么用的？
What are the 'privacy settings' in an app for?
隐私设置让你决定谁能看你的资料、是否允许定位、是否接收广告推送。常去检查一下，关掉不必要的分享，能少泄露很多个人信息。
Privacy settings let you decide who sees your profile, whether to allow location, and ad notifications. Review them and turn off unneeded sharing to leak less.
难度 进阶 · 适合 初中(12-15)
CC BY 4.0 · 来源待核验 · Source pending review
来源 · Source
出处备注：本题原挂出处与答案内容不符，已撤回；具体书目待补，暂不展示来源。
本题原挂出处与答案内容不符，已撤回；具体书目待补。
Previous citation withdrawn as unsupported for this answer; a specific source is pending.
#隐私 #设置 #权限
面对勒索软件，为什么说备份才是最后一道防线，「3-2-1」又是什么意思？
Why is backup the last line of defence against ransomware, and what does the 3-2-1 rule mean?
勒索软件会加密你的文件再索要赎金，加密本身无法硬破解，付钱也常常拿不到可用的密钥，所以真正能救回数据的只有一份未被感染的副本。3-2-1 原则是：至少保留 3 份数据，存放在 2 种不同介质上，其中 1 份放在异地。关键在于至少有一份是离线或不可改写的，比如拔下来的移动硬盘或写一次读多次的对象存储，否则勒索软件会连着映射的网络盘和自动同步的云盘一起加密；另外要定期做恢复演练，没验证过能还原的备份不算备份。
Ransomware encrypts your files and then demands payment, the encryption itself cannot be broken by force, and paying often fails to yield a working key, so the only reliable rescue is a copy the malware never reached. The 3-2-1 rule says keep at least 3 copies of the data on 2 different kinds of media with 1 copy stored off-site. What matters most is that at least one copy be offline or immutable — an unplugged external drive, or write-once object storage — because otherwise ransomware encrypts the mapped network share and the auto-syncing cloud folder along with everything else, and restores must be rehearsed, since a backup you have never restored is not yet a backup.
难度 入门 · 适合 小学低段(6-8)
CC BY 4.0 · 来源待核验 · Source pending review
来源 · Source
出处备注：著录含书名，但缺版次 / 出版社 / 年份中的一部分，需编辑补全后才能做独立比对。
美国网络安全和基础设施安全局（CISA）《#StopRansomware Guide》(2023 年修订版)
U.S. Cybersecurity and Infrastructure Security Agency, "#StopRansomware Guide" (2023 update)
#勒索软件 #备份 #3-2-1原则 #离线副本
通行密钥（passkey）凭什么说比「密码加短信验证码」更安全？
What makes a passkey safer than a password plus an SMS code?
通行密钥用公钥密码学：注册时设备生成一对密钥，私钥留在手机或安全芯片里永不外传，只把公钥交给网站；登录时网站发来一个随机挑战，设备在你用指纹或面容解锁后签名返回。因为不存在可被复用的共享秘密，服务器即使被拖库也拿不到能用来登录的凭据；而且签名绑定了具体域名，浏览器不会在仿冒站点上使用它，钓鱼因此直接失效。短信验证码则是可读、可转述的共享秘密，钓鱼页面能实时中转，SIM 卡交换攻击也可能截获。
A passkey uses public-key cryptography: at registration the device generates a key pair, keeps the private key inside the phone or a secure element where it never leaves, and hands the site only the public key; at login the site sends a random challenge that the device signs after you unlock it with a fingerprint or face. Because no reusable shared secret exists, a breached server yields nothing an attacker can log in with, and the signature is bound to the exact domain so the browser simply refuses to use it on a lookalike site, which defeats phishing outright. An SMS code, by contrast, is a human-readable shared secret that a phishing page can relay in real time and that SIM-swap attacks can intercept.
难度 入门 · 适合 大众
CC BY 4.0 · 来源待核验 · Source pending review
来源 · Source
出处备注：著录仅给书名，无版次与年份；同一书名常对应多个版次，不臆测具体版本。
W3C《Web Authentication: An API for accessing Public Key Credentials, Level 2》；FIDO Alliance《Client to Authenticator Protocol (CTAP) 2.1》
W3C, "Web Authentication: An API for accessing Public Key Credentials, Level 2"; FIDO Alliance, "Client to Authenticator Protocol (CTAP) 2.1"
#通行密钥 #WebAuthn #公钥密码学 #抗钓鱼
什么是诈骗电话，怎么对付？
What is a scam call and how do you handle it?
诈骗电话是陌生人编理由（退款、中奖、抓人）骗你转钱或给信息。接到就挂、别信、别转账，必要时打官方电话核实。
A scam call uses fake stories (refund, prize, arrest) to get money or info. Just hang up, don't believe it, don't transfer, and verify via official numbers.
难度 入门 · 适合 大众
CC BY 4.0 · 来源待核验 · Source pending review
来源 · Source
出处备注：本题原挂出处与答案内容不符，已撤回；具体书目待补，暂不展示来源。
本题原挂出处与答案内容不符，已撤回；具体书目待补。
Previous citation withdrawn as unsupported for this answer; a specific source is pending.
#诈骗电话 #防骗 #核实
上网时，哪些信息不能随便告诉陌生人？
What information should you never give strangers online?
姓名、学校、住址、电话、密码和家人的信息都不要随便说。就像不给陌生人开家门一样，网上也要保护好自己。
Don't share your name, school, address, phone, passwords or family info. Just as you wouldn't open your door to a stranger, protect yourself online.
难度 入门 · 适合 幼儿(3-6)
CC BY 4.0 · 来源待核验 · Source pending review
来源 · Source
出处备注：本题原挂出处与答案内容不符，已撤回；具体书目待补，暂不展示来源。
本题原挂出处与答案内容不符，已撤回；具体书目待补。
Previous citation withdrawn as unsupported for this answer; a specific source is pending.
#隐私 #信息 #安全
什么是密码？
What is a password?
密码是一串只有你知道的字或数字，用来证明“你是你”、打开你的账号。就像自家门锁的钥匙。
A password is a secret string of letters or numbers that proves it's you and unlocks your account—like the key to your front door.
难度 入门 · 适合 大众
CC BY 4.0 · 已核验 · Verified 2026-11-06
来源 · Source
美国国家标准与技术研究院（NIST）SP 800-63B
NIST SP 800-63B
独立核验依据 · Independent verification: 核验依据 1 NIST SP 800-63B · DOI 10.6028/NIST.SP.800-63b
#密码 #账号 #安全
为什么密码不能告诉别人,连好朋友也不行?
Why keep passwords secret even from best friends?
密码就像你家门的钥匙。可是钥匙会被复制呀——万一别人拿了钥匙冒充你,拿走你的画和小饼干怎么办?秘密只放在自己心里最安全。
A password is your house key. Keys can be copied — someone could pretend to be you and take your drawings and cookies. Secrets stay safest in your own head.
难度 入门 · 适合 幼儿(3-6)
CC BY 4.0 · 已核验 · Verified 2026-10-04
来源 · Source
Linda Liukas,《Hello Ruby: Adventures in Coding》,Feiwel & Friends,2015
Linda Liukas, Hello Ruby: Adventures in Coding, Feiwel & Friends, 2015
独立核验依据 · Independent verification: 核验依据 1 ISBN 978-0-14-330898-0 (2015, No Starch Press)
#密码 #保密 #网络安全
为什么不能把密码告诉别人？
Why shouldn't you share your password with others?
密码像钥匙，给了别人，他就可能用你的名字做坏事、看你的私信。就算是好朋友，也尽量不共用密码。
A password is like a key; giving it away lets someone act as you and read your private messages. Even with friends, avoid sharing passwords.
难度 入门 · 适合 大众
CC BY 4.0 · 来源待核验 · Source pending review
来源 · Source
出处备注：本题原挂出处与答案内容不符，已撤回；具体书目待补，暂不展示来源。
本题原挂出处与答案内容不符，已撤回；具体书目待补。
Previous citation withdrawn as unsupported for this answer; a specific source is pending.
#密码 #隐私 #安全