Online Safety網路安全
最強的密碼不是「P@ssw0rd!」這種——是四個隨機的普通單字。長度比符號重要得多。
CEFR B1閱讀約 5 分鐘 · 12 個單字 · 測驗卷 100 分
3D Tour3D 導覽影片：先看一遍，再自己點點看
3D 導覽影片 · 約 2 分鐘
Safety Town安全小鎮
12 個可以點的單字 · 可以隨時暫停、轉動場景
逐字稿（14 段）
- 1Welcome to Safety Town. Here you will learn how to keep your accounts safe online.歡迎來到安全小鎮。在這裡學會怎麼保護你的網路帳號。
- 2A password is the lock on your account. People think symbols make it strong. That advice is mostly wrong.密碼是你帳號的鎖。大家以為加符號就很強，這個建議大部分是錯的。
- 3Letters, numbers and symbols are all characters. Every extra character multiplies the work for an attacker.字母、數字、符號都是字元。每多一個字元，攻擊者的工作量就翻好幾倍。
- 4The strongest passwords are four random ordinary words. A line from a song is not random.最強的密碼是四個隨機的普通單字。一句歌詞可不算隨機。
- 5A computer can guess a short password like cat instantly. A long one would take effectively forever.像 cat 這種短密碼，電腦一瞬間就猜得到；長的密碼則是實質上永遠猜不完。
- 6Never reuse a password. One key should never open more than one door.密碼不要重複使用。一把鑰匙不該打得開第二扇門。
- 7When a site is breached, attackers try the same email and password everywhere else.某個網站被入侵時，攻擊者會拿同一組帳號密碼去試其他所有地方。
- 8So one leaked password can open every door that uses it.所以一組外洩的密碼，打得開每一扇用同一把鑰匙的門。
- 9This is phishing. The attacker uses a message as bait and waits for you to bite.這就是釣魚詐騙。攻擊者拿一則訊息當誘餌，等你上鉤。
- 10Phishing creates urgency: your account will be closed in 24 hours! Real organisations rarely rush you.釣魚訊息會製造急迫感：「您的帳號將在 24 小時內關閉！」真正的機構很少催你。
- 11Anyone can copy a logo perfectly. Check the domain in the address bar instead.標誌誰都能抄得一模一樣。要看的是網址列上的網域。
- 12Assume anything you post is permanent. Deleting it does not delete the screenshots other people made.當作貼出去的東西刪不掉。刪掉貼文，刪不掉別人已經存下的截圖。
- 13The weakest part is often a person who is persuaded to hand over the key. Tell a trusted adult.最脆弱的環節，常常是有人被說服交出鑰匙。這時候要告訴信任的大人。
- 14Now it's your turn. Walk around Safety Town and click on anything you see.現在換你了。在安全小鎮逛一圈，點點看你看到的每一樣東西。
Length Beats Symbols長度勝過符號
People are taught to make passwords complicated: capital letters, numbers, symbols. That advice is mostly wrong.大家被教導把密碼弄複雜：大寫字母、數字、符號。這個建議大部分是錯的。
A computer guessing passwords does not find symbols hard. It finds length hard, because every extra character multiplies the work.電腦在猜密碼時並不覺得符號難。它覺得難的是長度，因為每多一個字元，工作量就翻倍再翻倍。
Four random ordinary words are far stronger than a short password full of symbols, and much easier to remember.四個隨機的普通單字，比一個短又滿是符號的密碼強得多，而且好記得多。
The word random matters. A phrase from a song is not random, because attackers try song lyrics too.「隨機」這兩個字很重要。歌詞不算隨機，因為攻擊者也會拿歌詞來試。
The Rules That Actually Help真正有用的幾條
- Never reuse a password密碼不要重複用
- When one site is breached, attackers try that same email and password everywhere else. One leaked password should never open more than one door.某個網站被入侵時，攻擊者會拿同一組帳密去試其他所有地方。一組外洩的密碼不該打得開第二扇門。
- Turn on two-factor authentication打開兩步驟驗證
- A second step — a code from an app — means a stolen password alone is not enough. This is the single most effective thing you can do.多一個步驟——例如來自 App 的驗證碼——就代表光有密碼還進不去。這是你能做的最有效的一件事。
- Phishing creates urgency釣魚訊息會製造急迫感
- Your account will be closed in 24 hours. Real organisations rarely rush you. Urgency plus a link is the clearest warning sign there is.「您的帳號將在 24 小時內關閉」——真正的機構很少催你。急迫感加上一個連結，是最明顯的警訊。
- Check the address, not the logo看網址，不是看標誌
- Anyone can copy a logo perfectly. Nobody else can own the real domain name, so the address bar is what you check.任何人都能把標誌複製得一模一樣。但沒有人能擁有真正的網域名稱，所以要看的是網址列。
- Assume anything posted is permanent當作貼出去的東西刪不掉
- Screenshots exist. Deleting a post does not delete the copies other people already made.截圖是存在的。刪掉一則貼文，不會刪掉別人早就存下來的副本。
How Long Would It Take to Guess?猜出來要多久？
| Password 密碼 | Length 長度 | Roughly 大約 |
|---|---|---|
| cat | 3 | Instantly 瞬間 |
| P@ssw0rd | 8 | Very fast — it is a known pattern 非常快，這是已知的套路 |
| kD9#mQ2x | 8 | Hours to days 數小時到數天 |
| correct horse battery staple | 28 | Effectively for ever 實質上永遠猜不完 |
資料查證至 2025 年底
這些是概略量級，實際數字隨攻擊者的硬體而變。要記住的是順序：把 a 換成 @ 幾乎沒有幫助，多加幾個單字幫助非常大。
Did You Know?你知道嗎？
- A password manager remembers a different long random password for every site, so you only have to remember one.密碼管理員替每個網站記住一組不同的長隨機密碼，你只要記住一組就好。
- Public Wi-Fi is safer than it used to be, because almost every site now uses HTTPS and encrypts the traffic.公共 Wi-Fi 比以前安全，因為現在幾乎每個網站都用 HTTPS 加密流量。
- If a message says do not tell anyone, that is itself the warning sign. Telling a trusted adult is exactly the right move.如果一則訊息說「不要告訴任何人」，那本身就是警訊。告訴信任的大人正是該做的事。
- The weakest part of most systems is not the software. It is someone being persuaded to hand over the key.多數系統最脆弱的環節不是軟體，而是有人被說服交出鑰匙。
Key Words單字表
password/ˈpæs.wɝːd/n.
密碼
Never reuse a password.密碼不要重複用。
guess/ɡes/v.
猜
A computer guesses very fast.電腦猜得非常快。
character/ˈker.ək.tɚ/n.
字元
Every extra character helps.每多一個字元都有幫助。
random/ˈræn.dəm/adj.
隨機的
The words must be random.那些字必須是隨機的。
reuse/ˌriːˈjuːz/v.
重複使用
Do not reuse it on another site.不要在另一個網站重複用。
breach/briːtʃ/n. / v.
資安入侵
After a breach, attackers try the same details elsewhere.入侵之後，攻擊者會拿同樣的資料去別處試。
leak/liːk/v. / n.
外洩
One leaked password is enough.一組外洩的密碼就夠了。
phishing/ˈfɪʃ.ɪŋ/n.
釣魚（詐騙）
Phishing messages create urgency.釣魚訊息會製造急迫感。
urgency/ˈɝː.dʒən.si/n.
急迫感
Urgency plus a link is a warning sign.急迫感加連結就是警訊。
domain/doʊˈmeɪn/n.
網域
Check the domain in the address bar.檢查網址列上的網域。
permanent/ˈpɝː.mə.nənt/adj.
永久的
Assume anything posted is permanent.當作貼出去的東西是永久的。
persuade/pɚˈsweɪd/v.
說服
Someone is persuaded to hand over the key.有人被說服交出鑰匙。
讀完了，來考一下
測驗卷共 100 分，有單字配對、選擇、填空與簡答。 按下去會開啟列印版，可以直接印出來，或在列印視窗選「另存為 PDF」。