CHAPTER 14 · 10 SOURCE ENTRIES

Digital Security and Privacy

账号与信息安全

[← 回总目录](../README.md) 口径：金钱与个人信息。账号被别人登进去，丢的先是钱。对方还会用你的账号去骗你通讯录里的人。你的身份也等于被人拿走了。

14-001

Evidence AmoneySource-sensitive

Enable two-factor authentication on email, payment, and social accounts; prioritize phone pop-ups over SMS codes

邮箱、支付、社交账号都开二次验证，优先用手机弹窗确认，其次才是短信验证码

Two-factor authentication means an extra verification step beyond the password when logging in. Using a pop-up prompt on your phone that requires a single tap to confirm blocks over 90% of phishing and account theft attempts. In contrast, older verification methods such as answering questions like “Where did you log in last time?” or “What is your backup email?” only block around 10% of such attacks.

Open the low-ROI detour

Move “Enable two-factor authentication on email, payment, and social accounts; prioritize phone pop-ups over SMS codes” to Future Me's calendar

One more exception feels free because the bill arrives outside the current scene.

Today I keep a few minutes and avoid interrupting my default routine.

Read the source and trade-off

14-002

Evidence CmoneySource-sensitive

Use a unique password solely for your email

邮箱密码单独一个，不和任何网站重复

If a password you use elsewhere gets stolen, attackers can use it to log straight into your email account. Once they gain access to your email, they can reset passwords for any other accounts linked to it. Therefore, your email password must be unique and never reused anywhere else.

Open the low-ROI detour

Move “Use a unique password solely for your email” to Future Me's calendar

I can spend longer deciding whether to start than the small action would take.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off

14-003

Evidence CmoneySource-sensitive

Set a screen lock on your phone and a PIN for the SIM card

手机设锁屏密码，SIM 卡设 PIN 码

The SIM card is that tiny card inside your phone that receives SMS verification codes. If your phone gets lost, a finder can remove the card and insert it into another phone to receive those codes, then reset all your accounts one by one. Setting a PIN on the SIM card means that whenever the card is moved to another phone, the user must enter that PIN before the phone can be used — effectively blocking that path.

Open the low-ROI detour

Move “Set a screen lock on your phone and a PIN for the SIM card” to Future Me's calendar

The routine already works until the day the source says it may not.

Today I keep a few minutes and avoid interrupting my default routine.

Read the source and trade-off

14-004

Evidence CmoneySource-sensitive

Follow these steps if you lose your phone: block the SIM card, remotely lock it, change passwords, file a police report, and freeze your bank cards if needed.

手机丢了按这个顺序做：挂失 SIM 卡、远程锁定、改密码、报警、冻结银行卡

The order of actions matters more than speed. First, block the SIM card to cut off access to verification codes. Next, remotely lock the phone. Then, use a computer to change your email and payment passwords. After that, file a police report to obtain a receipt. Finally, freeze your bank cards as needed. Even if you’re using someone else’s phone, you can still call your carrier to block the SIM card.

Open the low-ROI detour

Move “Follow these steps if you lose your phone: block the SIM card, remotely lock it, change passwords, file a police report, and freeze your bank cards if needed.” to Future Me's calendar

There is no immediate alarm, so the sensible choice can wait for a less busy week.

Today I keep a few minutes and avoid interrupting my default routine.

Read the source and trade-off

14-005

Evidence AmoneySource-sensitive

If your card is fraudulently used, report it and freeze the card first, then demand compensation from the bank: proving “you made the transaction” is the bank’s responsibility

卡被盗刷先挂失冻结再报警，然后要求银行赔：证明「是你自己刷的」是银行的责任

If someone fraudulently uses your card, you don’t have to prove “this wasn’t me.” Instead, it’s the bank’s duty to prove the transaction was made by you. If they can’t, they must compensate you. This only applies if you report and freeze the card right away. Delaying this step means you’ll bear any additional losses that occur afterward.

Open the low-ROI detour

Move “If your card is fraudulently used, report it and freeze the card first, then demand compensation from the bank: proving “you made the transaction” is the bank’s responsibility” to Future Me's calendar

Future Me has a clearer calendar, more patience, and apparently the same responsibilities.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off

14-006

Evidence CmoneySource-sensitive

Periodically check the devices logged into your account and any authorized apps, then remove the ones you no longer use

每隔一段时间看一次账号的登录设备和已授权应用，不用的清掉

“Logged-in devices” refer to the phones and computers that can still access your account right now. Account thieves often lie low for a while before making their move. If you see any unfamiliar devices on the list, or third-party apps you no longer use still linked to your account, log out from all devices and change your password right away.

Open the low-ROI detour

Move “Periodically check the devices logged into your account and any authorized apps, then remove the ones you no longer use” to Future Me's calendar

If I do not open the notes, no new task has technically appeared.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off

14-007

Evidence AfreedomSource-sensitive

Don’t tap “Allow all” just to use an app: the data isn’t mandatory, and refusing to share it won’t block service access

别为了用 App 点「全部同意」：不是必需的信息，你不同意也不能拒绝给你服务

Apps request your data. If that data isn’t strictly necessary to deliver the service, the app can’t deny you access just because you refuse to share it. It may only collect what it actually needs. For instance, a map app needs your location, but a flashlight app has no business asking for your contacts list.

Open the low-ROI detour

Move “Don’t tap “Allow all” just to use an app: the data isn’t mandatory, and refusing to share it won’t block service access” to Future Me's calendar

One more exception feels free because the bill arrives outside the current scene.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off

14-008

Evidence AfreedomSource-sensitive

You have the right to view, copy, correct, and delete your personal information; if refused, you can sue.

你有权查看、复制、更正和删除自己的个人信息，被拒绝可以起诉

You have the right to demand that a company let you view, copy, correct, and delete your personal information. When a service is discontinued, its retention period expires, or you withdraw consent, the company is obligated to delete that data on its own. If it refuses your request, it must provide a valid reason; otherwise, you can take it to court. Deactivating an account and deleting personal information are two separate actions — after deactivating, you must separately request deletion.

Open the low-ROI detour

Move “You have the right to view, copy, correct, and delete your personal information; if refused, you can sue.” to Future Me's calendar

I can spend longer deciding whether to start than the small action would take.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off

14-009

Evidence AmoneySource-sensitive

You’re not required to use facial recognition: if other options exist, they must offer you alternatives if you refuse

刷脸不是必须答应的：有别的办法就不能只让你刷脸，你不同意得给你其他方式

As long as any other method can achieve the same result, a service provider cannot force you to use facial recognition. If you decline facial recognition, they must offer alternatives such as a card swipe, password entry, or ID verification. They also cannot threaten that “the service won’t be provided” if you refuse. Installing facial recognition devices in hotel rooms, public showers, changing rooms, or restrooms is strictly prohibited.

Open the low-ROI detour

Move “You’re not required to use facial recognition: if other options exist, they must offer you alternatives if you refuse” to Future Me's calendar

The routine already works until the day the source says it may not.

Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off

14-010

Evidence BfreedomSource-sensitive

Do not send code, secrets, or private data to an unknown AI proxy

别把代码、密钥和隐私资料交给来路不明的「AI 中转站」，让 AI 自动执行命令时尤其如此

A proxy can view or alter prompts and responses. The cited study tested more than 400 services and found some that inserted malicious code or tampered with planted cloud credentials.

Open the low-ROI detour

Move “Do not send code, secrets, or private data to an unknown AI proxy” to Future Me's calendar

There is no immediate alarm, so the sensible choice can wait for a less busy week.

Today I keep a little money, a few minutes, a bit of persistence and avoid interrupting my default routine.

Read the source and trade-off

Source snapshot: a994b6a0c90598b0fe15cb837343f438dbf7b95d. Every original stays available in Chinese alongside the English edition.