[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f60ub0Uwv0wOMx-Qijg67L2CMiZkHQBzid7VYS2e0T2Q":3},{"item":4,"related":51},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":39,"sourceName":40,"sourceUrl":41,"status":42,"seoTitle":43,"seoDescription":44,"canonicalUrl":45,"isFeatured":46,"sno":47,"sortOrder":48,"publishedAt":49,"updatedAt":50,"createdAt":50},"88270c35-f9eb-4c94-ba86-f5035c0986ea","article","短信验证码真的安全吗？不同二次验证方式的安全差异","mfa-sms-authenticator-passkey-security","短信、身份验证器、安全密钥和 Passkey 都属于多因素认证，但抗钓鱼能力并不相同。本文用普通读者能理解的方式解释它们的区别，以及银行、邮箱和社交账号该如何选择。","很多网站都会提醒你开启“二次验证”：除了密码，还要输入短信验证码、身份验证器里的数字，或者确认一次手机通知。它们都叫多因素认证（MFA），但安全强度并不相同。对普通用户来说，真正重要的问题不是“有没有第二步”，而是第二步能不能抵抗钓鱼、盗号和误操作。\n\n## 多因素认证到底多了什么\n\n单独使用密码时，系统只验证“你知道什么”。密码一旦被撞库、泄露或输入到仿冒网站，攻击者就可能直接登录。MFA 要求用户再提供至少一种不同类型的证据：你拥有的设备或安全密钥，你本人的生物特征，或者一组临时生成的代码。\n\n```mermaid\nflowchart LR\n    A[输入密码] --> B{第二个因素}\n    B --> C[短信或邮件验证码]\n    B --> D[身份验证器代码]\n    B --> E[手机通知确认]\n    B --> F[安全密钥或 Passkey]\n    C --> G[增加一道门]\n    D --> G\n    E --> G\n    F --> H[更能抵抗钓鱼]\n```\n\n## 短信验证码为什么不是最强\n\n短信验证码的优点是普及率高、使用门槛低，几乎任何手机都能接收。但短信会经过运营商网络，可能受到 SIM 卡换卡、号码劫持、短信转发或社会工程攻击影响。更现实的问题是，用户常常会把验证码告诉冒充客服的人，或者在假网站里输入验证码。验证码本身是真的，但登录页面是假的，攻击者仍然能实时转走这一步。\n\n身份验证器应用通常会在本地根据共享密钥和当前时间生成短期代码，不依赖短信传输，因此减少了号码劫持风险。不过它仍然可能被钓鱼：如果用户把刚生成的代码输入到仿冒页面，攻击者仍可能在有效期内使用它。CISA 也把一次性代码列为比短信更强、但仍弱于抗钓鱼认证的方式。\n\n## 什么叫抗钓鱼认证\n\n安全密钥和 Passkey 的关键区别是，它们不仅验证“你有一个秘密”，还会把登录凭据和真实网站的域名绑定起来。用户在仿冒网站上点击登录时，设备不会为那个错误域名生成可用的认证响应。因此，即使用户没有察觉网址不对，攻击者也更难把登录过程转走。\n\n这不是说 Passkey 或安全密钥绝对不会被盗。设备账户、恢复邮箱、恶意软件和人为授权仍然可能成为攻击面。但攻击者不能像窃取密码那样，把一串字符复制到另一台设备上继续使用。\n\n## 普通用户怎么选择\n\n如果某个账户只支持短信验证，打开它仍然比完全没有保护好；如果支持身份验证器，通常值得优先选择；如果支持 Passkey 或硬件安全密钥，则应优先考虑。银行、邮箱、云盘、社交平台和密码管理器这类账户，应该使用最强可用的方式。\n\n还要记得保存恢复代码，并为换手机、丢失设备和更换号码预留恢复路径。MFA 的目标不是让登录变得复杂，而是让“密码泄露”不再自动等于“账户失守”。\n\n来源：[CISA：Require Multifactor Authentication](https:\u002F\u002Fwww.cisa.gov\u002Faudiences\u002Fsmall-and-medium-businesses\u002Fsecure-your-business\u002Frequire-multifactor-authentication)","\u002Fuploads\u002F2026-09-12\u002Fd995731f-a522-409e-8d68-56954886980c.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31,35],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"7da20200-5815-42a5-851a-bc8c1db554cb","应用","app",{"id":32,"name":33,"slug":34},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse",{"id":36,"name":37,"slug":38},"68cedb55-2cac-412f-8f81-fda8c7d686dd","思考","thought","CISA 多因素认证指南","Require Multifactor Authentication","https:\u002F\u002Fwww.cisa.gov\u002Faudiences\u002Fsmall-and-medium-businesses\u002Fsecure-your-business\u002Frequire-multifactor-authentication","published","短信验证码安全吗？MFA、身份验证器与 Passkey 的区别","解释短信验证码、身份验证器、安全密钥和 Passkey 的安全差异，帮助普通用户选择更可靠的账号保护方式。",null,false,47,0,"2026-09-12T00:00:00.000Z","2026-09-12T04:45:37.893Z",[52,61,69],{"id":53,"type":6,"title":54,"slug":55,"summary":56,"coverUrl":57,"authorName":14,"sno":58,"publishedAt":59,"createdAt":60},"2c0069eb-784b-44c9-91e6-28d7a0a14f70","两台设备同时改一个文件，为什么会产生冲突副本","cloud-file-conflicted-copy-explained","当多人或多台设备同时编辑同一份文件，云盘可能生成冲突副本来避免覆盖其中一份修改。本文解释离线编辑、自动保存和版本合并为什么会导致冲突，以及正确的处理方式。","\u002Fuploads\u002F2026-09-13\u002F627de033-916f-457b-9a34-0e143fa78f28.jpg",48,"2026-09-13T00:00:00.000Z","2026-09-13T09:35:48.112Z",{"id":62,"type":6,"title":63,"slug":64,"summary":65,"coverUrl":66,"authorName":14,"sno":67,"publishedAt":49,"createdAt":68},"5bd2d651-c3c0-4d02-84dc-981363305e11","“端到端加密”到底保护了什么","end-to-end-encryption-what-it-protects","端到端加密保护的是消息从发送设备到接收设备之间的内容，但不自动解决设备中毒、身份冒充、云端备份和元数据问题。本文解释它的能力与边界。","\u002Fuploads\u002F2026-09-12\u002Fa283289a-ccca-46ab-be96-d9351271cfc7.jpg",50,"2026-09-12T04:45:43.559Z",{"id":70,"type":6,"title":71,"slug":72,"summary":73,"coverUrl":74,"authorName":14,"sno":75,"publishedAt":59,"createdAt":76},"8a87d9ae-9710-4f7c-82e5-1b17028fe88d","云同步和云备份，为什么根本不是一回事","cloud-sync-vs-backup-explained","云同步追求多台设备保持一致，云备份则负责保留某个时间点的副本。本文用误删文件、换手机和设备损坏等日常场景，解释两者的区别与使用边界。","\u002Fuploads\u002F2026-09-13\u002F10db3fab-8304-4f99-b88d-f224e0922dd5.jpg",57,"2026-09-13T09:35:46.779Z"]