通过网络发送密码 [英] Sending passwords over the web
问题描述
因此，我正在开发一个移动平台应用程序，我希望用户通过Web进行身份验证.我在想最好的安全方法.用户正在将HTTP密码发送到php服务器，并通过同一服务器上的mysql数据库进行身份验证.显然，我不想通过互联网以纯文本形式发送密码，但是我也不想做2个SHA哈希.
So I'm working on a mobile platform application that I'd like to have users authenticate over the web. I was wondering the best way to do security. The user is sending a password for HTTP to a php server wich authenticates against a mysql database on the same server. Obviously I don't want to send the password in plain text over the internet, but I also don't want to do 2 SHA hashes.
这是服务器的样子(用伪代码)
This is what the server looks like (in pseudocode)
$pass = $_POST['pass'];
if ((get PASSWORD where USERNAME = USERNAME) == SHA($pass)) return PASS;
这是非常标准的，我认为没有其他方法可以做到这一点.但是我想知道在通过互联网发送数据之前应该如何准备数据.
This is pretty standard and I don't think there's any other way to do this. But I was wondering how I should prepare the data before sending it over the internet.
推荐答案
- 如果您需要安全保护，那就是.必须.使用. HTTPS.带有适当的，非自签名的证书.无论您做什么，在未加密的通信中经过身份验证的身份都是微不足道的. (不必管密码，攻击者可以简单地窃取每个请求提供的会话cookie.)
- 散列本身是一文不值的，必须加盐. (这与身份验证并没有真正的关系-这是有人窃取您的数据库时的第二道防线.如果您成为有前途的目标，则迟早会发生这种情况.)将bcrypt与较长的每用户随机盐一起使用， sha *是不安全的，因为它太快了.
- 使用大型的，具有安全意识的项目已经使用的方法.这些方法在某种程度上经受住了时间的考验.有基于挑战响应的方法可以避免以任何形式发送密码，但是加密很困难，并且以不安全的方式实现安全算法非常容易.使用良好的安全框架(例如 PHPass )，不要依赖未广泛使用的代码
- If you want security, YOU. MUST. USE. HTTPS. With a proper, non-self-signed certificate. Whatever you do, identities that are authenticated in unencrypted communication will be trivial to steal. (Never mind the password, the attacker can simply steal the session cookie that is provided with every request.)
- Hashing is worthless in itself, you must salt it. (This is not really related to authentication - it is a second layer of defense for the case when someone steals your database. Which will probably happen sooner or later if you become a promising target.) Use bcrypt with long random per-user salt, sha* is insecure because it is too fast.
- Use methods that are already in use by large, security-aware projects. Those methods have, to some degree, withstood the test of time. There are challange-response based methods that avoid sending the password in any form, but crypto is hard, and it is very easy to implement secure algorithms in an insecure way. Use a good security framework (e.g. PHPass), don't rely on code that is not widely in use.
这篇关于通过网络发送密码的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
