i18n - 国际化和国际化 密码复杂性规则
我目前正在致力于产品的国际化，并且出现了一个问题。 该问题围绕非拉丁语言和复杂字符集国家/地区的密码复杂性要求。
该应用程序使用 aspnet 成员身份进行用户和密码管理，尽管这可能是一个完全不同的问题。 目前，我们的应用程序已设置和代码来容纳 AZ、0-9 和构成密码的特殊字符，但这些很可能需要扩展才能应对其他文化。
我一直在寻找这方面的指导和最佳实践，但到目前为止并没有太多的乐趣。 关于这个问题的最后一篇文章涉及关于这个问题，但并没有真正提供任何指导。
I'm currently working on the internationalization of a product and an issue has come up. The issue revolves around password complexity requirements for countries with non-Latin languages and complex character sets.
The application uses aspnet membership for user and password management, although this might be a whole other issue. Currently our application has settings and code in place to accommodate A-Z, 0-9 and special characters that make up passwords, but these will more than likely require extension to cope with other cultures.
I've been searching for guidance and best practice on this and so far not had much joy. The last post on this SO question touches on the issue but doesn't really provide any guidance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
很大程度上取决于访问的安全程度。 对于高安全性，密码方法并不实际，某种生物识别（指纹？）或双因素（SKey？）方法可能更好，特别是与数字 PIN 结合使用时。
这是因为对非西方语言密码进行字典或复杂性分析并不实际。 具体来说：
对于简单的网站，如果您向浏览器提供非西方语言版本的网站，建议对密码执行更严格的检查。
Much depends on how secure the access needs to be. For high security a password approach isn't really practical, and some kind of biometric (fingerprint?) or two-factor (SKey?) approach may be better, especially if combined with a numeric PIN.
This is because it's not really practical to perform dictionary or complexity analysis on non-Western language passwords. Specifically:
For simple Web sites it may be advisable to perform stronger checks on the password if you are delivering a non-Western language version of your site to the browser.
取决于您想要强制执行的内容。 字典检查和模式识别应该适用于任何编码和语言。 如果你想强制执行流行但任意的规则“大写、小写和数字的混合”，那么，是的，你可能需要找到 A) 一个可以确定任何语言的大小写和数字的库或 API，或者 B) 创建一个愚蠢的大型数据库可以您自己映射该信息。
不过，这种复杂性规则是一种黑客行为。 愚蠢的人会创建愚蠢的密码，无论您任意执行哪种复杂性规则。 密码安全的最佳实践是确保用户必须选择一个不太容易猜测的密码，因此要进行字典检查（不要忘记添加密码创建页面上的所有单词以及与密码相关的所有单词）条目、应用程序或其环境，加上所有可用的用户特定信息（例如出生日期和婚前姓名）和模式匹配（abc123）就可以了。
实际上，我见过很多使用“abc123.-”或类似内容作为 root 密码的情况，因为没有人会想出一个符合复杂性标准的真实密码。
Depends on what you want to enforce. Dictionary checks and pattern recognition should work in any encoding and language. If you want to enforce the popular but arbitrary rules "mix of uppercase, lowercase and numerics", then, yes, you probably need to find A) a library or API that can determine case and numerics for any language or B) create a stupidly large database to map that information yourself.
That kind of complexity rules is a hack, though. Stupid people WILL create stupid passwords, no matter what kind of complexity rules you arbitrarily enforce. Best practices for password security is making sure the user has to pick a password that isn't quite as guessable as it could be, so dictionary checks (don't forget to add all words on the password creation page and all words related to password entry, the application or its environment, plus all available user-specific info, e.g. birthdate and maiden name) and pattern matching (abc123) should do.
I've actually seen a lot of cases where "abc123.-" or something similar were used as root passwords because nobody could be arsed coming up with a real password that would meet the complexity criteria.
在联系我们公司在中国的海外分公司的技术人员后，我们发现，对于他们使用的大部分需要登录的系统，由于这些原因，他们倾向于坚持使用标准 ASCII 字符集作为用户名和密码。
中文键盘通常与中文字符一起设置 QWERTY，用户可以轻松地在中文和 ASCII 输入法之间切换以登录系统。 目前，我们将保持系统不变，并监控添加的其他培养物，处理可能出现的任何特殊情况。
有关中文输入法的更多信息，请参阅维基百科 - 计算机中文输入法
After contacting technical staff in a branch of our company abroad in China, we've found that for the bulk of the systems they use, which require logins, they tend to stick to the standard ASCII characterset for usernames and passwords for these reasons.
Chinese keyboards generally have the QWERTY set up alongside chinese characters and users are able to switch between chinese and ASCII input methods easily to login to systems. For now, we will be leaving our system as it is and monitor additional cultures as they are added, handling any special cases that may arise.
More information on Chinese input methods can be seen on Wikipedia - Chinese input methods for computers