Meebo 等网站如何存储用户名和密码？
我最近使用了 Meebo，我必须承认我对在网站中输入 IM 登录信息有点偏执像这样。 他们如何存储我的每个单独 IM 服务的用户名和密码？ 只有当某个网站获取我的密码并对其执行某种类型的不可逆转的单向功能时，我才会感到放心，但似乎 Meebo 必须以一种可以随时检索密码的方式存储我的密码，以便于自动登录到它们支持的单独 IM 服务。 我对此感到偏执有道理吗？
编辑： 我发现以下摘录自 Meebo 的隐私政策：
第三方 IM 服务用户名和密码。 Meebo 允许您通过 Meebo 登录您的帐户来访问第三方 IM 服务（“第三方 IM 服务”）。 为了访问您的第三方 IM 服务帐户，您必须在 Meebo 服务上输入适用的用户名和密码。 为了在网站上使用基本 IM 服务，Meebo 不会在我们的服务器上存储您的第三方 IM 服务帐户的密码。 如果您希望使用服务的高级功能（例如自动登录），可能需要存储您的密码。
Jeff Atwood 不久前在本文中就此主题发表过文章：< a href="http://www.codinghorror.com/blog/archives/001128.html" rel="nofollow noreferrer">请向我们提供您的电子邮件密码。
I recently used Meebo and I must admit I'm a little paranoid about typing my IM login information into a site like this. How do they store my username and password for each of the separate IM services? I only feel comfortable when a site takes my password and does some type of irreversible, one-way function on it, but it seems that Meebo would have to store my passwords in a way that they could retrieve them at anytime in order to facilitate the automatic logon into the separate IM services they support. Am I justified in being paranoid about this?
EDIT:
I found this excerpt from Meebo's privacy policy:
Third Party IM Service User Names and Passwords. Meebo allows you to access third party IM services by logging into your account through Meebo (the "Third Party IM Services"). In order to access your Third Party IM Service account, you must enter your applicable user name(s) and password(s) on the Meebo Service. To use the basic IM services on the Websites, Meebo does not store the password(s) of your Third Party IM Service accounts on our server. If you wish to utilize advanced features of the Services, such as automatic sign-in, storage of your password(s) may be necessary.
Jeff Atwood posted on this topic a while back in this article: Please Give Us Your Email Password.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（7）
是的，你是。
Yes, you are.
记下第 2 行和第 3 行。为了执行#3，Meebo 需要您的密码； （除非 IM 提供商和 Meebo 之间存在某种合作（这是可能的，但不太可能））它在这些行之间的某个时刻拥有您的明文密码。
恭喜，您不再完全控制您的 IM 帐户； 就 IM 服务而言，Meebo 就是您。
换句话说：您相信 Meebo 不会滥用您的密码吗？ 您信任 Meebo 来保护您的密码吗？ 您相信 Meebo 不会被黑客攻击并且您的密码不会被盗吗？
据我所知，没有办法分辨（除非你是 Meebo，但你不是）。
归结起来就是：你相信 Meebo 的承诺吗？
这是我的 0.02 美元：方便吗？ 查看。 极度缺乏安全感？ 查看。
哦，回答标题中的问题：最佳实践是“加密密码，不要将明文保留在任何地方（超过绝对必要的时间）”。 然而，我见过太多带有明文密码字段的数据库； 一些企业显然认为加密是浪费精力，直到发生真正糟糕的事情。 米宝有吗？ 我没有办法告诉。
Take note of lines 2 and 3. In order to do #3, Meebo needs your password; (unless there's some cooperation between the IM provider and Meebo (which is possible but unlikely)) it has, at some point between those lines, your plaintext password.
Congratulations, you no longer have complete control over your IM account; as far as the IM service cares, Meebo is you.
In other words: do you trust Meebo not to abuse your password? Do you trust Meebo to protect your password? Do you trust that Meebo won't be hacked and your password stolen?
As far as I see, there's no way to tell (unless you're Meebo, which you're not).
It boils down to this: do you trust Meebo's promises?
Here's my $0.02: Convenient? Check. Horribly insecure? Check.
Oh, and to answer the question in the title: best practice would be "encrypt the password, don't keep the plaintext anywhere (any longer than absolutely necessary)". However, I've seen too many databases with plaintext password fields; some businesses apparently see encryption as waste of effort until Something Really Bad Happens. Does Meebo? I don't have a way to tell.
是的，你说得有道理。 当您将用户名/密码提供给网站（任何网站）时，您真的不知道/保证他们将用它做什么以及他们将如何保护它。
Yes, you are justified. When you give your username/password to a site, any site, you really have no idea/guarantee what they are going to do with it and how they will protect it.
除非他们与每个供应商签订了合同，在合同中创建哈希并仅传递哈希，否则他们将需要存储您的信息。
unless they have contracts with each of the vendors in which they create a hash and pass just the hash, they will need to store your information.
在 meebo 博客上，他们更详细地讨论了他们的安全功能。 摘要如下：
“我们存储您的 [meebo] 密码的加盐哈希，而不是密码本身。”
“[我们使用您的] Meebo 帐户密码临时解密您的 IM 帐户的密码。我们仅将解密版本保留在内存，当你退出时我们就会忘记解密版本。”
所以这项服务看起来相当安全。 如果您想更加安全，请不要使用您的 meebo 帐户登录，而应使用您的 IM 详细信息登录。
On the meebo blog they discuss their security features in more detail. Here is the summary:
"We store a salted hash of your [meebo] password, NOT The password itself. "
"[we use your] Meebo account password to temporarily decrypt the passwords for your IM accounts. We only keep the decrypted version in memory, and we forget the decrypted version as soon as you log out."
So the service seems pretty safe. If you want to be extra safe don't log in with your meebo account, instead log in with your IM details.
他们在这里解释了如何将数据从浏览器发送到服务器； 提交表单之前在 JavaScript 中进行 RSA 加密。
http://www.meebo.com/security/
编辑：澄清，他们没有指定他们如何存储它，但大概是双向加密，也许以用户的密码作为密钥？
They explain it how they send the data from the browser to their servers here; RSA-encryption in javascript before form submission.
http://www.meebo.com/security/
EDIT: Clarification, they don't specify how they store it, but presumably it's a two-way encryption, maybe with the user's password as the key?
Meebo 使用您的 meebo 帐户密码对您的个人帐户密码进行加密。
您的 meebo 帐户密码已加密。 因此，除非您登录，否则 Meebo 不会知道您的任何密码。
http://blog.meebo.com/?p=2220
Meebo encrypts your individual account password w/ your meebo account password.
Your meebo account password is bcrypt-ed. So Meebo doesn't know any of your passwords unless you're logged in.
http://blog.meebo.com/?p=2220