如何处理脚本语言中的用户认证和错误修改？
我正在使用 Python/wxPython 构建一个集中式桌面应用程序。其中一项要求是用户身份验证，我正在尝试使用 LDAP 来实现（尽管这不是强制性的）。
该系统的用户将是制定预算的机械和电气工程师，最大的问题将是工业间谍活动。这是一个常见的问题，泄漏通常是通过非正式的方式从底层发生的，这可能会带来问题。该系统的设置方式使得每个用户都可以访问所有且仅其需要的信息，因此除了最高层的人之外没有人拥有整个项目的货币信息。
问题是，对于我能想到的实现身份验证系统的每一种方法，Python 的开放性让我想到至少一种绕过/从系统获取合理信息的方法，因为使用 py2exe 进行“编译”这是我能在 Windows 上最接近地混淆代码的方法。
我并不是真的试图隐藏代码，而是使身份验证例程本身安全，使其访问代码并不意味着能够访问应用程序。我想添加的一件事是对访问例程进行某种代码签名，以便用户可以确定他没有运行修改后的客户端应用程序。
我认为避免这种情况的方法之一是制作一个用于身份验证的 C 模块，但我宁愿不必这样做。
当然，这个问题现在正在发生变化，而不仅仅是“任何人都可以为我指明如何构建在 Python 上运行的安全身份验证系统的正确方向吗？这样的东西已经存在吗？”，而是“如何强化脚本编写” （Python）防止错误修改？”
I'm building a centralized desktop application using Python/wxPython. One of the requirements is User authentication, which I'm trying to implement using LDAP (although this is not mandatory).
Users of the system will be mechanical and electrical engineers making budgets, and the biggest problem would be industrial espionage. Its a common problem that leaks occur commonly from the bottom on informal ways, and this could pose problems. The system is set up in such a way that every user has access to all and only the information it needs, so that no one person but the people on top has monetary information on the whole project.
The problem is that, for every way I can think to implement the authentication system, Python's openness makes me think of at least one way of bypassing/getting sensible information from the system, because "compiling" with py2exe is the closest I can get to obfuscation of the code on Windows.
I'm not really trying to hide the code, but rather make the authentication routine secure by itself, make it in such a way that access to the code doesn't mean capability to access the application. One thing I wanted to add, was some sort of code signing to the access routine, so the user can be sure that he is not running a modified client app.
One of the ways I've thought to avoid this is making a C module for the authentication, but I would rather not have to do that.
Of course this question is changing now and is not just "Could anyone point me in the right direction as to how to build a secure authentication system running on Python? Does something like this already exist?", but "How do you harden an scripting (Python) against wrongful modification?"
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您的用户有多恶意？真的。
到底有多恶意？
如果您的用户是邪恶的反社会者并且不能信任桌面解决方案，那么不要构建桌面解决方案。建立一个网站。
如果您的用户是普通用户，他们会在尝试 (a) 学习 Python (b) 了解您的安全性如何工作以及 (c) 做出真诚的努力之前，通过安装来自色情网站的病毒、恶意软件和键盘记录器来破坏环境。打破它。
如果您确实存在桌面安全问题（即公共安全、军事等），请重新考虑使用桌面。
否则，放松，做正确的事，不要担心“脚本”。
C++ 程序更容易被破解，因为人们很懒并且允许 SQL 注入。
How malicious are your users? Really.
Exactly how malicious?
If your users are evil sociopaths and can't be trusted with a desktop solution, then don't build a desktop solution. Build a web site.
If your users are ordinary users, they'll screw the environment up by installing viruses, malware and keyloggers from porn sites before they try to (a) learn Python (b) learn how your security works and (c) make a sincere effort at breaking it.
If you actually have desktop security issues (i.e., public safety, military, etc.) then rethink using the desktop.
Otherwise, relax, do the right thing, and don't worry about "scripting".
C++ programs are easier to hack because people are lazy and permit SQL injection.
可能：
Possibly: