从网站进行电子邮件通信期间发送密码信息是否有意义
大多数注册在线网站都会发送一个链接来激活网站，并且在与最终用户进一步通信时，他们会提供有关该网站的信息，并以明文形式提供带有密码的登录凭据（如下所示）
用户名 - [电子邮件受保护] 密码 - mysecretpassword
在这种情况下您会怎么做？从可用性的角度来看，以明文形式发送密码信息是否有意义，或者您是否应该避免发送此信息。我的印象是，大多数密码在存储到数据库之前都会经过 MD5 哈希处理，因此服务提供商将无法访问明文密码，这是否违反安全规定？
Most of the online sites on registration do send a link to activate the site and on any further correspondence with the end user they provide information about the site and also provide the login credentials with password in clear text (as given below)
Username - [email protected]
Password - mysecretpassword
What would you do in such a case? From a usability perspective does it make sense to send the password information in clear text or should you just avoid sending this information. I was under the impression that most of the passwords are MD5 hashed before storing in the database and hence the service provider will not have any access to clear text passwords, is this a security violation?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这是一个普遍存在的谬论，如果您收到纯文本密码，则意味着它们没有安全存储 - 密码像任何其他数据一样可以使用可逆加密来存储。
话虽如此，向您发送明文密码的任何人很可能都不了解安全性，并且可能不小心存储它们（除非密码被用作弱现实世界标识符，例如作为店内会员计划的一部分） ，在这种情况下，它们不应该被称为密码，以免您的客户感到困惑）。
如果您以纯文本形式发送密码，您可能会认为它与重要的内容相关联，那么它已被泄露。弱点太多了。您还可能造成更多无意的伤害。
It's a commonly-held fallacy that if you receive a password in plain-text it means they aren't stored securely - passwords like any other data can be stored using reversible encryption.
Having said that, it's pretty likely anyone that sends you a plaintext password does not have a clue about security and is probably storing them carelessly (unless the passwords are used as weak real-world identifiers, say as part of an in-store membership scheme, in which case they shouldn't be called passwords lest your customers get confused).
If you send a password plain-text you may as well assume that if it is linked to something important then it has been compromised. There are just too many weak points. You can also do a lot more unintentional damage.
是的，这绝对是违反安全规定的。只应存储密码的加盐和散列版本。
重置密码功能很常见，可以发送临时自动生成的密码（仅适用于一次登录）或一次性重置链接。这确实意味着您的其他帐户与您的电子邮件一样安全。
但是，您应该避开任何以明文形式通过电子邮件发送您的实际密码的网站。
Yes, this is definitely a security violation. Only a salted and hashed version of passwords should be stored.
It is common to have reset password functionality that sends either a temporary auto-generated password (which should be good for only one login) or a one-time reset link. This does mean your other accounts are only as secure as your email.
However, you should steer clear of any site that will email your actual password in clear text.
总是需要权衡，开发人员必须考虑可用性、目标用户的悟性、数据的保密性和重要性、网站的使用频率等等。当然，用户不希望自己的隐私受到侵犯，但另一方面，“普通”网络用户可能会因为必须记住密码，甚至必须首先发明一个密码而感到厌烦（有些网站通过生成密码来简化用户注册）随机密码并通过电子邮件发送）。网站开发人员有责任在设计安全性时牢记用户的最大利益。
我的建议是，只有在随机生成密码时才应以明文形式通过电子邮件发送密码。这可以避免以下尴尬的情况：用户使用他们已经用于各种其他 Web 服务的密码进行注册，然后收到包含他们刚刚输入的密码的注册确认电子邮件。许多用户可能没有足够的安全意识，无法为每个网站使用唯一的密码，但他们有足够的安全意识，认识到不应通过电子邮件发送“敏感”密码。
There are always trade-offs, and developers have to consider useability, the savvy-ness of the intended users, the secrecy and importance of the data, the frequency that the website will be used, and so on. Of course users don't want their privacy violated, but on the other hand "ordinary" web users may be turned off by having to remember a password, or even having to invent one in the first place (some websites simplify user registration by generating a random password and emailing it). Website developers have a responsibility to keep the users' best interests in mind when designing security.
My advice is that passwords should only be emailed in the clear when they are randomly generated. This avoids the following awkward scenario: a user registers with a password which they are already using for various other web services, and then receives a registration confirmation email containing the password they just entered. A lot of users may not be security-conscious enough to use unique passwords for every website, but they are security-conscious enough to recognize that "sensitive" passwords should not be sent around by email.