进行密码检索/重置的安全方法？
在开始之前，我不使用 OAuth 的原因是我相信这并不是我们真正应该在这个项目中使用的东西，我们的目标是一个将被打包并转售给公司的平台，这些公司连接到他们自己的一组用途，我们真的不希望拥有我们这样的帐户不受 %100 控制，我们不希望它与其他服务共享登录，我们也不希望强迫人们获得 google/yahoo/openID/aol/facebook/blogger/wordpress/whatever帐户。
那么，我想要的是让用户重新设置密码的最佳方法。
我讨厌秘密问题的概念：你去了哪所学校？好吧，让我们检查一下你的 Facebook 页面。你一年级的老师是什么？我们就随便问问他们吧。
我讨厌通过电子邮件使用一次性密码：电子邮件从什么时候开始安全了？你的老板会读它。你每天都向我发送垃圾邮件。它进入了你的垃圾箱。它没有加密发送。
我也不想使用密码来重置密码。这根本没有道理。
我真的不知道最好的方法，所以我想我会询问社区。
Before I begin, my reason for not using OAuth is I believe it is not really something we should be using on this project, we're targeting a platform that will be packaged and resold to companies, which connect to their own set of uses that we really don't want to have accounts that we are not %100 in control of, we don't want it to be a shared-login with other services, and we don't want to force people into getting a google/yahoo/openID/aol/facebook/blogger/wordpress/whatever account.
Now then, What I would like is the best way to let users re-set a password.
I hate the concept of secret-questions: What school did you goto? Well, lets check your facebook page. What was your first-grade teacher? Lets just ask them casually.
I hate using one-time-passwords via email: Since when is email secure? Your boss reads it. Your sending out spam emails to me every day. It went into your junk-bin. It's not sent encrypted.
I don't want to use a password to reset a password either. This just doesn't make sense.
I'm really out of ideas here for the best way to do this, so I figure I would ask the community.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
你的问题是你需要外包信任。如果用户忘记了密码，您将不再有直接的方式来信任他们，因此您必须使用外部来源来重新建立您的关系。
如果您认为电子邮件不安全（实际上确实如此），您可以尝试电话。给他们打电话并提供临时密码。或者传真。或普通邮件，或短信等。
这与重置所经过的电话线/邮政运营商一样安全，并且在大多数地区，电话拦截或篡改邮件会受到法律的严格处罚。
如果这不行，请考虑向用户颁发 OTP 令牌、智能卡或其他东西。
Your problem is that you need to outsource trust. If the user forgets their password, you no longer have a direct way to trust them, so you have to use an outside source to reestablish your relationship.
If you think email is insecure (which it is, actually), you could try telephone. Give them a call with the temporary password. Or a fax. Or snail mail, or an SMS, etc.
This is as secure as the phone lines/postal carriers over which the reset travels, and in most areas, telephone intercepts or tampering with the mail is strictly punished by the law.
If that's no good, consider issuing users an OTP token, or smartcard, or something.
除非能够亲自审查此人，否则我认为您已经列出了我所见过的所有合理选项。在我看来，通过电子邮件设置一次性密码是更好的选择，因为人们至少希望将电子邮件保密。我个人讨厌秘密问题——答案公开的可能性太大（参见莎拉·佩林电子邮件事件）。如果你要做秘密问题，至少让用户选择他们自己的问题。
Barring being able to vet the person in person, I think you've listed all the reasonable options I've seen. In my opinion the one-time-password via email is the superior option as people tend to at least want to keep their email private. I personally hate secret questions - too big of a chance of the answers being public (see Sarah Palin email incident). If you are going to do secret questions, at least let the user choose their own questions.
我认为这需要一个困难的实现，但将新密码作为短信发送到用户的手机可能是另一种解决方案。手机比个人收件箱安全得多。
然后，用户被要求输入他们的手机号码。不需要该功能的用户将通过电子邮件获得新密码。
I think this requires a difficult implementation but sending new password to user's mobile phone as a text message may be an alternative solution. Mobile phones are much more secure than personal inbox.
Then, users are asked to enter their mobile phone numbers. Users that doesn't want that functionality are provided new passwords by email.
让用户选择一个或多个秘密图像。或者让用户上传自己的图像。
这比秘密问题效果更好。秘密问题有两个常见问题：
通过让用户选择秘密图像或更好地上传他们自己的图像。用户稍后在恢复密码时会更容易回忆起来，因为更容易进行视觉关联。
恢复密码时，用户可以选择多种选择来选择正确的图像。
Make users select a secret image (or images). Or make user upload their own image.
This works better than secret questions. Secret questions have two common problems:
By making user to select secret image(s) or better yet upload their own images. It'll be easier for user to recall it later when recovering the password, since it's easier to make visual associations.
When recovering the password present user with several choices to pick the right image.
因此，您实际上希望用户证明他就是他所声称的身份，而不透露有关自己的信息（假设您可以通过社交黑客获取任何信息）
有 3 种身份验证方法：您是谁（生物识别）、您拥有的东西（例如加密狗）和您知道的东西（密码、响应...）。 2 路或 3 路身份验证比 1 路身份验证安全得多。
根据定义，密码重置/恢复会降低身份验证过程的安全性，因为它现在不是 A，而是（A 或 B）。 （A= 密码，B=恢复密码）
因此，即使您的身份验证过程是 1 向（密码），您的恢复过程也应该是 2 向身份验证。
让我们看看您对密码恢复过程有哪些选择：
请注意，带有图片的公司 ID 标签是双向身份验证（既是您的身份，又是您拥有的身份）。
我认为最好的程序是让员工亲自前往 IT 部门，出示带照片的身份证件，并要求重置密码。
如果这是不可行的（太远 - 例如远程分支），请尝试使用可通过电话识别并可信任的deligator，因此员工必须向本地deligator出示ID标签。
如果您无法使用“您的身份”，您将只剩下您拥有的东西（电子邮件、电话号码、您自己的电脑）和您知道的东西（个人详细信息...）。你无法逃避它。
So you actually want the user to prove that he is who he claims he is, without revealing information about himself (assuming you can get ANY information with social hacking)
There are 3 ways for authentication: Something you are (biometrics), Something you have (dongle for example) and Something you know (password,response...). 2 or 3-way authentication is much more secure than 1-way.
Password reset/recovery, by definition reduces the security of the authentication procedure, because its now not A, but (A or B). (A= password, B=recover-password)
Therefore, even if your authentication procedure is 1-way (password), your recovery processes should be a 2-way authentication.
Let's see what are your options for the password recovery process:
Notice that corporate-ID tag with picture is a 2-way authentication (both something you are and something you have).
I think the best procedure is for the employee to physically go to the IT department, show his picture ID, and ask for a password reset.
If this is infeasible (too far - a remote branch for example), try to use a deligator who is recognized and can be trusted over the phone, so the employee will have to show the ID-tag to a local deligator.
If you can't use the 'Something you are' - you're left with something you have (e-mail, phone-number,your own PC) and something you know (personal details...). You can't escape it.