Silverlight 电子商务应用程序中的可破坏密码
我有一个业务需求，要求最终用户能够使用一次性密码登录电子商务系统，购买课程，然后永远无法再次登录。目前，允许其员工（我客户的学生）的公司将为他们生成该密码，并向我发送他们正在生成的密码列表。
我不喜欢这个概念，但我还没有想出一个适合各方的更好的概念。如果购买过程中出现问题，他们必须返回公司获取新的登录凭据。
购买课程的能力不能向公众开放，必须通过电子商务门户，目前只有一家公司参与，但将来会有更多公司参与。我认为这是一场彻底的维护噩梦。
我的问题是，以前有人遇到过这个问题吗？如果您不介意分享，请告诉我您是如何解决的，或者为我指出一个可以给我一些见解的方向。我已经用谷歌搜索了这个概念，但没有想出任何好主意。
I have a business requirement that calls for an end user to be able to login to an e-commerce system with a one-time use password, purchase a course, and then never be able to login again. At the moment the company that is allowing their employees, my client's students, is going to generate that password for them and send me a list of the passwords they are generating.
I do not like the concept but I have yet to come up with a better one that will work for all parties. If something happens mid-purchase they have to go back to the company to get new login credentials.
The ability to purchase a course cannot be open to the public, it has to be through the e-commerce portal, and for the moment there is only one company participating but there will be more in the future. I am seeing this as a total maintenance nightmare.
My question is has anyone run across this before, if you wouldn't mind sharing tell me how you solved it, or point me in a direction that will give me some insight. I have googled the concept to death and have not come up with any bright ideas.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您无法自行解决“购买过程中的问题”问题 - 他们需要修改其服务，以便在交易完成时密码被销毁。
无论您对密码做什么，一旦用户登录，密码就会在其服务器上被禁用。在那之后，你就无法控制了。
他们应该：
You can't resolve the "problem during purchase" issue yourself - They need to modify their service so that the password is destroyed when the transaction completes.
No matter what you do with regards to the password, once the user is logged in, the password is disabled on their servers. After that, you have no control.
They should either:
我已经找到了这个问题的答案，并将其记录在此处，以供我个人完成强迫症的目的。我创建了一个登录表单，允许使用两部分密钥；用户名基于公司名称加上内部公司 ID（不是 GUID），并与加密密钥密码（例如：@SCD6-）以及公司生成的员工 ID 配对。问题是我不知道员工 ID 是什么，只使用它，因为它应该是唯一的，尽管它不是唯一的也没关系，一旦用户登录一次，完成了唯一稍微安全的过程，然后检查登录无效，并且永远无法再次使用，除非手动解锁（以防将来某个时候出现重复的员工ID，这种情况不太可能发生）。用户名和密钥通过电子邮件发送给目标公司的员工，由目标公司生成。如果我的系统中确实有员工ID（50/50），那么我可以预先填写表格。
这个锁保护的唯一东西是一个进程，而不是安全信息，所以我不太担心安全性，它唯一的真正目的是防止 John Q 绊倒该进程并支付我的客户稍后需要退款的钱。如果这是一个安全的数据处理，我不会使用这种方法。
I have the answer for this one and document it here for my own personal OCD completion purposes. I created a login form that allows for a two part key; username is based on company name plus internal company ID(not a guid), paired with a password that is cryptic key, ex: @SCD6-, plus employee id generated by the company. The rub is I don't know what the employee ID is, and only use it because it should be unique although it doesn't matter if it is not, once the user logs in once completes the only marginally secure process then checks out the login is invalid and can never be used again, unless manually unlocked (in case of a duplicate employeeID at some time in the future, which is unlikely). The username and key is emailed to the employees of the target company, which is generated by the target company.If I do have the employeeID in the system which is 50/50 then I can pre-fill the forms out.
The only thing this lock protects is a process and not secure information so I am not too worried about security and it's only real purpose is to keep John Q, from stumbling onto the process and paying money that my client would need to refund later. If it were a secure data process I would not use this method.