这是禁用用户创建密码的好习惯吗？
我正在开发一个 Intranet 站点，需要选择两种方式之一： 1. 当用户可以将密码更改为他喜欢的任何单词时禁用选项，例如 pass123。这样就会有一个按钮使用一些复杂的算法生成新密码，然后用户接受它的使用。 2. 制定标准密码修改功能。这样用户可以输入他喜欢的任何密码并保存。 谢谢。
I am working on an intranet site and need to choose one way of two:
1. Disable an option when a user can change a password to any word he likes, for example, pass123. This way there will be a button to generate a new password using some complex algorithm and then user accepts its using.
2. Make standard password changing function. This way user can enter any password he likes and save it.
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
如果是 Intranet 站点，则身份验证通常应通过 LDAP 处理，而不是显式密码输入。
If it's an intranet site, then authentication should generally be handled through LDAP, not explicit password entry.
我想说，如果您只为用户提供一个生成新密码的按钮，那么他就不能在每个站点上使用相同的密码。
I'd say it's good if you only give the user a button to generate a new password, then he can't use the same password on every site.
如果您有密码强度策略，请在用户选择新密码时在表单上明确说明，如果密码强度不够，则不要接受新密码（选项 1）。
If you have a password strength policy, state this clearly on the form when the user chooses a new password and don't accept it if the password is not strong enough (option 1.).
这仅取决于您希望网站的安全程度。
如果您允许他们更改自己的密码，那么我建议您使用某种“密码强度”视觉辅助工具来帮助他们选择一个强密码。那么也许只有强密码除外。
只允许他们将密码更改为由复杂算法生成的另一个密码可能会导致他们不记得它，但是这样您就可以始终依靠强密码。通过电子邮件向他们发送密码意味着他们不必将密码写在某处，即使写下了密码，它也会安全地隐藏在他们的电子邮件登录后面。
It just depends on how secure you want the site to be.
If you allow them to change their own password, then I would suggest that you have some sort of "Password Strength" visual aid to help them pick a strong password. Then maybe only except strong passwords.
Only allowing them to change their password to another password generated from a complex algorithm would probably result in them not remembering it, however this way you can always count on strong passwords. Emailing them the password would mean that they would not have to write it down somewhere, and then even though it is written down it would then be securely hidden behind their email login.