如何建立基于网络的密码数据库
我目前正在考虑一个具有多个帐户的 Web 驱动的密码数据库，以及存储在 MySQL 或 Oracle 等数据库引擎中的登录名/密码。每个密码应该仅对部分用户可用：
用户 A 登录，创建新的登录信息并勾选一些复选框以使该信息对用户 B 和用户 C 可用。用户 D 和 E 不应看到它。
我的第一个想法：
密码以加密方式存储在数据库中。
当然，这里的主要问题是，如果您有权访问服务器，您可以查看脚本并检测解密算法，使您能够立即解密所有存储的密码。
所以我想，每个用户都会获得密码工具的主密码，这是加密/解密算法的一部分（用户输入此主密码并使用自己的凭据登录）。这样做的好处是，第三人不能简单地查看脚本来了解它们是如何解密的，因为他必须知道主密码。当然，访问权限非常有限的用户仍然有可能解密所有密码，因为他们知道主密码。
所以基本上我的问题是：如果有人可以访问服务器，如何才能拥有一个基于网络的多用户密码数据库，而不仅仅是通过查看简单的源代码轻松破解？是否有可能使解密以某种方式依赖于可能正式看到密码的用户登录？
感谢您对此的任何提示！
让事情变得更清楚的通知： 它旨在成为一个密码数据库，其中存储不同应用程序的登录凭据，用户可以登录并查看他们必须为这些应用程序使用哪些凭据。比如1Password等密码管理工具。它只是一个带有用户名/密码的简单查找表，不应插入第三方应用程序或与第三方应用程序交互。
I've currently thought about a web-driven password database with multiple accounts and the login/passwords stored in a Database engine like MySQL or Oracle. Each password should only be available to some of the users:
User A logs in, creates a new login information and ticks some checkboxes to make this information available to User B and User C. User D and E should not see it.
My first thoughts:
The passwords are stored encrypted in the database.
The main problem here is of course, if you have access to the server you can take a look a the script and detect the decryption algorithm with enables you to de-crypt all the stored passwords at once.
So I thought, each user gets a master password to the password tool which is part of the encryption/decryption algorithm (user enters this master password and the logs in with his own credentials). This had the benefit that a third person could not simply take a look at the scripts to see how they are decrypted exactly as he had to know the master password. But of course it's still possible for users with very limited access to decrypt all of the passwords as they know the master password.
So basically my question is: how is it possible to have a webbased multiple user password database which is not just cracked easily by looking at the plain sources, if someone gets access to the server? Is it possible to make the decryption somehow dependent on the user logins which may officially see the password?
Thanks for any hints on this!
Notice to make things more clear:
It's intended to be a password database where login credentials for different applications are stored and users can log in and see what credentials they have to use for these applications. Like password manager tools like 1Password and so on. It's just a simple lookup table with username/password, it should not insert or interact with 3rd-party applications.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
解决方案在这里：
是否有可能使用多个私钥加密（PHP）？
The solution is here:
Is it possible to have encryption with multiple private keys (PHP)?
使用单向哈希算法，例如 MD5 或 SHA-1（或其一些更强的变体）。这样，就无法对存储的密码进行逆向工程。
Use a one way hashing algorithm like MD5 or SHA-1 (or some of its stronger variants). This way, there will be no way to reverse engineer stored passwords.
您是否看过类似 Passwordstate 的产品？所有密码都在数据库中加密，可以在多人之间共享，所有页面都经过混淆处理以提供进一步保护，并且它与 Active Directory 集成以进行身份验证。
如果您想查看的话，可以免费获得 10 个用户许可证。
Have you looked at any products like Passwordstate? All the passwords are encrypted within the database, they can be shared amongst multiple people, all the pages are obfuscated for further protection, and it integrates with Active Directory for authentication.
There's a free 10 user license if you want to check it out.