锁定策略和一次性密码
我使用 RFC 4226 为我的网站实现了一次性密码系统。该密码通过短信发送到移动设备。用户只能在移动设备上接收密码，密码将在 15 分钟后过期。
用户还拥有通常使用的标准字母数字“主密码”。我已经实施了 3 次故障锁定工作流程。此锁定持续 15 分钟。
我的问题是，从安全角度来看，仅锁定“主密码”是否可以接受？如果用户使用一次性密码功能，我是否应该允许他们绕过锁定策略？我是否打开了任何类型的安全漏洞？
I have a one time password system implemented for my website using RFC 4226. This password is sent via SMS to a mobile device. The user can only receive the password on their mobile device, and the password expires after 15 minutes.
Users also have the standard alpha-numeric "master password" that is typically used. I have implemented a 3 failure lockout workflow. This lockout lasts for 15 minutes.
My question is from a security standpoint is it acceptable to only lockout the "master password"? Should I allow the user around the lockout policy if they use the one time password feature? Am I opening any kind of security holes?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我理解您对安全性与可用性的观点，我为您提供静态密码锁定机制，该机制已成为几乎每个网站的事实上的标准。
这里解释得很好，所以我不需要再次输入：
i understand your point of view security vs. usability, i offer you implement static password lockout mechanism, which has become a de-facto standard for almost every website.
here explained really well so i don't need to type again:
这并不完全是您问题的答案，但是在构建这样的系统时，您必须记住，每次两个对接时，可用性都会胜过安全性。对最终用户制定的安全策略越严格，他们就越有动力想出不安全的解决方法来完成工作。
施奈尔说的比我在这里总结的要好，我'我建议在那里阅读他的东西。
It's not exactly an answer to your question, but when building systems like this you have to keep in mind that usability trumps security every time the two butt heads. The more arduous you make your security policy on end-users, the more they'll be motivated to come up with insecure workarounds to get their jobs done.
Schneier said it better than I can summarize here though, I'd suggest reading up on his stuff there.