如果没有 https (ssl) 如何安全地传输密码？
如果没有 https (ssl) 如何安全地传输密码？
How to transmit password securely if you don't have https (ssl)?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
如果没有 https (ssl) 如何安全地传输密码？
How to transmit password securely if you don't have https (ssl)?
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
接受 或继续使用网站，即表示您同意使用 Cookies 和您的相关数据。
发布评论
评论（3）
摘要式身份验证提供一些保护，特别是如果您的随机数生命周期很短，并且易于实现。这使得它适用于某些情况，其中密码是您唯一需要防止窥探的内容。有关详细信息，请参阅 RFC 2617。
但它仍然不如 HTTPS 安全。
Digest authentication offers some protection, especially if you've a nice short nonce lifetime, and is easy to implement. This makes it appropriate in some cases where the password is the only thing you need to protect from snooping. See RFC 2617 for more.
It still isn't as secure as HTTPS though.
安全远程密码协议正是针对这些情况而设计的。有一些 JavaScript 实现应该适合 HTTP 上下文。但请记住，这可以防止有人被动监听，但不能防止有人干预流量，因为他们可能只会向您的用户发送损坏的 JavaScript。
另请记住，即使客户端密码不会被泄露，但它们经过身份验证，它们仍然容易受到中间人攻击，除非您注意保护它们，例如使用 SRP Hermetic
Clipperz 应该是一个适合您目的的良好 JavaScript SRP 库。
The Secure Remote Password protocol is designed exactly for those cases. There are JavaScript implementations floating around that should be suitable in a HTTP context. But keep in mind this can protect from someone listening passively but not from someone meddling with the traffic as they could just send your users corrupt JavaScript instead.
Also keep in mind that even if the client passwords can't be compromised one they are authenticated they'll still be vulnerable to a man in the middle attack unless you take care of protecting them, e.g. using SRP Hermetic
Clipperz should be a good JavaScript SRP library suitable for your purpose.
绝对推荐使用 SSL，并且有多种廉价（或免费）来源可以获得 SSL 证书。但是，如果您绝对可以，您可以使用 JavaScript 加密库，例如 http://www.jcryption.org/不要使用 SSL。只要记住：
SSL is definitely recommended and there are several cheap (or free) sources to get SSL certificates. However, you can use a JavaScript encryption library like http://www.jcryption.org/ if you absolutely can't use SSL. Just remember: