我应该加密存储 openid Claim_id 吗？
用户的OpenIDclaim_id存入数据库时是否需要加密？如果有人可以直接查看它，他们可以冒充该用户吗？
Does the OpenID claimed_id of a user need to be encrypted when stored in a database? If someone had plain view access to it, could they pose as that user?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
claimed_id 很像用户名。它根据提供商来识别用户。
因此，如果有人获得了claimed_id的访问权限，则不可能冒充该用户，除非攻击者也拥有密码，或者用户已经登录到攻击者的系统上（或者攻击者能够破坏登录过程）其他方式）。
因此，您可以将其视为用户名；加密不是必需的，但您可能会感觉更好，因为知道它是作为额外的安全层而存在的。
但是，如果有人直接访问您的数据库，他们很可能会通过其他方式危害您的整个网站。
The claimed_id is a lot like a username. It identifies the user according to their provider.
So, if someone gained access to a claimed_id, it would not be possible to pose as that user unless the attacker also had the password, or the user was already logged in on the attacker's system (or the attacker was able to subvert the login process some other way).
So, you can treat it like a username; encryption is not required, but you may feel better knowing it's there as an extra layer of security.
If someone gains direct access to your database, however, it's likely that they could compromise your entire site through other means.