VB.NET：密码加密
将 VB.NET 站点升级为使用加密密码的最简单方法是什么？ System.UI 中是否内置了易于使用的加密算法？
我的网站使用纯文本密码存储，很快就会从本地网络上的专用服务器转到 godaddy 的公共服务器。我将不得不开始向所有密码解析函数添加加密算法，如果我可以在 web.config 文件中设置 SALT 密钥并加密（密码）或类似的东西，那就太好了。
What's the simplest way to upgrade a VB.NET site to using encrypted passwords? Are there easy to use encryption algorithms built in to System.UI?
My site is using plain text password storage, and it will soon be going to a public server at godaddy from a private one on the local network. I'm going to have to start adding in encryption algorithms to all the password parsing functions, and it would be nice if I could just set a SALT key in the web.config file and Encrypt(password) or something like that.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
不在 System.UI 中，但绝对在 System.Security.Cryptography 中：
http://msdn.microsoft.com/en-us/library/system.security.cryptography.aspx
绝对有标准的“良好实践”会想要跟随。重新发明轮子没有意义，尤其是在密码存储方面。为此，有大量资源，而且它们更好比我更擅长:)
Not in
System.UIbut definitely inSystem.Security.Cryptography:http://msdn.microsoft.com/en-us/library/system.security.cryptography.aspx
There are definitely standard "good practices" you'll want to follow. No point in re-inventing the wheel, especially when it comes to password storage. There are a lot of resources for that, and they're better at it than I am :)
为每个用户生成一个盐并将其存储在数据库中。然后对用户传入的纯文本密码进行哈希处理，添加盐并再次进行哈希处理。为了额外的安全性，请在发回服务器之前在客户端对密码进行哈希处理。获得发布的哈希后，您可以向其中添加盐并再次对其进行哈希，然后将该值存储为用户密码。这基本上可以确保没有人，即使他们有权访问您的数据库，也可以轻松获取用户密码。
这是最简单的方法，所需要的只是对密码学库的引用。您可以随心所欲地使用您的算法。我刚刚提供了一个可以在几分钟内轻松完成的事情的松散示例。
Generate a salt for each user and store it in the database. Then hash the users incoming plain text password, add the salt to it and hash it again. For extra security, hash the password at the client before posting back to your server. Once you have the posted hash, you can add the salt to it and hash it again then store that value as the users password. This basically ensures that no one, even if they have access to your database can easily get to the users passwords.
This is the simplest way and all that is required is a reference to the cryptography libraries. You can get as fancy as you want with your algorithm. I've just provided a loose example of something that could be easily done in just a few minutes.