我目前正在开发一个基于 HTML+JS 的应用程序，几乎完全基于 ajax 连接（使用 jQuery.ajax() 调用来简化该过程）。
我正在考虑在不使用 HTTPS 的情况下进行安全调用的最佳实践（至少在这个时候。我现在买不起证书）。
此时，我唯一关心的是注册和登录步骤。也许登录会更容易一些。我想到发送用户名和时间戳，然后使用用户的密码对它们进行加密。因此，通过这样做，我不会发送任何密码（像 OAuth 一样作为秘密保存）。服务器应检查用户，使用密码进行解密，并将收到的时间戳与解密结果配对。服务器应该将类似于随机数的数字保存到数据库中（以避免重复攻击），然后向用户返回另一个唯一的 ID（使用用户的密码加密）。此时，用户应该开始使用该密钥来加密他的所有信息（可能还有另一个随机数）并将其发送到服务器。如果您发现任何错误或泄漏，请纠正我。
对我来说最大的问题是注册。我无法使用常规密码加密信息，因为如果我在 javascript 中这样做，任何人都可能知道密码。如果我提供临时生成的密码进行加密并将其从服务器发送到客户端，则任何嗅探器都可以获取它并用于解密信息。
我知道 HTTPS 此时可以挽救我的生命（也许这是唯一的解决方案），但此时我无法使用它。
还有其他解决方案吗，或者我应该等到可以使用 HTTPS 为止吗？请记住，如果我可以跳过等待，那就更好了。谢谢伙伴们！
I'm currently developing an application in HTML+JS based almost entirely in ajax connections (using the jQuery.ajax() call to ease the process).
I was thinking about the best practice to make secure calls without using HTTPS (at least at this time. I can't afford paying for a certificate right now).
At this point, the only thing that concerns me is the registration and login steps. Maybe the login is a bit easier. I thought of sending the username and a timestamp, and then encrypt them using the user's password. So, by doing this, I wouldn't be sending any password (keeping as a secret like in OAuth). The server should check the user, decrypt using the password and pairing the recieved timestamp with the decrypted result. The server should keep the nonce-like number into a database (to avoid repetition attacks) and then give back to the user another unique id (encrypted with the user's password). At that point the user should start using that key to encrypt all his information (and probably another nonce) and send it to the server. Please correct me if you find any mistake or leak.
The very big problem to me is the registration. I can't encrypt with a regular password the information, because if I do that in the javascript, any could know the password. If I serve temporary generated passwords to encrypt and I send it from the server to the client, any sniffer could get it and use to decrypt the info.
I know HTTPS could save my life at this point (and maybe that's the only solution), but at this point I'm not able to use it.
Is there any other solution, or should I wait until I can use HTTPS? Bear in mind that if I could skip the wait, it would be better. Thanks mates!
发布评论
评论（4）
简短的回答：没有 HTTPS，您就无法做到这
一点 较长的回答：如果您尝试在没有 HTTPS 的情况下做到这一点，您会发现自己试图重现 HTTPS 设计的所有功能。您可能会达到某个目标，但相信您将成功实现 HTTPS 提供的 1% 是不现实的。您将获得的唯一好处是一个模糊的安全机制（通过模糊实现安全性），这对于不关键的系统来说可能没问题，但在真正的关键情况下会严重失败。
您可以创建自己熟悉的证书，然后像使用常规 HTTP 调用一样使用 Ajax。唯一的缺点是用户会收到警告消息。
Short answer: You can't do it without HTTPS
Longer answer: If you try to do it without HTTPS, you will find yourself trying to reproduce everything that HTTPS was designed to do. You could reach at some point, but it is unrealistic to believe that you will succeed in implementing even the 1% that HTTPS offers. The only benefit you will have would be an obscure security mechanism (security through obscurity), which may be OK for not critical systems, but would fail miserably in a real critical situation.
You could create your own certificate you know and then work with Ajax the same way as with regular HTTP calls. The only drawback is that the users will get a warning message.
使用 SSL 证书是唯一的方法，如果你用 JavaScript 对其进行加密，任何人都可以读取代码并解密。
http://www.startssl.com/
Using an SSL Certificate is the only way really, if you encrypt it in javascript anyone can read the code and decrypt it.
http://www.startssl.com/
这不是一项简单的任务。您可能会发现购买证书更便宜、更有效。
编辑：这也意味着所有常规 HTTP 流量（HTML、图像、CSS 等）均以明文形式发送。这可能是一个问题，因为它可能允许窃听者间接弄清楚用户在做什么。
This would not be a trivial task. You'll probably find that it's cheaper and more effective to just buy a certificate.
EDIT: This also means that all the regular HTTP traffic (HTML, images, CSS, etc) is sent in the clear. That could be a problem, since it might allow an eavesdropper to indirectly figure out what the user is doing.
我认为你应该看看：
http://assl.sullof.com/assl/
以下是该项目的描述：
I think you should have a look at :
http://assl.sullof.com/assl/
Here is the description of the project :