使用 IP 记录错误的用户名/密码尝试是良好的做法吗？
我开发了一个 Intranet 应用程序，并使用 Forms-Authentication 实现了自定义 ASP.NET 会员提供程序。我认为在 DBMS 中记录所有失败的登录尝试是个好主意。因此，我创建了一个具有以下模型的表格：
现在我的问题：
出于安全原因存储此内容是良好做法还是由于数据保护原因甚至被禁止（德国）？我将原始密码散列存储在数据库中，但日志表中的错误密码（或使用错误用户名的正确密码）是明文形式。
有人可能会争辩说，每个有权访问此表的人都可以获取该应用程序的用户密码，也可以获取其他应用程序的用户密码，因为忘记密码（或用户名）的人也可能会尝试其他应用程序。
i've developed an intranet application and implemented an custom ASP.NET Membership Provider with Forms-Authentication. I thought it would be a good idea to log all failed login attempts in DBMS. Hence i've created a table with following model:
Now my question:
Is it good practise to store this for safety reasons or is it even forbidden due to data protection reasons(germany)? I'm storing the original passwords hashed in db but the wrong passwords(or correct pw with wrong username) in the log-table are in clear-text.
Somebody could argue that everybody with access to this table could get user's passwords not alone for this application but for others too, because people who have forgotten their passwords (or their username) might try out others as well.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
对于拼写错误用户 ID 但提供正确密码的用户来说，这不是一个好主意！
Not a good idea for users who misspell their user ID but give the correct password!
我认为这是相当危险的，因为许多错误的登录只会导致一个字符左右的关闭。如果您正在尝试收集数据，也许您应该通过算法运行错误密码，并只存储您正在查找的最终报告数据..例如，如果您正在尝试找出它们与密码的接近程度，也许而是存储一个表示有多少个字符不正确的整数。
I'd imagine it is quite dangerous, as many bad logins will only be a character or so off. If you are trying to collect data, perhaps you should run the bad passwords through an algorithm and only store the final report data you are looking for.. for instance, if you are trying to find out how close they are to the password, perhaps store an integer of how many characters were incorrect instead.
存储密码不会给您带来太多好处。如果您觉得需要查看密码，也许可以在 X 次错误登录尝试后记录下来，这样就可以避免记录拼写错误。
You don't gain much by storing the password. If you feel the need to see the password, perhaps record it after X incorrect login attempts, that way you avoid recording typos.
好吧，我认为你应该只保留密码哈希，如果你记录尝试，那么你为什么需要这些数据？用户 ID 或名称与 IP 地址和日期相结合即可解决问题。
Well I think that you should only keep password hashes, and if you log attempts, then why do you need that data? User ID or name combined with IP address and date will do the trick.