发送未加密的密码是一个好的做法吗？
我正在建立一个需要注册和登录的网站。 由于我是网络开发新手，我在想是否可以选择将未加密的密码发送到服务器。 或者，既然我对密码学一无所知，你会推荐我什么？
I'm building a website that will require registration and login.
Since I'm new to web developing, i was thinkink if sending unencrypted passwords to the server is an option.
Or, what you would reccomand me, since I don't know nothing about cryptography?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
如果您的网站只是用于测试或在内联网中使用，那没什么大不了的。
如果没有，我强烈建议您使用 SSL。
如果您买不起证书，至少为您的用户提供以下选项：
If your website is just for testing or for use within the intranet, it's not that big of a deal.
If not, I highly suggest you use SSL.
If you can't afford the certificate, at least give your users the option to :
如果您的意思是从浏览器发送到服务器，那么您需要使用 https/ssl 来加密连接，而不是密码本身。另一方面，如果您正在谈论存储明文密码，那么是的，这也很糟糕。您应该使用强盐（每个用户最好）和慢速算法对其进行哈希处理。
此答案更详细地介绍了有关通过 SSL 发送密码的信息：通过网络发送密码
可以使用 PHP 的 crypt 进行哈希： http://php.net/manual/en/function.crypt.php
If you mean sending from browser to your server, then you need to use https/ssl to encrypt the connection, not the password itself. If on the other hand you're talking about storing passwords plaintext, then yes, that's bad as well. You should hash it with a strong salt (per user is best) and a slow algorithm.
This answer goes into more detail about sending passwords over SSL : Sending passwords over the web
You can use PHP's crypt for hashing : http://php.net/manual/en/function.crypt.php
请记住，即使您的服务没有任何有价值的有效负载，也可以保证您的许多用户将使用与处理更有价值的内容相同的密码，这意味着违规或容易被拦截您的密码可能会造成伤害。即使这对用户来说是一种不好的做法，但这也是生活中不可避免的事实，因此在任何情况下，用户都没有责任对可公开访问的服务的用户凭据感到厌倦。请使用 SSL/https 或 OpenID（或其他外部托管的登录管理方案，甚至 Facebook：如何使用 facebook 在我的网站上进行用户登录？），如果您是密码持有者，请不要将它们以明文形式保存在数据库中。
Keep in mind that even when your service doesn't have any kind of valuable payload, it is guaranteed that many of your users will use the same password with it that they use with something more valuable, which means a breach or an easily-intercepted password on your end is capable of causing harm. Even if this is bad practice on the user's part, it's an unavoidable fact of life, so there is really no circumstance under which it is responsible to be blasé about user credentials with a publicly-accessible service. Please use SSL/https or OpenID (or another externally-hosted login management scheme, even Facebook: how to use facebook for user login on my website?) and if you are the password holder, please don't save them in the db as plaintext.
发送未加密的密码永远是不好的。对于一个严肃的网站，您应该使用 https 加密浏览器和服务器之间的流量。您可以通过购买安装在 Web 服务器上的证书来实现此目的。
It is never good to send password unencrypted. For a serious web site you should encrypt the traffic between the browser and server using https. You do that by purchasing a certificate that you install on the web server.
永远不要在网上发送原始关键数据，我认为使用 ssl 是最好的解决方案，您也可以使用 javascript 加密器在客户端加密密码并在服务器中解密，
never send raw critical data on net,using ssl is best solution i think,also you can use javascript encryptor to encrypt password in client side and decrypt in server,