应用程序报告当前密码还剩多少天过期是否不安全？
应用程序报告当前密码还剩多少天过期是否不安全？
例如，如果密码每 30 天过期，如果应用程序告诉您密码将在 5 天后过期（当然是在您登录之后）。
或者，应用程序是否可以存储一个 cookie，告诉应用程序在密码过期前 3 天开始建议更改密码？
其中任何一个都会被视为不好的做法吗？
Is it insecure for an app to report how many days are left before current password expires?
For example, if passwords expire every 30 days, if the app told you that your password will expire in 5 days (after you have logged in of course).
Or, is it possible that the app could store a cookie that tells the app to start suggesting a password change 3 days before the password expires?
Would either of these be considered bad practice?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
请参阅 Bruce Schneier 关于更改密码的博客文章。
密码过期的主要原因是使泄露的密码过期；告诉用户（或攻击者）它将过期并不会改变这一点。它的作用是告诉攻击者在截止日期之前妥协其他东西；这是否存在风险取决于是否存在此类攻击者（我希望首先要做的是安装 rootkit）。
安全好处是用户有一定的时间（例如一周）来考虑新密码。如果我不急于完成工作，我可以在一两分钟内想出一个还算不错的密码；否则我只会在最后增加一个计数器。 每个人都会这样做。
我的感觉是，有效地说“在下周的某个时候，考虑一个新密码”的好处超过了潜在的风险，但 30 天太短了。我实际上需要记住的密码只有少数（电话、笔记本电脑+root、家庭服务器+root、工作计算机+服务器、密码保险箱）；改变其中任何一个都是乏味的。
有多种方法可以确保用户不会选择与旧密码相关的密码；他们都不是特别好。
See Bruce Schneier's blog post on Changing Passwords.
The main reason for password expiry is to make compromised passwords expire; telling the user (or the attacker) that it'll expire doesn't change this. What it does do is tell the attacker to compromise something else before the deadline; whether this is a risk depends on whether there are such attackers (I'd expect the first thing to do would be to install a rootkit).
The security benefit is that the user is given some amount of time (e.g. a week) to think of a new password. I can come up with a half-decent password in a minute or two, provided I'm not in a rush to get work done; otherwise I'd just increment a counter on the end. Everyone does this.
My feeling is that the benefit of effectively saying "at some point in the next week, think of a new password" outweighs the potential risks, but 30 days is far too short. There are only a handful of passwords that I actually need to remember (phone, laptop+root, home server+root, work computer+server, password safe); changing any of these is tedious.
There are various ways of ensuring that users don't choose passwords related to old passwords; none of them are particularly good.
我认为，如果你需要告诉用户密码在这么多天后过期，你应该制作一个登录完成后出现的页面。
例如，如果您有一个页面是登录表单，那么之后它会转到另一个脚本，该脚本在成功登录后重定向到主页。
您可以在页面上使用
来给用户五秒钟的时间来阅读页面，而不是立即重定向。显示用户的密码还有多少天到期。但请确保该消息仅在登录后显示，否则黑客可以读取登录页面的内容以找出何时需要更改密码。
广告@m
I think that if you need to tell the user that the password expires in so many days, you should make a page that appears after the login has been completed.
For example, if you have one page that is your login form, then after that it goes to another script that redirects to the home page on successful login.
Instead of immediately redirecting, you could use
<meta http-equiv="refresh" content="5; URL=/">on the page to give the user five seconds to read the page and show how many days the user has until their password expires.But make sure the message is only shown after login, otherwise a hacker can read the contents of the login page to find out when their password needs changing.
Ad@m
我不认为告诉用户密码过期是不安全的——至少我看不出它如何真正帮助攻击者。无论如何，这是常见的做法 - 正如 adam 提到的，Windows 本身就是这样做的。
I don't think it's insecure to tell the user when their password expires - at least I cannot see how it can realistically aid an attacker. It's common practice in any case - as adam mentions, Windows itself does that.