如何在 iPhone 应用程序中实现密码恢复？
我想在我正在开发的 iPhone 应用程序中添加简单的密码保护。我可能会使用 crypt() 将密码存储在我的数据库中，该数据库采用 CoreData / sqlite 格式。
我想我对如何创建和存储密码有很好的了解，但为了防止用户忘记密码，我想添加密码恢复功能，
这是我在 iOS 中遇到的问题。我希望一切都在本地，所以我想不出使用链接重置密码的方法。
我曾考虑过通过电子邮件发送密码，但在 iOS 中，如果持有设备的人无法看到电子邮件内容，则无法发送电子邮件。
我能想到的唯一方法是拥有一两个“备份密码”，这基本上是用户选择的问题的答案（或者甚至可能只是将提醒问题与密码一起存储）。
尽管我的应用程序中受保护的数据并不那么重要，但这些都不是真正那么安全，所以我并不是在寻找最强大的解决方案（只是一个不错的解决方案，实现起来不太难，对于用户来说也不太不方便）用户，并且对于黑客来说破解并不难）。
非常感谢您的建议。
谢谢， 罗恩
I would like to add simple password protection in an iPhone App that I am working on. I will probably use crypt() to store the password in my database which in in CoreData / sqlite format.
I think I have a pretty good understanding of how to create and store the password, but in case the user forgets their password, I would like to add a password recovery ability
This is the part that I'm struggling with in iOS. I want everything to be local, so I can't think of a way to use a link to reset a password.
I had thought about emailing the password, but in iOS there is no way to send emails without the person holding the device seeing the contents of the email.
The only way that I can think of is to have one or two "backup passwords" which is basically the answer to a question of the user's choice (or maybe even just storing a reminder question along with the password).
Neither of these are really that secure, although the data being protected in my app is not that critical, so I'm not looking for the most robust solution (just a decent solution that is not too hard to implement, not too inconvenient for the user, and not too hard for a hacker to break).
Suggestions are greatly appreciated.
Thanks,
Ron
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您可以使用他们最初创建帐户时设置的条件（例如母亲的婚前姓名、姓氏 4 等）提示重置密码，而不是恢复密码。这样，您就无需担心解密密码或将其发送给用户。一旦他们正确回答了足够多的安全问题，系统就会提示他们重置密码。您可以在本地加密存储此数据。您永远不需要向用户发送密码。
Instead of recovering a password, you can prompt to reset a password using criteria that is set up when they initially create their account -- such as mothers maiden name, last-4, etc. This way, you don't need to worry about decrypting a password or sending it to the user. Once they answer enough security questions correctly, they are prompted to reset their password. You can store this data encrypted locally. You'll never need to send a password to the user.
最简单的方法可能是使“密码保护”可选并显示警告（“如果您忘记密码，您的数据可能无法恢复！”）。
它不会那么安全：数据可能在手机备份中显示为未加密，除非您自己加密。结果是，坚定的用户可以向您寻求帮助，您可以为他们编写一个工具来挖掘未加密的备份并重置密码。
避免使用内置的
crypt()，它可能基于 DES，并且限制为 8 个 ASCII 字符。将明文密码存储在钥匙串中并不是一个太糟糕的选择。The easiest way is probably to make "password protection" optional and display a warning ("if you forget your password, your data may be irrecoverable!").
It's not going to be that secure: The data is probably going to appear unencrypted in a phone backup, unless you encrypt it yourself. The upshot is that determined users can ask you for help, and you can write them a tool that digs through the unencrypted backup and resets the password.
Avoid the built-in
crypt(), which is probably DES-based and limited to 8 ASCII characters. Storing the plaintext password in the keychain is not too terrible an option.