将未加密的密码存储到 HTML5 客户端数据库中是否安全？
我假设答案是在客户端的 WEBSQL 数据库中存储未加密的密码并不安全，但我想我还是会问，我问的原因是我正在尝试将 dropbox 上传工具添加到Web 应用程序，但我需要纯文本的密码才能访问用户的保管箱帐户，我当然可以想出一些 foobar 方法来对客户端密码进行哈希处理，并在需要时对它们进行取消哈希处理，但是如果我能够对密码进行取消哈希处理他们，任何人都可以这样做，如果是这种情况，有人有解决办法吗？
I am assuming the answer is that storing a password in a WEBSQL database on the client side, unencrypted is not safe, but i thought i would ask anyway, the reason I am asking, is I am trying to add a dropbox uploading tool to a web app, but i need the password in plain text in order to access the user's dropbox account, i surely could come up with some foobar way to hash the passwords client side, and unhash them when needed, but if I will be able to unhash them, anyone will be able to do so as well, does anyone have a work around if this is the case?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
不存在 100% 安全的事情。安全的目标是足够安全。您确定风险是什么，以及您愿意经历并找到最佳平衡点的痛苦程度。
如果您必须从密码中获取纯文本，您别无选择，只能使用加密而不是散列。当然，您必须在某个地方拥有密钥，无论用户输入还是存储在某个地方，因此密钥很容易受到攻击。
由于这是在客户端计算机上，因此可能容易受到网络钓鱼攻击、社会工程攻击、特洛伊木马/键盘记录器/病毒攻击、物理安全风险等。
存储明文不是一个好主意，但除此之外，您还必须决定什么用户将遭受的痛苦程度。
如果成本值得的话，PKI 代币是一个不错的选择。否则大多数语言都有许多可以有效使用的加密算法。
There is no such thing as 100% secure or safe. The goal of security is to be safe enough. You determine what is the risk, and what is the level of pain you are willing to go through and find the sweet spot.
If you have to get a plain text back from a cypher you have no choice but to use encryption not hashing. Of course you have to have the key somewhere, whether user entered or stored somewhere so the key is vulnerable.
Since this is on a client computer, it may be vulnerable to phishing attacks, social engineering attacks, trojan/keylogger/virus attacks, physical security risks, etc.
storing clear text is a bad idea, but other than that you have to decide what level of pain the users will suffer through.
PKI tokens are a good option if the cost is worth it. otherwise most languages have many various encryption algorithms that can be used effectively.
不，存储明文密码并不安全。
假设您的用户使用密码登录您的网络应用程序，为什么不使用该密码来加密他们的（加盐的）Dropbox 密码？从安全角度来看，这仍然不太令人满意，但总比没有好。
在同一段落中使用“foobar”和“dropbox”这两个词是一个明确的信号，表明您正在为本地解决方案带来麻烦。您要求您的用户信任您保管箱数据的安全性，这意味着您要承担可怕的大量责任。您还要求您的用户违反安全的基本法则之一：永远不要将您的安全信任给第三方。
我能提供的最佳建议是将所有与安全相关的任务委托给专家，并让另一位专家审核该代码。
No, it's not safe to store plaintext passwords, period.
Assuming your users log into your web app with a password, why not use that password to encrypt their (salted) dropbox password? That's still less than satisfactory from a security standpoint, but it's better than nothing.
Using the words "foobar" and "dropbox" in the same paragraph is a clear signal that you're asking for trouble with a home-grown solution. You're asking your users to trust you with the security of their dropbox data, which means you're accepting an awful lot of liability. You're also asking your users to violate one of the fundamental laws of security: Never trust your security to a third party.
The best advice I can offer is to delegate all security-related tasks to an expert, and have that code audited by another expert.