允许用户更改密码的模式。用户是否必须重复新密码并输入旧密码？
关于在 SO 上恢复密码有很多问题，但考虑以下两个问题之一而不是关于更改密码：
1）用户已经在系统中进行了身份验证（通过 user/pw 或通过第三方身份验证，例如 facebook/twitter）< br> 2) 用户知道他或她的旧密码。
考虑到这些出发点，我有两个不同的问题：允许用户以最少的步骤更改其密码的最佳实践是什么。
场景（用户已通过身份验证并登录系统）：
输入旧密码：_______（1：我可以摆脱这个）
输入新密码：_______
再次输入新内容：_______（2：我可以去掉这个）
1）不让用户输入旧密码可以吗？在这种情况下，我假设用户已经通过系统身份验证。让用户重新输入密码似乎是多余的。我知道这对于高安全性应用程序（例如银行）来说可能很重要，其中用户在无人看管的情况下离开会话可能会允许某人在不知道导致他们进入这种情况的密码的情况下输入新密码。
在我演示的示例中，应用程序的安全性不是很高，风险也很低。另外，由于我们允许第三方身份验证（facebook/twitter），所以理论上如果其他人在机器上并且用户有 facebook/twitter 的实时 cookie，他们就可以进入该帐户。
2）不让用户输入两次新密码可以吗？这样做有点90年代的感觉。人们现在已经习惯了密码，他们输入的密码与预期不同的 5% 的可能性似乎并不比输入两次密码所花费的时间重要。在这 5% 的情况下，最糟糕的情况是他们只需要重置密码（或者只需使用 facebook/twitter 登录并重置）。我发现现在这样做的一个网站是 Quora（尽管他们仍然执行步骤 1）。我还没有看到其他人做同样的事情。
There are lots of questions about recovering passwords on SO, but not about changing passwords considering one of the two following:
1) The user is authenticated in the system already (either through user/pw or through third part authentication e.g. facebook/twitter)
2) The user knows his or her old password.
Given these starting points, I have two distinct question as to what the best practice is for allowing a user to change his or her password in the fewest steps.
Scenario (user has already authenticated and logged into system):
Enter Old Password:_______ (1: can I get rid of this)
Enter New Password:_______
Enter New Again: _______ (2: can I get rid of this)
1) Is it ok to not have the user enter his old password? In this case I'm assuming the user is already authenticated into the system. It seems redundant to have the user re-enter the password. I understand this could be important for high security applications (e.g. banking) where a user leaving the a session unattended could allow someone to enter a new password without knowing the password that got them into this situations.
In the example I'm presenting, the application is not very high security and risk is low. Also, since we allow third part authentication (facebook/twitter) then theoretically if someone else was on the machine and the user had a live cookie for facebook/twitter, they could get into the account.
2) Is it ok to not have the user enter the new password twice. This feels a bit 90's-ish doing this. People are used to passwords now, and the 5% chance they type their password differently than they expect does not seem to outweigh the time spent typing it in twice. In that 5% scenario, the worst case is they just have to reset their password (or just login with facebook/twitter and reset it). One website that I found doing this now is Quora (though they still do step 1). I have not seen many others doing the same.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
首先，我要提醒您永远不要假设用户就是他所说的那个人，尤其是在更改允许他们访问其帐户的密钥时。这是一种非常常用的方法，始终需要密码身份验证才能编辑密码。
至于输入两次密码，这主要是在后端完成的，因此您可以比较两个密码并确保它们相同。这样做是为了确保用户确实想在键入密码时键入密码。连续两次出现相同拼写错误的可能性不大，因此，如果两个密码相同，您很可能会认为它们没有拼写错误。
就我个人而言，我宁愿每天花 10 秒钟重新输入密码，而不是经历意识到我输入了密码的麻烦，然后必须重置密码、访问我的电子邮件、重新访问网站，然后重新输入我的密码。在一天结束时，您仍然需要输入两次，第一种方法更加精简。
我永远不会允许用户编辑身份验证方法，而不首先让他们验证使用身份验证方法的能力。一些用户在离开座位时让计算机保持登录状态，这允许其他人坐下来访问私人数据，如果他们有权更改密码而无需输入当前密码，则该帐户更容易被盗用。被虐待。
First, I would caution you to never, ever, ever, ever, ever assume the user is who he says he is, especially when it comes to changing the very key that allows them access to their account. It is a very well used method to always require a password authentication to edit the password.
As for entering the password twice, that is mostly done so on the back end you can compare the two passwords and make sure that they are identical. This is done to make sure that the user has intended to type the password as it is typed. The odds of making the same typo twice in a row are not likely, and as such if the two passwords are identical you can pretty well assume that they are typo free.
Personally I would much rather take 10 seconds out of my day to retype a password, instead of having to go through the hassle of realizing that I typoed my password, then having to reset my password, visit my email, revisit the website, and then re-enter my password. At the end of the day you still have to type it twice, the first method just is so much more streamlined.
And I would never allow a user to edit an authentication method, without having them verify the ability to use an authentication method in the first place. Some users leave their computers logged in while leaving their seats, which allows others to sit down and access private data, and if they have access to changing a password without needing to enter the current password, that opens the account to an easier chance of being abused.
大约1）。我不会信任在尝试更改旧密码时不询问我的旧密码的应用程序，我更喜欢偶尔输入旧密码的麻烦，而不是有人在我不注意的情况下更改它的风险，这并不重要对我来说，如果这是我的银行帐户或只是我的杂货清单。
2) 我已经好几次需要两次输入密码来保存我的屁股了，输入密码的一个小变体很容易，而且可能非常有害，将您锁定在帐户之外。
您应该考虑到，用户不会经常更改密码，因此麻烦是有回报的，我会保留询问您最后一个密码并要求您输入新密码两次的旧公式。
About 1). I would not trust on a App that doesn't ask my old password when trying to change it, I prefeer the once in a while hassle of entering my old password than the risk that somebody changes it without me noticing, it doesn't matter to me if it's my bank account or just my grocery's list.
2) I've got my butt saved a couple of times with requiring to double type your password, it's easy to type a minor variant of your password and could be very harmfull, locking you out of your account.
You should take into account, that the users doesn't change their passwords that often, so the hassle pays off, i would keep the old formula of asking your last password and requiring you to type the new one twice.
让他们输入旧密码的一个很好的理由是合法用户起身去洗手间，而恶作剧者决定更改他们的密码。
就我个人而言，我不介意输入两次新密码。也许有些人会这样做。
您当然可以选择消除其中一个或两个步骤，并且它可能不会给您带来太多麻烦。但也许会。
IMO 消除这种用户名/密码垃圾的更好方法是执行 SO 所做的操作，并使用 OpenID 或其他替代身份验证方法，例如 X509 证书。
one good reason to make them type in their old password is the case where the legitimate user got up and went to the bathroom, and a prankster decides to change eir password.
personally I don't mind typing the new password twice. perhaps some people do.
you can certainly choose to eliminate either or both steps, and it probably won't cause you too many headaches. but then it might.
IMO a better way to eliminate this username/password garbage is to do what SO did, and use OpenID, or other alternative authentication methods, like X509 certs.
据我了解，输入旧密码的必要性是为了防止用户不小心保持登录状态并离开帐户的情况下帐户被劫持。是的，在这种情况下，劫持者（通常是某人的朋友，注意到他们在 Facebook 上保持登录状态）会做一些事情，例如发布愚蠢或冒犯性的内容，但至少，如果没有原始密码，他们无法有效锁定原始用户。
对于第二种情况，我认为要求用户再次输入密码并不太合适；对于好的密码，它们应该相对复杂，因此有点难以输入。要求第二个条目有点麻烦，但也不是太不合理（IMO）。
To my understanding, the necessity for entering the old password is to prevent account hijacking in the case where users have accidentally left themselves logged in and left the account. Yes, in those cases the hijackers (usually somebody's friend who noticed that they left themself logged in on Facebook) will do things like post silly or offensive stuff, but at the very least, without the original password, they can't effectively lock out the original user.
In the second case, I don't think it's too inappropriate to ask the users to type the password a second time; for good passwords, they should be relatively complex, and therefore a little bit hard to type. Requiring the second entry is a little bit of a hassle, but not too unreasonable (IMO).