是否有安全的客户端密码加密之类的东西？
客户端对用户密码进行加密->>
我已经在这个网站上搜索了我的问题的答案，但我的问题没有什么具体内容，我想知道是否有人可以提供一些线索。
*问题*** 如果我要使用用户在登录表单上输入的密码作为加密文件的密码来在客户端加密用户密码，然后将文件发送到服务器端，是否可能（并且安全）。解密该文件的唯一方法是使用管理密码（第二个密码），只有服务器端知道该密码，这意味着即使用户也无法解密它。
举个例子 - 假设我使用用户在 winrar 中输入的表单密码来加密密码。 winrar 文件被发送到服务器。现在，为了让服务器解密并获取密码，它需要使用其唯一的服务器端解密密码。
或者也许，不是使用用户输入的密码来解密 - 让 Javascript 生成一次 random() 密码？
我在网络开发方面并不那么先进，只有逻辑可以走，希望有人能给我一些关于这种方法的缺陷的指示？
Client side encrption of user password->>
I have searched for an answer to my question on this site but there is nothing specific to my question and was wondering if someone could shed some ligth.
*THE QUESTION***
Would it be possible (and secure) if I was to encript a user password on the client side by using the user entered password on the login form as the passsword for the encrpted file, then send file to server side. The only way that this file can be decypted would be with an administrative password (second password) which only the server side knows meaning that not even the user is able to decypt it.
As an example - say i encrpt a password using the user entered form password in winrar. the winrar file gets sent to the server. Now for the server to decrpt and get the password it needs to use its unique server side decypting password.
Or perhaps, instead of using the user entered password to decrypt - get say Javascript to produce a once of random() password?
I'm not that advanced in web development and only have loggic to go off and hope that somone who is can give me some pointers on the flaws of this approach?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
除非您使用 HTTPS 和 SSL，否则这本质上是不安全的，因为攻击者可以先用恶意 Javascript 替换您的 Javascript，将用户的密码发送到邪恶的服务器，然后正常执行其他操作。
Unless you use HTTPS and SSL, this is inherently insecure, since an attacker can pre-emptively replace your Javascript with malicious Javascript that sends the user's password to an evil server, then does everything else normally.
使用一个密码进行加密并使用不同的密码进行解密称为公钥加密术 (PKI)
但如果您确实使用它，则无需将加密密钥作为用于加密数据的“公共”密钥发送到服务器，只有“私有”密钥可以解密它。
在 Javascript 中实现 PKI 将是一个大项目。
您可能想重新表述您的问题，这有点令人困惑。
Using one password to encrypt and a different password to decrypt is called Public-key Cryptography (PKI)
But if you do use it, then there is no need to send the encryption key to the server as a "public" key used to encrypt the data and only a "private" key can decrypt it.
Implementing PKI in Javascript would be a big project.
You might want to re-phrase your question, it is a bit confusing.
您可以将密码存储为单向哈希（即 MD5）。然后在客户端，MD5 输入的密码并将其发送到数据库。
You could store your password as a one way hash (ie MD5). Then on the client side, MD5 the password input and send that to the db..
请参阅 https://docs.djangoproject.com/en/dev/topics/signing/< /a>
See https://docs.djangoproject.com/en/dev/topics/signing/