验证不安全密码更改的逻辑
我是一支单人乐队，必须解决某人之前在日志中创建的问题。我有一个客户端站点，其密码存储不安全（纯文本）。我想解决这个问题，但我只是想发布该过程，以确保我在转换为哈希密码（最有可能是 md5）方面处于正确的轨道上。
这是我相信我可以解决这个问题的步骤。
- 更改表以允许更大的加密密码。
- 将盐、以前的密码和上次更改密码的日期添加到表中。
- 重置所有密码，存储所有旧密码。不确定存储旧密码时是否使用纯文本或 md5。
强制用户更改密码。这个过程我仍然有待评判。
我认为我允许他们登录、验证用户、检查密码是否为 32 个字符或更少。
如果少于，请检查过去的密码是否匹配。
如果过去的密码匹配，则将带有临时令牌的电子邮件发送到页面以更改密码。
这听起来合理吗？我担心的是他们被迫更改密码。另一种选择是在他们尝试登录时向他们发送令牌以更改密码。
提前致谢！
I am a one man band, and have to fix a problem that someone created a log time ago. I have a client site that has passwords stored insecurely (plain text). I want to remedy this, but I just wanted to post up the process to make sure I am on the right track with converting to a hashed password (md5 most likely).
Here is my steps that I can believe I can tackle this problem.
- Alter table to allow for larger encrypted password.
- Add salt, previous password, and date last changed password to table.
- Reset all passwords, storing all old passwords. Not sure whether to use plain text or md5 when storing old passwords.
Force users to change password. This process I am still out to jury on.
I would think I allow them to log in, verifying user, checking to see if the password is 32 characters or less.
If less, check past password for match.
If past password is a match, send out email with temporary token to a page to change password.
Does this sound reasonable processes? The part I am worried about is when they are forced to change their password. The other option is to just send them the token to change their password when they try to log in.
Thanks in advance!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我认为你应该区分两个问题：
1. 使用单向加密对密码进行加密
2.让客户每180天左右更改一次密码
关于#2：要求用户每隔一段时间更改一次密码是完全可以接受的，但你不应该将其设置得短于180天，因为这会变得非常烦人。 。
I think that you should separate between two issues:
1. encrypting the passwords using one-way encryption
2. making the clients change their password every 180 days or so
About #2: it's totally acceptable to ask users to change their passwords every period of time, but you shouldn't make it shorter than 180 days as it becomes very annoying...