English 中文(简体)
无密码的登录系统安全
原标题:Securing a login system without passwords

我正在开发一个公司的移动应用程序。 公司里每个人都有一个@corporate. com 电子邮件地址。 应用程序本身是保密的, 只能安装在员工设备上。 此应用程序与外部服务器通讯, 以存储和检索数据 。

最理想的是,我希望通过提供他们的电子邮件地址,在没有密码的情况下,让人们登录到应用程序中。 以下是我目前的想法:

  1. A new user opens the app for the first time on a certain device and puts in their email address. The email address is sent to the server, along with a static token embedded in the application (which is the same for all instances of the application).
  2. The server verifies the token and the fact that the email address is @company.com. It responds with a new token/key for use only with that user and device, which the client stores in plain text locally. That key is effectively the user s password. It is hashed, stored in the server database, and marked as disabled.
  3. There are two possibilities at this point:
    1. The server sends an email to that address confirming that they want to log in on a new device. The email contains a link which, when clicked, marks the key as enabled. There would need to be rate-limiting on new device requests so people can t get spammed if someone discovers the token embedded in the app.
    2. An administrator specifically approves new device requests.
  4. Every subsequent client request to the server must include the key.

假设所有通信都经过了SSL,这听起来像安全战略吗?是否有更安全或更简单的方法?

此外, 生成将存储客户端的标记的最佳方式是什么? 因为我希望用户在第一次使用该应用程序时只将电子邮件地址放入他们的电子邮件地址, 我相信这个标记永远不会改变 。 这是我目前基于 Drupal s drupal_get_token () 的算法( PHP) :

// Usage: get_token($email) or get_token($client_token)
function get_token($value =   ) {
  $salt = hash( sha256 ,  Some static, predefined phrase );
  $hmac = base64_encode(hash_hmac( sha256 , $email, $salt, TRUE));
  return $hmac;
}

正如你所看到的,它并不能防止平行攻击(例如,如果有人发现预先定义的短语和算法,并且他们可以进入数据库,他们可以产生杂交,并与数据库中储存的术语进行比较),但因为原始关键值已经很长了,我不认为这将比正常密码有效。 此外,我不确定有什么办法可以制造一种动态的盐,攻击者如果能够进入数据库(或者说,如果在那个时候,如果这甚至很重要,因为进入数据库会暴露我们试图保密的数据),那么攻击者就已经无法进入数据库(或者说,如果在那个时候,如果这样做很重要,因为进入数据库会暴露出我们试图保密的数据 ) 。

最佳回答

经过一些研究和更多的思考后,我认为,这个问题的答案在于当地储存的脆弱程度。由于在这种情况下可以安全地假定只有公司雇员才会使用该应用程序,因此即使代码中存在问题,也存在恶意代码运行的风险很小。因此,主要的风险在于利用OS系统当地储存实施中的安全洞阅读磁盘上本地的私人密钥的其他应用。由于软件的存在不应为公司以外的任何人所知,因此这一信息不太可能直接成为目标。因此我认为这对公司来说是一个可以接受的过程。

不过,在一般情况下,任何考虑采用类似模式的人都应该意识到基本上在本地将密码储存在纯文本中的风险。 (这与在用户头上储存密码,或者同样可能在其机器上其他地方的密码文件中储存普通文本;这是你更安全的电话。 )

问题回答

暂无回答




相关问题
Signed executables under Linux

For security reasons, it is desirable to check the integrity of code before execution, avoiding tampered software by an attacker. So, my question is How to sign executable code and run only trusted ...

MALICIOUS_CODE EI_EXPOSE_REP Medium

I run findbugs against all of my code and only tackle the top stuff. I finally got the top stuff resolved and now am looking at the details. I have a simple entity, say a user: public class User ...

XSS on jsbin.com

Anyone know if jsbin.com implements any protection for XSS or other javascript attacks? I see jsbin links used fairly regularly on sites like this one and I can t find any indication from the site ...

Make md5 strong

Im making a website that will intergrate with game that only support md5 hashing metod (atm). Which ofc is not especially safe anymore. But how could i make it stronger? Should I just generate long ...

Why running a service as Local System is bad on windows?

I am trying to find out the difference between difference service account types. I tumbled upon this question. The answer was because it has powerful access to local resources, and Network Service ...

Brute-force/DoS prevention in PHP [closed]

I am trying to write a script to prevent brute-force login attempts in a website I m building. The logic goes something like this: User sends login information. Check if username and password is ...

热门标签