blocks|key|617062|text|简单地说，当你登录到我帐户中更安全的地方时，你需要重新输入你的密码，而不是使用记忆-我的功能，所以如果有人上了电脑，他们所能做的就是从正常的会话中访问电子邮件。雅虎也是这样做的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|617063|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Simply so when you login to more secure areas of my account, you need to reenter your password instead of use the remember-me function, so if someone gets on the computer, all they can do is access email from a normal session. Yahoo does this also.

blocks|key|1293522|text|不确定康卡斯特是否在做同样的事情，但我知道我最近使用的许多银行网站开始做以下工作：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1293523|creation.|1293524|Display+|unordered-list-item|1293525|提示您输入用户名|1293526|，查找您在帐户|1293527|中指定的图像和字符串--该图像%2B字符串以及密码框.|1293528|1293529|声明的目标是，如果用户注意到图像和字符串与创建帐户时选择的不匹配，那么您就会产生怀疑，并且不输入您的密码。|1293530|这里的好处是什么？我也没有看到任何东西，因为攻击者的脚本可以从真实的登录页面中查找图像和字符串。也许这会让愚蠢的人觉得更安全。|1293531|entityMap^0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|T|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|U|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|V|8|@]|9|@]|A|$]]|$1|G|3|H|5|F|7|W|8|@]|9|@]|A|$]]|$1|I|3|J|5|F|7|X|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|Y|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]|$1|N|3|O|5|6|7|10|8|@]|9|@]|A|$]]|$1|P|3|Q|5|6|7|11|8|@]|9|@]|A|$]]|$1|R|3|-4|5|6|7|12|8|@]|9|@]|A|$]]]|S|$]]

Not sure if Comcast is doing the same thing, but I know a lot of bank websites I use lately started doing the following:

<ul>
<li>Prompt you for your username</li>
<li>Look up an image and a string that you specified at your account creation.</li>
<li>Display that image + string along with the password box.</li>
</ul>

The stated goal is so that, if you as a user notice that the image and string don't match what you picked when you created the account, you get suspicious and don't enter your password.

What is the benefit here? I don't see any either, as an attacker's script can just look up the image and string from the real login page. Maybe it makes dumb people feel more safe.

blocks|key|1326638|text|奇怪的是，在密码页面上，他们需要你的电子邮件和密码，而不是用户名。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1326639|用户名不是秘密，因为你可能在你的邮件地址中使用它.|1326640|他们仍然允许你“留在这里”..。|1326641|所以实际上，我不认为有真正的安全利益|1326642|你可以直接到第二个登录页面如果你书签它.|1326643|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|M|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|N|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|O|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|P|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|K|$]]

It is strange, on the password page they require your email and password, not the user name.

The user name is not a secret, as you use it in your mail address probably.... 

They still allow you to "stay signed in" ... 

So Actually, I don't think there is a real security benefit

You can get directly to the 2nd login page if you bookmark it....

blocks|key|1293577|text|我的猜测是，他们正在获取特定的钓鱼/密钥记录软件，该软件“用于”在同一页面上查找所有登录信息。这使得一些恶意软件的工作变得更加困难。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1293578|如果您使用许多浏览器的“自动填写我的表单”功能，这也会将登录信息分离为浏览器数据存储中的两个单独的条目，这同样会使任何试图利用此功能的软件变得更加困难。|1293579|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

My guess would be that they are targetting specific phishing/keylogging software which is "used to" finding all the login information on the same page. It's making the job of some malicious software a little harder.

If you use the "automatically fill in my forms" feature of many browsers, this will also separate the login information into two separate entries in the browser's data store, again making things just a little harder for any software which might try to exploit this feature.

Comcast has changed their login process so it happens in two steps. Instead of two input boxes for username and password, you submit your username first. Then on a second page you enter your password.

<a href="https://www.comcast.com/Customers/CustomerCentral.cspx" rel="nofollow noreferrer">https://www.comcast.com/Customers/CustomerCentral.cspx</a>

<blockquote>
 Due to some recent security
 improvements, we now require you to
 enter your user name and password in
 two separate steps.
</blockquote>

What could the security improvement possibly be in this system? If anything it seems less secure since you can confirm the existence of a username independently from it's password. 

Any ideas on what they're accomplishing here?

Comcast's two step login

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

Comcast已经更改了他们的登录过程，因此可以分两个步骤进行。而不是两个输入框的用户名和密码，你首先提交你的用户名。然后在第二页输入密码。由于最近的一些安全改进，我们现在要求您在两个单独的步骤中输入用户名和密码。在这个系统中可能会有什么安全改进呢？如果有的话，它似乎不太安全，因为您可以确认用户名的存在，独立于它的密码...

问康卡斯特的两步登录
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问康卡斯特的两步登录EN