blocks|key|773681|text|绝对不是。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|773682|重要的是，系统之外的用户不能获得有关密码的信息。如果他们能够很容易地猜测哪些密码正在使用，通过发现密码是不可用的，那么他们就可以在已知的用户名上使用这些密码，并获得一个很好的机会获得访问。|773683|另一种方法是查找某种常见的密码数据库，并防止任何用户使用它们。|773684|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

absolutely not.

It is critical that no information about passwords be available to users outside the system. If they can easy guess which passwords are in use, by discovering that a password is unavailable, then they can use those passwords on known usernames and get a good shot at gaining access.

An alternative is to find some kind of common passwords database, and prevent any user from using them.

blocks|key|1971347|text|正如你已经提到的那样，我建议大家使用“唯一”密码的缺点。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1971348|教育用户有关强密码的知识。|ordered-list-item|1971349|请用户定期更改密码。|1971350|当他们输入密码时，保持一个“密码强度”表。|1971351|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$]]|$1|E|3|F|5|D|7|M|8|@]|9|@]|A|$]]|$1|G|3|H|5|D|7|N|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|O|8|@]|9|@]|A|$]]]|J|$]]

I would suggest the follwing as you have already mentioned the disadvantage of using "unique@ passwords for all

<ol>
<li>Educate the user's about strong password.</li>
<li>Ask user's to change password regularly.</li>
<li>Keep a "Password strength" meter while they type in the password.</li>
</ol>

blocks|key|1971361|text|eeeuh|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|1971362|我可能误解了你的问题，但我希望你不要储存实际的密码？|1971363|您应该使用随机盐对密码进行散列。这样，您就无法知道一个或多个用户是否有相同的密码。|1971364|如果您的系统以任何方式允许您确定两个或多个用户是否具有相同的密码，则您正在以错误的方式存储密码。|1971365|entityMap^0|0|5|0|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@$9|O|A|P|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|Q|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|R|8|@]|D|@]|E|$]]|$1|J|3|K|5|6|7|S|8|@]|D|@]|E|$]]|$1|L|3|-4|5|6|7|T|8|@]|D|@]|E|$]]]|M|$]]

eeeuh

I might be misreading your question, but I hope you do not store the actual password?

You should hash the password with a random salt. That way, there is no way for you to ever tell if one or more users have the same password.

If your systems, in any way, allows you to determine if two or more users have the same password, you are storing the passwords the wrong way.

blocks|key|2328965|text|真的不|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2328966|只要你有盐，密码就不会以同样的方式存储。|2328967|如果要确保密码安全：|2328968|选一个好的哈希(sha256，河豚等)|ordered-list-item|2328969|使用盐类|2328970|在具有最小阈值的密码表中插入|2328971|其中很多都可以与单词列表捆绑在一起。|2328972|看看我在reddit上写的一篇文章：谈话/|offset|length|2328973|entityMap|0|LINK|mutability|MUTABLE|url|http://www.reddit.com/r/netsec/comments/ektb8/in_the_light_of_recent_gawker_breakout_lets_talk/^0|0|0|0|0|0|0|0|I|3|0|0^^$0|@$1|2|3|4|5|6|7|10|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|11|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|12|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|13|8|@]|9|@]|A|$]]|$1|I|3|J|5|H|7|14|8|@]|9|@]|A|$]]|$1|K|3|L|5|H|7|15|8|@]|9|@]|A|$]]|$1|M|3|N|5|H|7|16|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|17|8|@]|9|@$Q|18|R|19|1|1A]]|A|$]]|$1|S|3|-4|5|6|7|1B|8|@]|9|@]|A|$]]]|T|$U|$5|V|W|X|A|$Y|Z]]]]

Really don’t

As long as you have salts, the password won’t be stored the same way anyway.

If you want to ensure password security:

<ol>
<li>Pick a good hash (sha256, blowfish, etc.)</li>
<li>Use salts</li>
<li>Snap-in a password meter with a minimum threshold</li>
<li>A lot of those can be bundled with wordlists</li>
</ol>

Check out a post I made about it on reddit:
<a href="http://www.reddit.com/r/netsec/comments/ektb8/in_the_light_of_recent_gawker_breakout_lets_talk/" rel="nofollow">http://www.reddit.com/r/netsec/comments/ektb8/in_the_light_of_recent_gawker_breakout_lets_talk/</a>

blocks|key|1971407|text|如果密码管理是正确的，那么唯一应该知道密码的人就是创建密码的用户。在我的网站中，我从不以任何形式存储密码。我存储该密码的密码散列(SHA-1或某些变体)，该密码由某种惟一的“盐类”填充操作。从本质上说，如果两个人确实有独特的密码，那就无法判断。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1971408|您给出的链接上的大多数密码都是容易猜到的字典密码。很弱，很容易用暴力。所有这些都是不允许的任何系统与基本的密码检查。|1971409|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

If password management is done correctly, the only person who should know their password is the user who created it in the first place. In my web sites, I never store the password in any form. I store a cryptographic hash (SHA-1 or some variant) of that password that is manipulated with some sort of unique "salt" padding. Essentially if two people did have unique passwords, there would be no way to tell.

Most of the passwords on that link you gave are all easily guessed dictionary passwords. Very weak, and easy to brute force. They would all be unallowed by any system with rudimentary password checking.

In light of the recent <a href="http://blogs.wsj.com/digits/2010/12/13/the-top-50-gawker-media-passwords/" rel="nofollow">Gawker Media password leak</a>, I've realized that many users share the same passwords. To help encourage stronger passwords, would it be helpful if passwords are constrained to be unique among all users?

One immediate downside I could think of (besides account creation performance?) is being able to know that someone is using a given string as a password. This knowledge, combined with a list of users, could be quite dangerous.

Is there a way to mitigate that downside while retaining the alleged benefits of not allowing repeat passwords?

It's kind of like the <a href="http://blog.xkcd.com/2008/01/14/robot9000-and-xkcd-signal-attacking-noise-in-chat/" rel="nofollow">XKCD kick bot</a> where you aren't allowed to repeat short, unoriginal sentences like "yah" or "lol".

Edit^2: I thought you could unique-ify against a hash, but as someone pointed out, with varying salts, this would not have the intended effect. Good eye!

Should the password field be unique?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

根据最近的，我意识到许多用户共享相同的密码。为了鼓励更强的密码，如果密码在所有用户中都是唯一的，会有帮助吗？我能想到的一个直接的缺点(除了创建帐户的性能？)能够知道某人正在使用给定的字符串作为密码。这种知识，再加上一个用户列表，可能是相当危险的。是否有办法在保留所谓的不允许重复密码的好处的同时，减轻这一缺点？这有点像，...

问密码字段是否是唯一的？
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问密码字段是否是唯一的？EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问密码字段是否是唯一的？
EN