June 2021
Intermediate to advanced
290 pages
9h 21m
Chinese
Content preview from Node与Express开发（第2版）
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
安全
｜
203
18.3.2
使用密码认证的问题
使用密码认证的问题在于，要求用户凭空想出一个密码，而每个安全系统的强度都会取决
于密码设置中最弱的一环。众所周知，人类很难想出安全的密码。
2018
年的一个安全漏洞
分析显示，使用最多的密码是“
123456
”
，其次是“
password
”。即使是在安全意识深受重
视的
2018
年
，人们还是在选择极其糟糕的密码。如果要求某种密码格式，比如说，至少
有一个大写字母、一个数字和一个标点符号，人们就会使用“
Password1!
”这样的密码。
即使系统对照着一个常用密码清单做核查，也无法避免这个问题。就算人们不得不使用高
质量的密码，也会把这些密码写进文本文件里，未经加密就存放在计算机中，或者通过电
子邮件发送给别人。
总之，作为应用的设计者，对于这个问题你没有太多可以做的。不过，从督促人们使用更
安全的密码的角度，你还是可以采取一些措施的。一是依靠一个第三方的认证，由第三
方的认证来处理这个问题。二是让登录系统更适应一些密码管理服务，比如
1Password
、
Bitwarden
和
LastPass
。
18.3.3
第三方认证
第三方认证得益于这样一个现实：在当今的互联网上，几乎每个人会拥有至少一个主要服
务的账号，这些主要服务包括谷歌、
Facebook
、
T
witter
或
LinkedIn
。所有这些服务都提供
一个机制，让你得以通过它们来认证并识别用户。
第三方认证常常被称作
联合认证
或
委托认证
，这些术语很大程度上可以互
换，而联合认证通常跟“安全断言标记语言”（
SAML
）和
OpenID ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.