用户账户、授权和密码管理的 12 个最佳方法 #3288
Merged
用户账户、授权和密码管理的 12 个最佳方法 #3288
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
leviding
changed the title
Closed
|
校对认领 |
|
@pot-code 好的呢 🍺 |
pot-code
reviewed
Feb 19, 2018
| @@ -6,101 +6,206 @@ | |||
| > * 校对者： | |||
|
|
|||
| # 12 best practices for user account, authorization and password management | |||
| 用户账户、授权和密码管理的12个最佳方法 | |||
|
|
||
| Account management, authorization and password management can be tricky. For many developers, account management is a dark corner that doesn't get enough attention. For product managers and customers, the resulting experience often falls short of expectations. | ||
|
|
||
| 账户管理、授权和密码管理问题可以变得很棘手。对于很多开发者来说，账户管理仍是一个暗角,并没有得到足够的重视。而对于产品管理者和客户来说，由此产生的体验往往达不到预期的效果。 |
|
|
||
| Account management, authorization and password management can be tricky. For many developers, account management is a dark corner that doesn't get enough attention. For product managers and customers, the resulting experience often falls short of expectations. | ||
|
|
||
| 账户管理、授权和密码管理问题可以变得很棘手。对于很多开发者来说，账户管理仍是一个暗角,并没有得到足够的重视。而对于产品管理者和客户来说，由此产生的体验往往达不到预期的效果。 |
There was a problem hiding this comment.
『而对于产品管理者和客户来说，由此产生的体验往往达不到预期的效果。』=>『由此产生的体验，对于产品经理和客户来说，没有达到预期的效果』
| Fortunately, [Google Cloud Platform](https://cloud.google.com/) (GCP) brings several tools to help you make good decisions around the creation, secure handling and authentication of user accounts (in this context, anyone who identifies themselves to your system — customers or internal users). Whether you're responsible for a website hosted in [Google Kubernetes Engine](https://cloud.google.com/kubernetes-engine/), an API on [Apigee](https://cloud.google.com/apigee-api-management/), an app using [Firebase](https://firebase.google.com/) or other service with authenticated users, this post will lay out the best practices to ensure you have a safe, scalable, usable account authentication system. | ||
|
|
||
| 幸运的是，[Google Cloud Platform](https://cloud.google.com/) (GCP) 上有几个工具，可以帮助你在围绕用户账户（在这里指那些在你的系统中认证的客户和内部用户）进行的创新、安全处理和授权方面做出好的决定。 |
| My most important rule for account management is to safely store sensitive user information, including their password. You must treat this data as sacred and handle it appropriately. | ||
|
|
||
| 账户管理最重要的准则是安全地存储敏感的用户信息，包括他们的密码。你必须神圣地对待并恰当地处理这些数据。 |
| It's surprisingly common in legacy systems or any platform that provides email accounts not to allow users to change their username. There are [very good reasons](https://www.computerworld.com/article/2838283/facebook-yahoo-prevent-use-of-recycled-email-addresses-to-hijack-accounts.html) not to automatically release usernames for reuse, but long-term users of your system will eventually come up with a good reason to use a different username and they likely won't want to create a new account. | ||
|
|
||
| 令人普遍感到惊讶的是，原有系统或是其他提供邮箱账户的平台都不允许用户修改他们的用户名。我们有很多 [非常好的理由](https://www.computerworld.com/article/2838283/facebook-yahoo-prevent-use-of-recycled-email-addresses-to-hijack-accounts.html) 不去自动释放用户名以供重新使用，但是你系统的长期用户终将会想要一个新的用户名，且无须创建一个新的账户。 |
There was a problem hiding this comment.
『我们有很多 非常好的理由 不去自动释放用户名以供重新使用，但是你系统的长期用户终将会想要一个新的用户名，且无须创建一个新的账户。』=>『当然，有很多正当理由不允许重用已经自动回收的用户名，但是你的长期用户终有一天一拍脑袋想要换个新的用户名，最好能不用另外新建一个账户』
| Consider the practical impact on a user of having their account stolen when choosing from [2-Step Verification](https://www.google.com/landing/2step/) (also known as 2-factor authorization or just 2FA) methods. SMS 2FA auth has been [deprecated by NIST](https://pages.nist.gov/800-63-3/sp800-63b.html) due to multiple weaknesses, however, it may be the most secure option your users will accept for what they consider a trivial service. Offer the most secure 2FA auth you reasonably can. Enabling third-party identity providers and piggybacking on their 2FA is a simple means to boost your security without great expense or effort. | ||
|
|
||
|
|
||
| 要考虑当用户选择 [两步验证](https://www.google.com/landing/2step/) (也称两因素验证或只是 2FA)方法而账户被盗后的实际影响。由于有许多缺陷,SMS 2FA 认证 [被 NIST 反对](https://pages.nist.gov/800-63-3/sp800-63b.html),然而,它或许是你的用户考虑到这是一项微不足道的服务时会接受的最安全的选择了。请尽可能提供你能提供的最安全的 2FA 认证。支持第三方身份验证和在他们的 2FA 上面打包是个十分简单的方法,使你能够不花费太多力气就能提高你的安全度。 |
|
|
||
| Your users don't care and may not even remember the exact case of their username. Usernames should be fully case-insensitive. It's trivial to store usernames and email addresses in all lowercase and transform any input to lowercase before comparing. | ||
|
|
||
|
|
||
| 你的用户不会关心或者甚至可能并不记得他们确切的用户名。用户名应该完全不区分大小写。与输入时将所有字符转换为小写相比,存储时将用户名和邮件地址全部保存为小写显得十分微不足道。 |
|
|
||
|
|
||
|
|
||
| 智能手机的使用代表用户设备所占的比重不断增加。他们大多数提供纯文本字段的自动更正和自动资本化功能。 |
| If you're using a service like Firebase Auth, a lot of security concerns are handled for you automatically. However, your service will always need to be engineered properly to prevent abuse. Core considerations include implementing a [password reset](https://firebase.google.com/docs/auth/web/manage-users#send_a_password_reset_email) instead of password retrieval, detailed account activity logging, rate limiting login attempts, locking out accounts after too many unsuccessful login attempts and requiring 2-factor authentication for unrecognized devices or accounts that have been idle for extended periods. There are many more aspects to a secure authentication system, so please see the section below for links to more information. | ||
|
|
||
|
|
||
| 如果你在使用一个像 Firebase Auth 一样的设备,大量的安全隐患都会自动帮你处理。然而,你的设备总是需要正确地设计以防滥用。核心的问题包括实现 [密码重置](https://firebase.google.com/docs/auth/web/manage-users#send_a_password_reset_email)而不是密码检索,详细账户活动日志,限制登录尝试率,多次登录尝试不成功后锁定账户以及需双因素识别已长时间限制的未知设备或账户。安全认证系统还有很多方面,所以请查看下方的链接获取更多信息。 |
|
另外，译文不用包含英文原文 |
|
校对认领 |
|
@ryouaki 妥妥哒 🍻 |
ryouaki
reviewed
Feb 24, 2018
|
|
||
| Account management, authorization and password management can be tricky. For many developers, account management is a dark corner that doesn't get enough attention. For product managers and customers, the resulting experience often falls short of expectations. | ||
|
|
||
| 账户管理、授权和密码管理问题可以变得很棘手。对于很多开发者来说，账户管理仍是一个暗角,并没有得到足够的重视。而对于产品管理者和客户来说，由此产生的体验往往达不到预期的效果。 |
| My most important rule for account management is to safely store sensitive user information, including their password. You must treat this data as sacred and handle it appropriately. | ||
|
|
||
| 账户管理最重要的准则是安全地存储敏感的用户信息，包括他们的密码。你必须神圣地对待并恰当地处理这些数据。 |
| Do not store plaintext passwords under any circumstances. Your service should instead store a cryptographically strong hash of the password that cannot be reversed — created with, for example, PBKDF2, SHA3, Scrypt, or Bcrypt. The hash should be [salted](https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet#Use_a_cryptographically_strong_credential-specific_salt) with a value unique to that specific login credential. Do not use deprecated hashing technologies such as MD5, SHA1 and under no circumstances should you use reversible encryption or [try to invent your own hashing algorithm](https://www.schneier.com/blog/archives/2011/04/schneiers_law.html). | ||
|
|
||
| 不要在任何情况下存储明文密码。相反，你的服务应该存储经过加密且不可逆转的密码的强哈希值——比如，可以用 PBKDF2, SHA3, Scrypt,或 Bcrypt 这类值创建。这些哈希值应该用相应的登录证书所特有的数值来 [设置](https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet#Use_a_cryptographically_strong_credential-specific_salt)。不要用已经弃用的哈希技术比如 MDS 和 SHA1，并且，任何情况下都不要使用可逆转的编码或者 [试着发明自己的哈希算法](https://www.schneier.com/blog/archives/2011/04/schneiers_law.html)。 |
| You should design your system assuming it will be compromised eventually. Ask yourself "If my database were exfiltrated today, would my users' safety and security be in peril on my service or other services they use? What can we do to mitigate the potential for damage in the event of a leak?" | ||
|
|
||
| 在设计系统时，应该假设你的系统会受到攻击，并以此为前提设计系统。设计系统时要考虑“如果我的数据库今天受损，用户在我或者其他服务上的安全和保障会有危险吗？我们怎样做才能减小事件中的潜在损失。” |
There was a problem hiding this comment.
原文 提到的 是 数据库系统收到攻击，包括可能的后果 有 数据丢失，泄漏，数据系统销毁。
因此 翻译成 最大程度降低信息泄漏造成的损失是有失原意的。
建议保留原来翻译。
| Another point: If you could possibly produce a user's password in plaintext at any time outside of immediately after them providing it to you, there's a problem with your implementation. | ||
|
|
||
| 另外一点：如果你随时都能将用户提供给你的密码生成明文密码，那么你的系统就是有问题的。 |
There was a problem hiding this comment.
这里的意思 应该是 -》用户在你的系统输入密码以后，你的系统将密码加密，然后你可以在任何时候将加密的密码转换成明文密码，那么你的处理就是有问题的。
所以单纯的说 根据用户提供的密码生成 明文密码 是 不 严谨的。用户输入的本身就是明文密码。
| Third-party identity providers enable you to rely on a trusted external service to authenticate a user's identity. Google, Facebook and Twitter are commonly used providers. | ||
|
|
||
| 使用第三方提供身份验证，你就可以依赖一个可靠地外部设备来对用户的身份进行验证。Google，Facebook 和 Twitter 都是常用的身份验证提供者。 |
| Third-party identity providers enable you to rely on a trusted external service to authenticate a user's identity. Google, Facebook and Twitter are commonly used providers. | ||
|
|
||
| 使用第三方提供身份验证，你就可以依赖一个可靠地外部设备来对用户的身份进行验证。Google，Facebook 和 Twitter 都是常用的身份验证提供者。 |
| Your users are not an email address. They're not a phone number. They're not the unique ID provided by an OAUTH response. Your users are the culmination of their unique, personalized data and experience within your service. A well designed user management system has low coupling and high cohesion between different parts of a user's profile. | ||
|
|
||
| 你的用户并不是一个邮件地址，也不是一个电话号码，更不是由一个 OAUTH 回复提供的特有 ID。他们是你的服务中，所有与之相关的独特、个性化的数据和经验呈现的最终结果。一个设计优良的用户管理系统在不同用户的个人简介之间低耦合且高内聚。 |
There was a problem hiding this comment.
这个 我觉得 翻译的没毛病，而且 review 建议 只是换了一个 表述方式。跟原来也没啥区别。不过我还是尊重 原译者，保持原文描述方式。
| An often overlooked aspect of security and authentication is [session length](https://firebase.google.com/docs/auth/web/auth-state-persistence). Google puts a lot of effort into [ensuring users are who they say they are](https://support.google.com/accounts/answer/7162782?co=GENIE.Platform%3DAndroid&hl=en) and will double-check based on certain events or behaviors. Users can take steps to [increase their security even further](https://support.google.com/accounts/answer/7519408?hl=en&ref_topic=7189123). | ||
|
|
||
| 安全和认证中一个经常被忽视的方面是 [会话长度](https://firebase.google.com/docs/auth/web/auth-state-persistence)。Google 在 [确保用户是他们所说的人](https://support.google.com/accounts/answer/7162782?co=GENIE.Platform%3DAndroid&hl=en) 方面做了很多努力，并将基于某些事件或行为进行二次确认。用户可以采取措施 [进一步提高自己的安全度](https://support.google.com/accounts/answer/7519408?hl=en&ref_topic=7189123)。 |
| In some circumstances, you may be [legally required to comply](http://ec.europa.eu/justice/data-protection/files/factsheets/factsheet_data_protection_en.pdf) with a user's request to delete their data in a timely manner. You also greatly increase your exposure in the event of a data breach where the data from "closed" accounts is leaked. | ||
|
|
||
| 在某些情况下，你可能会 [被合法地要求遵照](http://ec.europa.eu/justice/data-protection/files/factsheets/factsheet_data_protection_en.pdf) 用户的需求及时的删掉他们的数据。同样，当“已关闭”账户的数据泄漏时，你也会极大的增加你的曝光率。 |
|
@ryouaki 兄弟手下留情，我想我应该和你没啥私人恩怨？不必要翻译，甚至校对都跑来怼我？校对只是个人意见，或者说就是个人观点。如果完全错了，那我虚心接受，但是觉得自己是对的，别人的都有问题，那...是吧 |
|
辛苦校对了， @Wangalan30 来修改啦 |
|
@Wangalan30 快来修改啦 |
|
@Wangalan30 还有两点问题
可以再阅读下 Repo WIKI 的译者教程 |
leviding
previously approved these changes
Mar 5, 2018
leviding
approved these changes
Mar 5, 2018
|
@Wangalan30 已经 merge 啦~ 快快麻溜发布到掘金然后给我发下链接，方便及时添加积分哟。 掘金翻译计划有自己的知乎专栏，你也可以投稿哈，推荐使用一个好用的插件。 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
译文翻译完成，resolve #3236