Ngabe i-TOTP kuleyo ndlela yekhompyutha eyodwa iyisici sesibili ngempela?
Umkhiqizi wamakhodi kukhompyutha ye-VPN iyisici sokuba nakho esingaphakathi komngcele wokuhlaselwa ofanayo. Landela imbewu nesikhathi sokuqala.
Ngena kuklayenti ye-VPN ecela iphasiwedi bese icela ikhodi yamadijithi ayisithupha, futhi izicelo ezimbili zibonakala njengezithiyo ezimbili ezizimele. Uma kubalwa ngohlobo lwesici, zinjalo: iphasiwedi yinto oyaziyo, ikhodi yinto onayo. Uma kubalwa ngalokho okuvezwa ikhompyutha eyodwa ehlaselekile, zingase ziwele emngceleni owodwa, ngoba into onayo iyifayela elikuleso mshini odinga kuwo. Umehluko phakathi kwalezi zibalo ezimbili uyisihloko salolu hlolo.
Landela ukungena okukodwa kusuka enkambeni yephasiwedi kuya ebhokisini lekhodi
Bheka ukulandelana, hhayi amalebula. Iklayenti lithumela iphasiwedi, iseva liphendula ngokuthi kudingeka ubufakazi besibili, futhi iklayenti livula inkambo yamadijithi ayisithupha noma ayisishiyagalombili. Ngemuva kwaleyo nkambo kukhona uhlelo lokukhiqiza olugcina imfihlo eyabiwe kanye newashi. Lubala inani lisuka emfihlweni nasesigabeni sesikhathi samanje, futhi iseva libala kabusha lelo nani elifanayo lisuka ekhophini yalo yemfihlo.
Izinhlangothi zombili zigcina impahla efanayo yokhiye. Lokho kulingana iyingxenye abantu abayigeji lapho bechaza ikhodi njengemfihlo: umhlinzeki angakhiqiza namakhodi akho, yingakho imbewu ibaluleke ngaphezu kwanoma yikuphi okukhiphayo okukodwa. Ikhodi evuzayo iyinani lesikhathi esisodwa; imbewu eyikhiqizile iyisimo sokuqinisekisa esihlala njalo esiqhubeka nokukhiqiza amanani asemthethweni kuze kube yilapho ishintshwa.
Ukwenziwa kusebenze ingxenye yesibili yokugeleza. Umkhiqizi ovuleka ngekhodi yedivayisi, isicelo sebhayometriki noma isitsha esibethelwe uveza ubufakazi bokuba nakho kanye nokunye. Lowo osebenza ngaphandle kokubethela futhi ovuleka ngesikhathi sohlelo lokusebenza uveza ifayela kuphela. Uhlelo olufanayo lungahlinzeka zombili izinhlelo kuye ngokuthi ukubhaliswa kwenziwe kanjani, ngakho isinqumo sokusetshenziswa sisekuleyo nyathelo, hhayi ekhasini lokukhangisa lohlelo.
Nquma ukuthi ikhodi ifakazelani ngempela
Ulimi lwamazinga lucace ngokungajwayelekile lapha, futhi kufanele lufundwe ngqo. Umhlahlandlela we-NIST weziqinisekisi ubala abakhiqizi be-OTP abasekelwe kusofthiwe njengeziqinisekisi, uhlukanisa i-OTP yesici esisodwa ne-OTP yezici eziningi enesici sokwenza kusebenze, futhi uthi ukuqinisekisa nge-OTP akumelani nokukhwabanisa. Ngakunye kwalokhu kathathu kushintsha lokho ongakusho mayelana nesicelo.
Ukungamelani nokukhwabanisa uwumkhawulo obukhali kakhulu. Ikhodi ethayiphiwe enkambeni ingathayiphwa enkambeni yomunye umuntu, ngesikhathi sangempela, ngumuntu othonyiwe ukuba enze lokho. Iwindi lifushane, okunciphisa inani lemizamo ewusizo kodwa akulivali iqhinga. Uma imfuneko yakho ihlanganisa ukumelana nakho, i-OTP iyisisekelo esingalungile, noma ngabe umkhiqizi usebenza kuphi.
Isici esisodwa ngokumelene nezici eziningi umehluko wesibili. Ikhodi evela ngaphandle kwesinyathelo sokwenza kusebenze ifakazela ukuba nakho kwefayela futhi akukho okunye, futhi ifayela linamandla njengoba kuphela i-akhawunti engalifunda. Engeza isici sokwenza kusebenze futhi isimangalo siyathuthuka, nakuba sisachaza ubufakazi obethulwe ekungeneni, hhayi ukwehlukaniswa komshini okukhiqizayo.
Bheka ukuthi ikhompyutha ehlaselekile ingafinyelela kuphi
Umhlaseli onamandla okusebenzisa ikhodi esiteshini somsebenzi akakhawulelwe ekufundeni inkambo othayipha kuyo. Isikhathi esisungulwe ngemva kokungena ngempumelelo ngokuvamile siyithokheni noma ikhukhi, futhi ithokheni ingasetshenziswa kusuka komunye umshini ngaphandle kwanoma iyiphi ikhodi. Uma lokho kuyikhono olivikelayo, ukwengeza isicelo sesibili ekungeneni kushintsha inani lezinyathelo ekuhlaselweni, hhayi umphumela.
| Arrangement | What it adds at login | What it leaves inside the laptop boundary |
|---|---|---|
| Password plus TOTP app on the same machine | A possession proof the password alone does not supply | The seed, the unlock step and the authenticated session |
| TOTP app on a separate phone | Seed storage outside the workstation | Session cookies, the typed password and any prompt that can be proxied |
| Hardware key with a signed challenge | A per-login signature bound to the origin | Whatever the browser and the workstation are already trusted to do |
Funda ikholomu yesithathu njengeqotho. Zonke izinhlelo ezingenhla zishiya okuthile ngaphakathi komngcele wokuthembela wesiteshi somsebenzi, ngoba yilapho isikhathi sisetshenziswa khona. Okushintshayo ukuthi imfihlo yesikhathi eside ihamba ngalo mngcele noma ihlala ngaphandle kwawo, nokuthi ubufakazi buhlotshaniswa nomthombo othile yini ukuze ikhasi lokulingisa lingakwazi ukuludlulisa.
Imininingwane emibili emincane iyingxenye yesithombe esifanayo. Ikhodi ihlala isemthethweni phakathi newindi layo lokwamukela, ngokuvamile imizuzwana engamashumi amathathu kanye nokubekezelela ukuphambuka kwewashi, ngakho inani elithunjiwe lingadlalwa futhi ngaphakathi kwalelo winti ngaphandle uma umqinisekisi enqaba ukusetshenziswa kabusha. Futhi ukufaka umkhiqizi omusha akuziqedi izikhathi esezivele ziqinisekisiwe, ngakho isikhathi esidala siphila isikhathi eside kunokushintsha kwesimo sokuqinisekisa okwakufanele kubambe isigameko.
Hambisa umkhiqizi kuphela lapho ukwehlukanisa kusiza khona
Ukubeka umkhiqizi wamakhodi ocingweni kuwukuthuthuka kwangempela ekwehlulekeni okukodwa: ikhompyutha ebiwe ayisayithwali bobabili ubufakazi. Kodwa akenzi lutho ekuthunjweni kwesikhathi kukhompyutha, akuncedi umsebenzisi othayipha ikhodi ekhasini lokukhwabanisa, futhi akuncedi amakhodi okubuyisela ake anyatheliswa kanye futhi afotwa kuhlelo lwamanothi.
Ngakho bhala imfuneko ngaphambi kokukhetha ithuluzi. Uma umgomo uwubufakazi obungeziwe ngokumelene nephasiwedi evuzile, shono lokho ngokucacile, futhi uhlelo olukudivayisi efanayo selukuhlinzeka. Uma umgomo ukumelana nokuhlaselwa kwesiteshi somsebenzi se-VPN, shono lowo mkhono womhlaseli futhi ukhethe uhlelo oluhlolwe kuwo, kanti imfuneko yokukhwabanisa ishiwo ngokwahlukile esikhundleni sokucatshangwa.
Bese usingatha ingxenye yokusebenza, enquma ukuthi kukhona yini okuzosinda lapho kuhlangana nesigameko. Ukulahlekelwa idivayisi kudinga indlela yokushintsha ebhaliwe, ukushintshwa kwesimo sokuqinisekisa kudinga ukuhoxiswa kwezikhathi ezisebenzayo, futhi impahla yokubhalisa idinga ukuvikelwa okufanayo nembewu, ngoba ikhophi yokubhalisa engavikelwe inikeza umhlaseli lawo makhodi azayo afanayo ngendlela emfishane. Ukubala lezi zinto ezine kusiza ukwedlula ukuphikisana ngokuthi amathokheni akudivayisi efanayo mahle noma awanamsindo.