Thatha inombolo ye-akhawunti eyimfihlo njengobufakazi bokuqinisekisa: yihlole

Inkambu enelebuli yenombolo ye-akhawunti ayiyona ngokuzenzakalela inkomba yomphakathi, futhi ilebuli akuyona isivivinyo. Isivivinyo yilokho okukuvunyelwe ukuba nokuthile: uma ukwazi inombolo kungena umuntu, kulanda iphrofayela yoxhumo noma kugunyaza idivayisi, leyo nombolo iwubufakazi bokuqinisekisa obunomjikelezo wokuphila. Ngenza izivivinyo ezinhlanu ezingezansi njalo lapho insizakalo ikhipha ubunikazi bezinombolo futhi ibiza lokho njengokungenangozi. Ngayinye ikhiqiza umugqa kurekhodi elifushane, futhi irekhodi yilona okunikezwayo, hhayi isinqumo ngomkhiqizo.

Bhala phansi lokho okunikezwa ukuba nokuthile ngempela

Bhala isenzo ngasinye esivulwa yinombolo ngokwehlukana. Ukungena kuphothali, ukuthola ifayela lokulungiselela, ukugunyaza idivayisi entsha nokunikeza ukungena komhubhe okwamukelwe kungamandla ahlukene, futhi insizakalo ingasebenzisa okukodwa ngaphandle kokunye. Iphothali eyamukela inombolo njengenkambu eyodwa kuphela ayisho lutho mayelana nokuthi umhubhe uqinisekisa kanjani umlingani wawo kamuva noma ukuthi izikhiye zokuhamba zitholakala kanjani.

Imodeli evamile ilula ukuyisho: ubufakazi bokuqinisekisa be-bearer yilobo umnikazi angabisebenzisa ngaphandle kokuqinisekisa ukuthi unesikhiye sokubhala esihlukile, futhi lowo umehluko yilo RFC 6750 odonsa kumathokheni. Lokhu ukuqhathanisa, hhayi isimangalo sokuthi insizakalo esekelwe kunombolo isebenzisa i-OAuth. Uma umnikazi engadingi okunye, thatha inombolo njengemfihlo ye-bearer futhi uhlukanise umklamo osele ngokufanele.

Yivikele njengemfihlo, hhayi njengenkomba

Ukugcinwa kulandela ukuhlukaniswa. Inani elingena lisendaweni yokuphatha amagama ayimfihlo, hhayi kusithombe sesikrini, emlandweni webhodi lokunamathisela, kumyalezo wengxoxo noma kunothi lesiphequluli. Izithombe zesikrini ukuvuza okuvamile: inombolo imfushane futhi ibonakala ingenangozi, ngakho igcina isekuqenjini losizo oluphila isikhathi eside kunedivayisi elivela kuyo.

Ubuqili enye indlela yokwehluleka, futhi akunandaba nokuthi inombolo ingahle futhi ingahle. Umkhohlisi ofuna inani uzocela ukuthi uyinamathisele efomini, futhi ubufakazi bokuqinisekisa obungapheli futhi obungenayo into yesibili bufanele umzamo. Fika endleleni yokungena kusuka kubhukhimaka noma ikheli elaziwayo, hhayi kusixhumanisi esisemlayezweni okubuye kucele inombolo.

Thatha izinto zokubuyisela njengengxenye yemfihlo. Uma umqhubi ekhiphe nekhowudi yokubuyisela, i-PIN noma ikheli le-imeyili elingasetha kabusha i-akhawunti, lezo ziwubufakazi obuhlukile obunesidingo esifanayo sokuvikela. Isiteshi esisodwa sokubuyisela esingavikelwe senza konke okunye ukulawula kube umhlobiso.

Hlola ngokubambisana ukumelana nokuqagela nomkhawulo wejubane

Ubude bunencazelo kuphela eduze kwendlela yokukhiqiza. Inombolo ende ekhiqizwe ochungechungeni olungabikezelwa inobuthaka kunenani elifushane elivela kumkhiqizi we-cryptographic, futhi inani elimangalisayo lamadijithi alifakazeli ukungalindeleki. Buza ukuthi inani likhiqizwa kanjani ngaphambi kokucabanga ngobunzima bokuliqagela.

Ukumelana nokuqagela kukodwa futhi akumelani nezinga elinganiselwe lemizamo. Izilawuli ezibalulekile yilezo umqhubi azisebenzisayo: izibali zemizamo ehlulekile, ukukhiya, ukunciphisa ngesimo somthombo kanye nokuthi inombolo engalungile ihlukaniseka yini kuleyo engekho. Uma insizakalo isekela lokho, umzamo owodwa ohlulekile ubonisa ukuthi iphutha linjani nokuthi isibali sokuphinda sibonakala yini:

# one attempt, then read the response and any counter or delay
# do not script repeated guesses against a live account
curl -i -X POST https://portal.example.invalid/login -d "account=000000000000"

Rekhoda lokho okwembulwa impendulo. Iphutha elihlukile le-akhawunti engaziwa i-oracle yokubala ngisho lapho inombolo ingaqageki, futhi lokho okutholakele kungokwerekhodi, noma ungakwazi ukukulungisa ohlangothini lwekliyenti noma cha.

Hlela ukushintshwa nokuhoxiswa ngaphambi kokukudinga

Thola inqubo esekelwayo yenombolo elahlekile noma evezwe futhi uyibhale phansi ngesikhathi konke kusebenza. Ingabe ubufakazi bokuqinisekisa be-akhawunti bungashintshwa nakancane? Ingabe ukushintsha kungavimbela amadivayisi asevele abhalisiwe, amaseshini asebenzayo noma ukulungiselela okulandiwe? Yiziphi izinto zokubuyisela ezidingwa inqubo? Insizakalo engenakho ukuncika ku-imeyili ingadlulisela umthwalo omkhulu wokubuyisela kumsebenzisi, okwenza inqubo ibe baluleke kakhulu, hhayi kancane.

Hlukanisha ukushintshwa kwe-akhawunti nokuhoxiswa kobufakazi bokuqinisekisa. Uma inombolo igunyaza ukulanda isikhiye, isitifiketi noma iphrofayela, ukushintsha inombolo kungashiya lokho okulandiwe kusemthethweni, futhi ukuhoxisa okulandiwe kungaba omunye umsebenzi onomunye umnikazi. Ungacabangi ukuthi inkambu eyodwa eshintshiwe iqeda konke ukuxhumana; hlola imodeli yangempela yomqhubi futhi urekhode lapho ukuqinisekisa khona.

Bhala phansi isinqumo futhi usihlole futhi kamuva

Gcina irekhodi lekhasi elilodwa ngesinsizakalo ngayinye: yimaphi amandla anikezwa yinombolo, igcinwa kuphi, ubani angayisetha kabusha, yibuphi ubufakazi bokusetshenziswa obukhona nokuthi uzokwenzani ehovini lokuqala ngemva kokwembulwa. Lelo rekhodi yilona eliguqula impikiswano ngamagama ibe isinqumo umuntu angasihlola.

Izimangalo zobumfihlo zidinga ububanzi bazo. Inombolo ekhiqizwe ngokungahleliwe ingaba yisikhombi esizinzile esixhumanisa izehlakalo ze-akhawunti ngokuhamba kwesikhathi; ukungalindeleki akukona ukungaxhumaneki, futhi asikho isici esisho lutho mayelana nemethadatha yenethiwekhi egciniwe. Qhathanisa imiklamo ephelele esikhundleni sokubala izinkambu kusikrini sokungena.

Ngaphambi kokuyirekhoda:

• Wonke amandla anikezwa yinombolo abhaliwe, kuhlanganise nokulanda nokugunyazwa kwedivayisi.
• Iziteshi zokugcina nokubuyisela zivikelwe ngezinga elifanayo nenombolo uqobo.
• Indlela yokukhiqiza nemikhawulo yejubane ziyaziwa, akucatshangwa ngobude.
• Kukhona inqubo yokushintsha nenqubo yokuhoxisa, futhi uyazi ukuthi yiphi ehoxisa eyiphi.
• Irekhodi lisho ukuthi ubani angasetha kabusha inani nokuthi yibuphi ubufakazi obusalayo ngemva kokusetshenziswa.