清华大学校内外主要网站用户密码传输探讨.pdfVIP

清华大学校内外主要网站用户密码传输探讨 学校：清华大学 院系：信息学院计算机科学与技术系 班号：计12 作者：张卓 工程领域：密码学与信息安全 1 Research and Analysis of the Transportation of Passwords of Some Main Websites Author: Zhang Zhuo Specialty : Web Security and Cryptology 2 清华大学校内外主要网站用户密码传输探讨 摘要： 用 户口令（俗称密码）的存储和传输是互联网安全很重要 的一个部分，现代密码学的发展已经使得口令的传输得以相 对安全地加密。但一方面，有许多网站由于资源的考虑或不 够重视而未将用户的口令合理地加密，这造成了很大的安全 隐患。 本文利用抓包技术对清华校内外数个学生常用网站的口令 传输方式做了分析，提出了可能存在的安全隐患，以及对应 的解决措施，同时提供了在短期内网站不改变现有口令传输 方式时的用户应对措施。 关键词：加密通信，网络安全 3 Research and Analysis of the Transportation of Passwords of Some Main Websites Abstract ： The security of storage and transportation of user’s passwords is essential. The development of cryptology can guarantee the security of user’s passwords to a considerably content. However, because of limited resource or the lackness of awareness of the importance of encrypting the passwords, some websites do not encrypt the passwords well, which begets big risk. In this dissertation , I use the packet-capture technology to analyse the current situation of the transportation of passwords of some main websites in and out of Tsinghua University, and discuss the potential risks, and propose some methods to deal with the problem. Also , the dissertation propose some ways for ordinary users , when the security problem cannot be solved soon. Keywords: Web security, Encrypted communication 4