我们一个新来的leader昨天踌躇满志的跟我说.....

乱码

原帖由 cdfei 于 2010-11-19 23:47 发表
你不用身份证去开证书，光登录那种，根本没有交易功能，你攻击的话，也最多可以查查别人的交易记录。

如果是电子签名的证书，就只能在一个固定的机器上作业务，在其他机器上只有看得份，可以这么理解么？

kawara

每个token有一个密钥，用密钥根据时间算出一个password.

cdfei

我的理解是，每个客户一个密码，写到这个设备中了，然后根据一定的算法，生成一个标识码，服务中用客户的登录用户信息，验证这个标识码是否正确，判定是否为客户本人。这个是和时间相关的，设备每生成的一个码，在一定时间内就失效了，好像是5分钟还是什么的，记不到了。

乱码

原帖由 kawara 于 2010-11-19 23:53 发表
每个token有一个密钥，用密钥根据时间算出一个password.

这是hsbc那个device的原理么？

got it.

How does the Online Security Device Security Code work?
The Online Security Device generates a time-sensitive, single-use six digit Security Code for you to use when logging on to Internet Banking and for selected online transactions. The Security Code is generated by an algorithm based on time within the Online Security Device. Each Online Security Device has a matching file, stored securely in a database at HSBC, with the matching algorithm.

When you activate your Online Security Device, HSBC identifies which Device you have by asking you to enter the serial number. The serial number has no security value; it is simply a means of identifying to the Bank which Device a customer has. Once activated, a Device becomes unique to the PBN it was activated with.

When you are using Internet Banking and are required to enter a Security Code, the system compares the entered Code with the expected Code within the file. If they match, you are granted access. If they do not match, you will be asked to re-enter the Security Code.

http://www.hsbc.com.au/1/2/perso ... et-banking/faq/faq6

[ 本帖最后由 乱码 于 2010-11-19 23:59 编辑 ]

cdfei

证书是导入到浏览器中的，你可以导入导出，安装到多台机器，我们都是在IE上测试的。

kawara

那个token实现其实老复杂了，刚出来的时候要20美金一个。

主要是server 和token时间有误差的时候不好处理。

那个南非项目就用这个token，当时澳洲还没有

[ 本帖最后由 kawara 于 2010-11-20 00:05 编辑 ]

乱码

原帖由 cdfei 于 2010-11-19 23:58 发表
证书是导入到浏览器中的，你可以导入导出，安装到多台机器，我们都是在IE上测试的。

嗯，不错，听起来比较安全。

国内好像就认IE，其他的都忽略，好简单啊

乱码

原帖由 kawara 于 2010-11-20 00:03 发表
那个token实现其实老复杂了，刚出来的时候要20美金一个。

主要是server 和token时间有误差的时候不好处理

我看了那个解释半天，也没明白啥意思，还是cdfei说的清楚些，可能就是不让我们弄清楚

cdfei

银行什么时候缺过钱啊。
真正银行被击破导致偷钱的事情其实很少，主要还是木马、钓鱼网站等使客户密码用户名丢失，所以银行在验证客户身份上就很下功夫，起码中国的是这样。

kawara

呵呵，我以前看过token的开发手册的

bulaohu

原帖由 乱码 于 2010-11-19 22:14 发表


他会用xss来举例子。

我也同意带着javascript的确有隐患，不过要看产品对安全级别的要求，我不觉得我们的产品有什么值得去hack的东西，不过classic asp这个framework在安全上的support的确很有问题，稍微不注意，肯定被人ha ...

XSS绝大多数情况下威胁有限，XSRF威胁大得多，但跟自家网站往往没什么关系

乱码

原帖由 cdfei 于 2010-11-20 00:06 发表
银行什么时候缺过钱啊。
真正银行被击破导致偷钱的事情其实很少，主要还是木马、钓鱼网站等使客户密码用户名丢失，所以银行在验证客户身份上就很下功夫，起码中国的是这样。 ...

嗯，当时我们行有个做储蓄的写程序，留后门，每个客户的帐里偷一分钱，转到他自己的帐户里去.有一次有个客户，刚刚存了10000块，转身就要取出来，结果死活差一分取不出来，行里就查这事，后来把这小子揪出来了。判了几年不清楚。

其实他还是业务不熟，要我是他，就在年底结息那天晚上作这个，每个人偷1毛钱也肯定没人发现，他太傻了。

cdfei

大老虎的那个网站确实不错，关了JS也能到这个效果，真不错。

bulaohu

原帖由 kawara 于 2010-11-19 22:59 发表
过去的网站简单，整个网银也没几处JS，validation全部是server side，哪像现在都要求client side validation.以前的UX也就是要排版好看之类。

当时我们卖了个网银给南非的一家银行，人家有钱，从俄罗斯找了一帮从良的黑客来测 ...

当年有好多网站连SQL injection都不检测，完全是裸奔。但最近几年形势完全变了，看看CVE里面的entry，大的漏洞基本上都快挖完了，结构性的漏洞基本上没有了，现在能找到的基本上就是网管的愚蠢导致的东西

cdfei

是吗，以前我去给建行做项目的时候，看他们结息日晚上都是通宵上班的，应该也没那么容易吧，这些歪路不好走啊。

cdfei

那时候的很多网站没这么需要保护，现在连新足迹的分都可以买东西了，安全确实越来越重要了

bulaohu

原帖由 乱码 于 2010-11-19 23:16 发表


看来谁都没睡哈~~

https是传输方面用binary,防止有人在中间用proxy侦听，在客户这端可以用任何方式改request parameter，都没问题。

I'd call it encryption rather than binary - and SSL can be MITM attacked as well, if you know how to do it ;)

乱码

原帖由 bulaohu 于 2010-11-20 00:11 发表


XSS绝大多数情况下威胁有限，XSRF威胁大得多，但跟自家网站往往没什么关系

同意，所以我会定期清清browser，尤其是log in自己银行帐户的时候，都用safari干这个，除了查帐，我根本不用它

bulaohu

原帖由 乱码 于 2010-11-19 23:31 发表


申请客户证书是怎么回事？谁来issue? 也是3rd party well-known的机构么？年费是多少？有点搞阿~~

不过这倒真的是secure了

Same as server cert.

bulaohu

原帖由 乱码 于 2010-11-19 23:49 发表


我不是很明白这个数字狗的原理，你能解释一下么？是不是一组数对应一个用户，只要输入其中一个就可以？server side存者每个用户的那组数字？

Search for OTP

乱码

原帖由 cdfei 于 2010-11-20 00:16 发表
是吗，以前我去给建行做项目的时候，看他们结息日晚上都是通宵上班的，应该也没那么容易吧，这些歪路不好走啊。

用现成的程序就快多了，只要没人complain，就没有人会查这个，当然这些歪门邪道不提倡，我是说从技术角度，结息那天最好。

乱码

原帖由 cdfei 于 2010-11-20 00:13 发表
大老虎的那个网站确实不错，关了JS也能到这个效果，真不错。

嗯，为了non-js也能工作，下了不少心思，花了不少冤枉钱

乱码

你们接着聊，我觉觉去了

kawara

原帖由 bulaohu 于 2010-11-20 00:20 发表


Same as server cert.

不是的。搜索 mutral auth trust store

kawara

The Situation

When GraysOnline sought to re-develop their website, they were referred to Readify to help architect and develop the solution.

GraysOnline sought to augment their successful auction business with a range of fixed price "buy now" products.

This required a significant update to their existing web property to support the new sales model, providing an opportunity to revamp the existing website at the same time.

With the move into fixed price retailing, a key requirement of the solution was to provide a system upon which GraysOnline could rapidly develop and refine their offering.
The Solution

The solution was an e-Commerce system that encompassed everything from the internet website to back-end tools and integration components.

A team of Readify consultants led the effort to produce this system using ASP.NET with Commerce Server 2007 to build a rich and interactive shopping experience. In order to provide a consistent experience to all users, all HTML and CSS is standards compliant. Also, to ensure JavaScript was not a user requirement, the concept of progressive enhancement was enforced.

The result was a rich front-end application supporting auction and fixed price offerings to provide GraysOnline customers with a unified and satisfying experience when purchasing goods. It allows users to keep track of items they are bidding on in the same way a traditional retail website allows users to manage their cart.

The back-end tools provide the ability to manage products, users and marketing on the website. Business users utilise the standard business tools that are provided out of the box by Commerce Server, along with custom tools built during development to ensure the website runs smoothly with the provided content.

The integration components communicate events to other systems inside the GraysOnline ecosystem. Components were built to manage communication between Commerce Server and the existing warehousing and inventory systems, which were primarily built around auction principles.

The GraysOnline website is a great example of Readify's front-end engineering experience, combined with deep technical skills required to make a site of this magnitude perform.

Stewart McGrath, Chief Information Officer, GraysOnline commented, "Readify has been exceptionally flexible and adaptable to meet our needs and their core strength has been in the capability of its people".
The Methodology

Part of this engagement was the introduction of the SCRUM methodology to GraysOnline. Readify Principal Consultant, Richard Banks, was involved in training the developers and managers to comply with the SCRUM methodology. Team Foundation Server (TFS) and the Conchango SCRUM template were used to manage the User Stories, Sprints, Tasks and Bugs, thereby providing an integrated experience with Visual Studio and reporting tools to allow management to track the product development process.

Several quality indicators and were also automated. The use of TFS allowed for the setup of Continuous Integration builds that provided reporting on indicators such as unit test coverage and standards compliance. Deployments were automated in order to provide quick verification of build stability and ease of transition from one environment to another.

Over the lifetime of the project the team has had to adapt to changes in business drivers. While the website was in the initial phase of development, sprints were organised into two week iterations of work. During this phase the team grew to ten developers so it was split into two teams. Work was split amongst these two teams depending on the areas of expertise of developers.

Each of the development teams was provided with one or two testers depending on the size of the team at the time. The usual ratio of developers to testers was 2:1. This allowed for ongoing quality assurance.

Once the solution was deployed, feature development continued at a slower rate as stabilisation was the primary concern. Sprint durations were cut to one week in order to provide a quick turn-around on priority issues.
The Challenges

During development, it was necessary to maintain the classic site side-by-side in order to provide a smooth transition from one system to another. This also meant that GraysOnline could expose the new system to a select group of loyal customers to allow the opportunity of collecting feedback on the progression of the new concept.

It was also necessary to ensure the existing back-end systems, such as warehousing, inventory management and reporting, continued to function once the retail system was put in place. In order to achieve this, new back-end systems were created to foster the communication of events that occurred between the retail system and the existing back-end systems.
The Benefits

Implementing the retail solution using Commerce Server 2007 allowed the development team to quickly produce a fully functional e-commerce framework by utilising the catalogue, ordering, profiling and marketing sub-systems that it provides out of the box. This meant that development efforts could be focused on delivering a rich front-end experience to combine both the auction and retail businesses and give customers an interactive shopping experience - whether bidding or buying.

Readify delivered benefits to the partnership through the full lifecycle of the project in the form of SCRUM methodology coaching, requirement scoping, solution architecture, development and go-live transition management. Use of a strong SCRUM methodology allowed the project to adapt to and deliver upon a complex and changing scope.

"Readify has helped us execute code cutting, architecture, development processes and performance testing. We look forward to Readify's continued support", says McGrath.

The new GraysOnline site is a significant asset and is allowing Grays to expand into other business areas. Using Readify's ALM experience it is now possible for GraysOnline to easily maintain the solution and roll it out to production.

bulaohu

原帖由 kawara 于 2010-11-20 08:27 发表

不是的。搜索 mutral auth trust store

dude he's asking what a client cert is, not how mutual SSL authentication is performed I assume.

kawara

原帖由 bulaohu 于 2010-11-20 09:03 发表


dude he's asking what a client cert is, not how mutual SSL authentication is performed I assume.

网站的certificate一般要大CA机构签发，像Verisign啥的，费用很高。原因是browser的truststore里面只有那几个大CA。其他的CA会被浏览器警告。可以编辑浏览器truststore避免，但是不能要求客户那么做，否则也失去了验证的意义。

客户端的certificate因为server端可以设置truststore，所以由网站所在公司内部签发cert已经足够。否则的话费用也不现实。

乱码知道cert是什么，他只是不确定client cert该由谁签发。

乱码

原帖由 kawara 于 2010-11-20 09:50 发表

网站的certificate一般要大CA机构签发，像Verisign啥的，费用很高。原因是browser的truststore里面只有那几个大CA。其他的CA会被浏览器警告。可以编辑浏览器truststore避免，但是不能要求客户那么做，否则也失去了验证的意 ...

嗯，我只是不确定谁来issue这个certificate，如果每个行都采取client certificate的方式，还不如由银监会/人民银行来签发，这样形势更统一，在client那边只有一个certificate，而不是每个银行一个。

典

我们公司使用Verisign, 好像不贵，可能是因为我们的网页只有几百个内部用户

kr2000

SSL有free的
http://www.startssl.com/
一般用户都够用了