Giter Site home page Giter Site logo

Comments (8)

darknessomi avatar darknessomi commented on May 20, 2024

额，官方的登录页面http://music.163.com/ ，就是非TLS登陆。
看来网易自己就在耍流氓。

from musicbox.

chaserhkj avatar chaserhkj commented on May 20, 2024

嘛……理论上来讲能用TLS就用TLS当然是Best Practice,但是实践上很多国内公司都做不到,其实这的确是一个很不负责任的表现.

像github, G+, facebook这种网站且不说登录页面TLS,更是实现了全域TLS,可见在这方面的安全重要性.

另一方面来讲,虽然我没有调查过,但是我相信网易既然有TLS登陆的接口(https://music.163.com/api/login ),就应该是在使用的……

我强烈怀疑网易自己的手机/Windows客户端是TLS登陆的,至于网页端不这么做纯粹因为他们觉得用网页端的人少……

我觉得我们的项目的安全性还是要向Windows客户端看齐的……

from musicbox.

darknessomi avatar darknessomi commented on May 20, 2024

嗯，没错，客户端经过抓包确实是TLS登陆的，但是 Ubuntu 证书错误的确是个问题，本人平时并不使用 Ubuntu。 在没找到解决方案之前，所以只能临时去掉了TLS登陆，毕竟先得保证 Ubuntu 用户能用才能再考虑可能存在的安全问题。
你要是常用 Ubuntu 环境的话可以帮忙看看啊，应该是 Ubuntu 系统问题，纯净 Ubuntu 也会报错，其他系统不存在这个问题。

from musicbox.

chaserhkj avatar chaserhkj commented on May 20, 2024

没问题，我可以比较方便的接触Ubuntu环境，回头有空就看看……

不过我觉得如果是证书错误的话，优先尝试https登陆，出错再Drop back回http登陆或许也可以是一个方案？

from musicbox.

darknessomi avatar darknessomi commented on May 20, 2024

看来是urllib3更新引起的
https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning
Python2.7.9 以下使用urllib3 1.9就会报错，看来只要等Python更新就好，或者禁用ssl检查

from musicbox.

typcn avatar typcn commented on May 20, 2024

这这情况一般是把证书指纹内嵌到软件中，在建立 SSL 连接的时候校验一下服务端的证书是否与预置的相等

from musicbox.

chaserhkj avatar chaserhkj commented on May 20, 2024

@typcn 但是这样的话，服务端要是换证书了软件也得更新后才能用啊……

from musicbox.

typcn avatar typcn commented on May 20, 2024

一般证书至少都是一年换的吧。。。

from musicbox.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.