パスワード管理ベストプラクイティス / Password management best practice.

Transcript

1. .BTBZB
   0VSB
    ύεϫʔυ؅ཧ
   ϕετϓϥΫςΟε
2. ໨ඪ • Ϣʔβʔͱͯ͠ద੾ʹύεϫʔυΛ؅ཧ͢Δํ๏Λߟ͑Δ • αʔϏεͷ։ൃऀͱͯ͠ͷ؅ཧํ๏͸ԼͷεϥΠυΛ
 https://speakerdeck.com/pddg/why-are-plain-passwords-evil
3. μϝͳύεϫʔυ • ద౰͗͢Δ΋ͷ
 ྫɿʮpasswordʯɼʮ123456ʯ • ໊લ΍஀ੜ೔͕ೖ͍ͬͯΔ΋ͷ
 ྫɿʮtarou0101ʯɼʮ19700101ʯ • ୯ޠ
 ྫɿʮbaseballʯɼʮplaystationʯ • IDͱಉ͡
4. ඍົͳύεϫʔυ • ه߸Ͱஔ͖׵͑ͨ΋ͷ
 ྫɿʮpasswordʯˠʮp@ssw0rdʯɼʮjohnbankʯˠʮJ0hnB@n<ʯ • ద౰ʹࣗಈੜ੒ͨ͠௕͍จࣈྻ
 ྫɿʮQW(Kbj&tgW~Upjv5U+,gʯɼʮ#MqFQnLr(#NGcnk5Ujnkʯ • ύεϫʔυʹαʔϏε໊Λ଍͢
 ྫɿʮpasswordserviceAʯɼʮpasswordseviceBʯ
5. ͍͍ύεϫʔυͷఆٛ •௕͍ •ෳࡶ
6. ؅ཧํ๏ • શ෦҉ه͢Δ
 →֮͑ΒΕͳ͍ • ࢴʹॻ͍͓ͯ͘
 →ͳͨ͘͠ΒऴΘΓ • ύιίϯͷϝϞாʹॻ͍͓ͯ͘
 →σʔλ͕ফ͑ͨΒऴΘΓ • ύεϫʔυ؅ཧαʔϏεΛར༻͢Δ
 →৴༻Ͱ͖Δ؅ཧձ͔ࣾɼ༗ྉͩͬͨΓ͢Δ
7. ແྉͰ؆୯ʹ؅ཧͰ͖ͯ
   ҆શͳํ๏͸ͳ͍ͷ͔ʁ
8. ϋογϡԽ • ೚ҙͷσʔλ͔Βݻఆ௕ͷผͷ஋ʢϋογϡ஋ʣΛಘΔૢ࡞
 ྫɿʮpasswordʯɹɹ
 ɹɹɹˠʮXohImNooBHFR0OVvjcYpJ3NgPQ1qq73WKhHvch0VQtg=ʯ • ಉ͡σʔλ͔Β͸ৗʹಉ͡ϋογϡ஋͕ಘΒΕΔ • ม׵αΠτ
 https://hogehoge.tk/tool/
9. ϋογϡԽ
   
   ϝϦοτ • ͓֮͑ͯ͘ͷ͕؆୯ and ଞͷਓʹ͹Εͳ͍
 ྫɿʮpasswordserviceAʯ
 ɹɹɹˠʮVKrMUwooLN4Yj7RitaSCLmzI0ZGlSQj3mX245hAkQDE=ʯ
 ɹɹʮpasswordserviceBʯ
 ɹɹɹˠʮAELCxupPvvbaNVRHDyxntb3KmYPYnmEEulyKPW2+/dA=ʯ • طଘͷΞϧΰϦζϜΛ༻͍͍ͯΔͷͰ͍ͭͰ΋࢖͑Δ
 SHA-1, SHA-256, MD5ͳͲ
10. ϋογϡԽ
    
    ɾσϝϦοτ • ݁ہϒϥ΢βʹύεϫʔυอଘͨ͠Γ͢Δඞཁ͸͋Δ • αʔϏε໊͕มΘͬͨΓͯ͠๨ΕΔՄೳੑ΋
11. ࣗ࡞ͨ͠ • ୭͔͕࡞ͬͨαʔϏε͸৴༻Ͱ͖ͳ ͍ • ࣗ෼Ͱ࡞Δ͔͠ͳ͍ʂ • AndroidΞϓϦͰϋογϡԽͰ͖Δͷ Λ࡞ͬͯΈͨʂ
 http://github.com/ocucrqp/
12. ࢀߟ • ύεϫʔυ؅ཧͬͯΈΜͳͲ͏ͯ͠Δͷʁʁ͜͏͢Δͱ͍͍ͱࢥ͏Αʂ - Qiita
 https://qiita.com/agajo/items/41f518647605753a8c0a • 2019 ೥ͷੈքύεϫʔυσʔʹύεϫʔυͷ 3 ͭͷϕετϓϥΫςΟεΛ࠶֬ೝ ͢Δ – UTM/NGFWͰϚϧ΢ΣΞɾඪతܕ߈ܸରࡦʛ΢ΥονΨʔυɾςΫϊϩ δʔ
 https://www.watchguard.co.jp/security-news/three-updated-password-best- practices-for-world-password-day-2019.html • ʲJava SE 8ݶఆʳ҆શͳύεϫʔυΛੜ੒͢Δํ๏ | ΩϟεϨʔίϯαϧςΟϯ άגࣜձࣾ
 https://www.casleyconsulting.co.jp/blog/engineer/153/