blocks|key|4672184|text|如果您愿意将用户身份验证功能委托给其他人，那么谷歌的双因素认证是一个很好的选择。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|entityMap|0|LINK|mutability|MUTABLE|url|http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html^0|N|8|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@$A|L|B|M|1|N]]|C|$]]]|D|$E|$5|F|G|H|C|$I|J]]]]

If you're willing to delegate your user authentication function to someone else, then <a href="http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html">Google's two factor authentication</a> is a good option.

blocks|key|3531273|text|我建议您查看一下PhoneFacter。我在过去看过他们，发现这是一个非常有趣的概念。就像你的银行，他们使用电话作为第二个因素，并提供短信或直接语音电话核实。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3531274|当然，它们是否具有“成本效益”，将取决于这些词对你意味着什么。|entityMap|0|LINK|mutability|MUTABLE|url|http://www.phonefactor.com/^0|8|B|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@$A|N|B|O|1|P]]|C|$]]|$1|D|3|E|5|6|7|Q|8|@]|9|@]|C|$]]]|F|$G|$5|H|I|J|C|$K|L]]]]

I would recommend looking into <a href="http://www.phonefactor.com/">PhoneFacter</a>. I have looked at them in the past and found it to be a very interesting concept. Much like your bank they use telephones as the second factor, and offer either SMS or direct voice calls for verification.

Whether they are "Cost Effective" will, of course, depend on what those words mean to you.

blocks|key|3531320|text|虽然我没有亲自使用它们，但我从几个来源听到了关于YubiKey的非常好的消息，它是一个插入计算机USB端口的微型硬件密钥，基本上提供了一个一次性密码，每次使用时都会更改密码。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|entityMap|0|LINK|mutability|MUTABLE|url|http://www.yubico.com/yubikey^0|O|7|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@$A|L|B|M|1|N]]|C|$]]]|D|$E|$5|F|G|H|C|$I|J]]]]

Although I have not personally used them, I have heard very good things from several sources about <a href="http://www.yubico.com/yubikey">YubiKey</a>, which is a tiny hardware key that's plugged into a computer USB port and basically provides a one time password which changes each time it is used.

blocks|key|3531445|text|我们在双保安上提供了一种双因素解决方案，可以使用语音、短信、移动设备和硬件令牌.我们的开源网站和unix客户端还可以帮助您评估您的选项(包括我们的，其他的，以及滚动您自己的)。免责声明，我是一个二人开发人员。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|entityMap|0|LINK|mutability|MUTABLE|url|http://www.duosecurity.com/|1|https://github.com/duosecurity/duo_web|2|https://github.com/duosecurity/duo_unix^0|3|3|0|19|2|1|1C|4|2^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@$A|P|B|Q|1|R]|$A|S|B|T|1|U]|$A|V|B|W|1|X]]|C|$]]]|D|$E|$5|F|G|H|C|$I|J]]|K|$5|F|G|H|C|$I|L]]|M|$5|F|G|H|C|$I|N]]]]

We provide a two-factor solution at <a href="http://www.duosecurity.com/">Duo Security</a> which can use voice, SMS, mobile device, and hardware tokens. Our open-source <a href="https://github.com/duosecurity/duo_web">web</a> and <a href="https://github.com/duosecurity/duo_unix">unix</a> clients may also help you evaluate your options (both ours, others, and towards rolling your own). Disclaimer, I am a Duo developer.

blocks|key|4671967|text|我可以建议一些不那么标准的东西，并考虑采用基于软件的生物特征认证吗？|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4671968|4671969|我熟悉一些在这个领域工作的(秘密的)初创公司.这可以包括键盘动力学，通过网络摄像头进行指纹识别，其他.|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|G|8|@]|9|@]|A|$]]|$1|C|3|D|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

Can I suggest something a little less standard, and consider going with software-based biometric authentication? 
I'm familiar with a few (stealth) startups working in this space... this can include things like keyboard dynamics, fingerprint recognition via webcam, others...

blocks|key|4672133|text|可耻的是，我不知道费用的数字，但也许你想试试前维瑞信基于云的双因素认证。该网站声称这是低成本。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|entityMap|0|LINK|mutability|MUTABLE|url|http://www.verisign.com/authentication/two-factor-authentication/index.html?tid=gnps^0|Q|9|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@$A|L|B|M|1|N]]|C|$]]]|D|$E|$5|F|G|H|C|$I|J]]]]

The shame on me, I don't know the cost figures but maybe you want to try ex-VeriSign <a href="http://www.verisign.com/authentication/two-factor-authentication/index.html?tid=gnps" rel="nofollow">cloud based two-factor authentication</a>. The web site claims it is low cost.

blocks|key|4672170|text|虽然没有答案，但我会在这里发出来。我当然希望普通的日常电子商务网站不要开始使用二因素认证作为标准.对于用户来说，它应该始终是可选的，除非对您的业务有很大的负债(不可接受的risk%2Bcost)。我讨厌他们，而且他们在旅行时非常烦人。它减慢了我的网络体验，而我等待一条短信或电子邮件，并转录一次代码。我最糟糕的经历是在海外和我的手机漫游时尝试接收短信验证代码。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4672171|下面是我的建议:使用电子邮件地址验证和HTTPS，直到您有进一步的time%2Bmoney。然后添加它作为一个选项，就像OpenID一样。|4672172|甚至基于电话号码的2因素认证也依赖于识别用户的电话号码。我认识一些人，他们宁愿给你一张信用卡来核实他们的地址，也不愿把他们的电话号码给一个随机的网站。尤其是当你在电子商务领域的时候。将身份验证视为注册的额外步骤，而不是登录的额外步骤。|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|H|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|I|8|@]|9|@]|A|$]]]|F|$]]

Although not an answer, I'll post it here. I sure hope that common everyday e-commerce sites do NOT start using 2-factor authentication as standard. It should always be optional for users unless there is large liability (unacceptable risk+cost) leveraged against your business. I hate them, and they're horribly annoying when traveling. It slows down my web experience while I wait for a text message or email and transcribe the one-time code. My worst experience was trying to receive an SMS verification code while overseas and my phone on roaming.

Here's my suggestion: use email addresses verification and HTTPS until you've got time+money to go further. Then add it as an option, just like OpenID.

Even phone-number-based 2-factor authentication relies on identifying the user's phone number. I know people who would rather give you a credit card to verify their address than give their phone number to a random website. Especially if you're in the e-commerce space. Consider identity verification as an extra step to registration rather than an extra step to login.

blocks|key|3531774|text|SMS从来都不是一个质量保证的渠道，因为它主要工作在“火和遗忘”模式下，发送速度取决于发件人控制之外的许多因素。此外，您还必须维护当前的用户电话号码，并有一个安全的过程，以改变它。此外，短信的成本仍然相对较高。我没有测试，我不知道它需要多少钱，但解决方案看起来很有趣，问题是，就像短信一样，你强迫移动电话使用你的网站。解决方案：http://www.cronto.com/visual_cryptogram.htm|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|entityMap|0|LINK|mutability|MUTABLE|url|http://www.cronto.com/visual_cryptogram.htm^0|4K|17|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@$A|L|B|M|1|N]]|C|$]]]|D|$E|$5|F|G|H|C|$I|J]]]]

SMS has never been a Quality Assured channel as it mostly works in "fire and forget" mode, with delivery speed depending on many factors outside the sender's control. Also you have to maintain the current user phone number and have a secure procedure for changing it. Furthermore, the cost of an SMS is still relatively high. I didn't test, i don't know how much it costs, but the solution looks interesting, the problem, as with SMS, that you force mobile telephone as requirement to use your site. the solution: <a href="http://www.cronto.com/visual_cryptogram.htm" rel="nofollow">http://www.cronto.com/visual_cryptogram.htm</a>

blocks|key|4672196|text|Apache+TripleSec可能很有趣，虽然我还没有试过，所以我不确定它有多稳定。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|entityMap|0|LINK|mutability|MUTABLE|url|http://directory.apache.org/triplesec/^0|0|G|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@$A|L|B|M|1|N]]|C|$]]]|D|$E|$5|F|G|H|C|$I|J]]]]

<a href="http://directory.apache.org/triplesec/" rel="nofollow">Apache TripleSec</a> might be of interest, although I haven't tried it, so I'm not sure how stable it is.

blocks|key|3531858|text|作为认证和授权解决方案的顾问，我研究了几种使用OTP、生物特征和其他挑战应对系统的产品。我发现来自奥德赛技术有限公司的Snorkel-TX是一种针对Web应用程序的全面和精心设计的安全解决方案。与许多其他解决方案相比，它具有成本效益。它可以在很短的时间内实现，而不会对web应用程序进行任何编码更改。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|entityMap^0^^$0|@$1|2|3|4|5|6|7|C|8|@]|9|@]|A|$]]]|B|$]]

As a consultant for authentication and authorisation solutions I have looked at several products using OTP, Biometrics and other challenge response systems. I find Snorkel-TX from Odyssey Technologies Limited, is a comprehensive and well engineered security solution for Web applications. It is cost effective compared to many other solutions. It can be implemented in a very short time without any coding changes to the web application.

blocks|key|3531822|text|我可以推荐LaunchKey，因为它们作为服务提供真正的多因素身份验证，它们的API和移动应用程序都是免费的。还应该注意的是，多因素认证结合了所有3种可能的因素类型(知识、占有、继承)，并且被认为比只使用3种中的2种的两种因素更安全。从安全的角度来看，您应该追求的是MFA而不是2FA。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|entityMap|0|LINK|mutability|MUTABLE|url|https://launchkey.com/^0|5|9|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@$A|L|B|M|1|N]]|C|$]]]|D|$E|$5|F|G|H|C|$I|J]]]]

Might I recommend <a href="https://launchkey.com" rel="nofollow">LaunchKey</a> as they provide true multi-factor authentication as a service and their API and mobile apps are all free. It should also be noted that multi-factor authentication combines all 3 possible auth factor types (knowledge, possession, inherence) and is considered more secure than two-factor which would only utilize 2 of the 3. From a security perspective, you should be pursuing MFA rather than 2FA.

My local bank uses a <a href="http://www.citibank.com.sg/gcb/otherservices/cbpre_2factor.htm" rel="nofollow">2 factor authentication</a> where customers key in password AND a One Time PIN delivered via SMS to mobile phone OR from a security token device.

I am doing a web startup in the ecommerce space. 

I already have implemented https for important pages like login. I have chosen a, shall we say, cost effective SSL CA that has the initials GD.

This may be in the future, but what is a cost effective solution for me to implement a 2 factor authentication like my local bank for my users?

Which vendor would provide a cost effective solution just like I approached GD for my SSL certs?

2 factor authentication - cost effective solution for a web startup

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我的本地银行使用2个因素认证，客户输入密码，并通过短信向手机或安全令牌设备发送一次PIN。我正在电子商务领域做一家网络创业公司。我已经为重要的页面(如登录)实现了https。我选择了一个，应该说，成本有效的SSL CA，它的首字母是GD。这可能是未来的事，但对于我来说，实现像本地银行这样的2要素认证对我的用户来说有什么成本效益的解决方案呢？哪个供应商会提供一个成本效益高的解决方案，就像我接近GD获

问2要素认证- web启动的成本效益解决方案
EN

回答 11

Security用户

Security用户

Security用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问2要素认证- web启动的成本效益解决方案EN

回答 11

Security用户

Security用户

Security用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问2要素认证- web启动的成本效益解决方案
EN