Android应用中安全密码策略与实现教程

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

public class PasswordService {

    private final BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();

    /**
     * 对原始密码进行哈希
     * @param rawPassword 用户的原始密码
     * @return 哈希后的密码字符串
     */
    public String hashPassword(String rawPassword) {
        return passwordEncoder.encode(rawPassword);
    }

    /**
     * 验证原始密码是否与存储的哈希密码匹配
     * @param rawPassword 用户输入的原始密码
     * @param encodedPassword 数据库中存储的哈希密码
     * @return 如果匹配则返回true，否则返回false
     */
    public boolean verifyPassword(String rawPassword, String encodedPassword) {
        return passwordEncoder.matches(rawPassword, encodedPassword);
    }

    public static void main(String[] args) {
        PasswordService service = new PasswordService();
        String userPassword = "MySecurePassword123!";

        // 1. 哈希密码
        String hashedPassword = service.hashPassword(userPassword);
        System.out.println("哈希后的密码: " + hashedPassword);
        // 每次哈希结果不同，但验证会通过，因为盐值是内置在哈希结果中的

        // 2. 验证密码
        boolean isMatch = service.verifyPassword(userPassword, hashedPassword);
        System.out.println("密码验证结果 (正确): " + isMatch);

        boolean isWrongMatch = service.verifyPassword("WrongPassword", hashedPassword);
        System.out.println("密码验证结果 (错误): " + isWrongMatch);
    }
}

import java.io.IOException;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Formatter;

public class HIBPChecker {

    // 计算SHA-1哈希值
    private static String sha1(String input) {
        try {
            MessageDigest crypt = MessageDigest.getInstance("SHA-1");
            crypt.reset();
            crypt.update(input.getBytes("UTF-8"));
            return byteToHex(crypt.digest());
        } catch (NoSuchAlgorithmException | IOException e) {
            throw new RuntimeException("SHA-1 hashing failed", e);
        }
    }

    private static String byteToHex(final byte[] hash) {
        Formatter formatter = new Formatter();
        for (byte b : hash) {
            formatter.format("%02x", b);
        }
        String result = formatter.toString();
        formatter.close();
        return result;
    }

    /**
     * 检查密码是否在HIBP数据库中泄露
     * @param password 待检查的原始密码
     * @return 如果密码被泄露，返回泄露次数；否则返回0
     * @throws IOException 网络请求错误
     * @throws InterruptedException 网络请求中断
     */
    public int checkPasswordWithHIBP(String password) throws IOException, InterruptedException {
        String sha1Hash = sha1(password).toUpperCase();
        String prefix = sha1Hash.substring(0, 5);
        String suffix = sha1Hash.substring(5);

        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create("https://api.pwnedpasswords.com/range/" + prefix))
                .GET()
                .build();

        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());

        if (response.statusCode() == 200) {
            String[] lines = response.body().split("\n");
            for (String line : lines) {
                String[] parts = line.split(":");
                if (parts.length == 2 && parts[0].equals(suffix)) {
                    return Integer.parseInt(parts[1].trim());
                }
            }
        }
        return 0;
    }

    public static void main(String[] args) throws IOException, InterruptedException {
        HIBPChecker checker = new HIBPChecker();
        String weakPassword = "password"; // 一个非常弱且可能已泄露的密码
        String strongPassword = "ThisIsAStrongAndUniquePassword123!";

        int weakCount = checker.checkPasswordWithHIBP(weakPassword);
        if (weakCount > 0) {
            System.out.println("密码 '" + weakPassword + "' 已被泄露 " + weakCount + " 次。请选择其他密码。");
        } else {
            System.out.println("密码 '" + weakPassword + "' 未发现泄露。");
        }

        int strongCount = checker.checkPasswordWithHIBP(strongPassword);
        if (strongCount > 0) {
            System.out.println("密码 '" + strongPassword + "' 已被泄露 " + strongCount + " 次。请选择其他密码。");
        } else {
            System.out.println("密码 '" + strongPassword + "' 未发现泄露。");
        }
    }
}

import android.util.Patterns;
import android.widget.EditText;
import android.widget.Toast;
import androidx.fragment.app.Fragment; // 假设在Fragment中使用

public class RegistrationFragment extends Fragment {

    // ... 其他UI组件和初始化

    private void validateInput(String email, String password, String name, String lastName, String age) {
        if (email.isEmpty() || password.isEmpty() || name.isEmpty() || lastName.isEmpty() || age.isEmpty()) {
            Toast.makeText(getActivity(), "请填写完整信息", Toast.LENGTH_SHORT).show();
            return;
        }

        if (!Patterns.EMAIL_ADDRESS.matcher(email).matches()) {
            // 假设有一个名为 emailEditText 的 EditText
            // emailEditText.setError("邮箱格式无效");
            // emailEditText.setFocusable(true);
            Toast.makeText(getActivity(), "邮箱格式无效", Toast.LENGTH_SHORT).show();
            return;
        }

        // 客户端仅做基本长度检查，提升用户体验
        // 核心密码强度和内容验证应在服务器端进行
        if (password.length() < 8) {
            // 假设有一个名为 passwordEditText 的 EditText
            // passwordEditText.setError("密码长度不能少于8位");
            // passwordEditText.setFocusable(true);
            Toast.makeText(getActivity(), "密码长度不能少于8位", Toast.LENGTH_SHORT).show();
            return;
        }

        // 如果客户端验证通过，则将数据发送到服务器进行进一步处理（注册或登录）
        // 例如：
        // registerUserOnServer(email, password, name, lastName, age);
        Toast.makeText(getActivity(), "客户端验证通过，准备发送至服务器", Toast.LENGTH_SHORT).show();
    }
}