Bao Mat Manclub: Nhung Lop Khien Thuc Su dung Sau Tai Khoan Cua Ban

Moi khi ai do hoi toi rang dieu gi quyet dinh do tin cay cua mot nen tang giai tri truc tuyen, toi thuong tra loi bang mot con so duy nhat: so lop bao ve ma nguoi dung khong nhin thay. Voi Manclub, cau chuyen Bao Mat Manclub khong nam o nhung dong quang cao hao nhoang, ma nam o cach he thong xu ly mot lan dang nhap, mot giao dich nap tien, hay mot cu nhap chuot luc 3 gio sang tu mot dia chi IP la. Bai viet nay mo xe tung lop do, theo cach mot nguoi lam ky thuat nhin nhan.

Truoc khi di vao chi tiet, can noi ro mot dieu: khong co he thong nao an toan tuyet doi. Cau hoi dung khong phai la "co bi tan cong duoc khong", ma la "khi bi tan cong, he thong phat hien trong bao lau va thiet hai dung o dau". do cung la cach Manclub dat bai toan Bao Mat Manclub ngay tu dau.

Lop dau tien nam o duong truyen

Toan bo ket noi giua thiet bi nguoi dung va may chu Manclub chay tren giao thuc TLS 1.3 voi khoa 256-bit, kem chung chi EV. Noi cach de hieu, du lieu roi khoi dien thoai cua ban duoi dang mot chuoi ky tu vo nghia va chi duoc giai ma khi cham toi may chu dich. Ke ca khi ai do ngoi cung mang Wi-Fi quan ca phe va chan duoc goi tin, ho cung chi thay mot mo nhieu. day la muc toi thieu ma bat ky nen tang nghiem tuc nao cung phai co, nhung diem khac biet cua Manclub la viec tu choi cac giao thuc cu. He thong chan hoan toan TLS 1.0 va 1.1, dong nghia voi viec nhung thiet bi qua cu khong the ket noi — mot su danh doi co chu dich giua tien loi va an toan.

Ve phia may chu, du lieu tinh nhu thong tin tai khoan, lich su giao dich va so du duoc ma hoa bang AES-256 truoc khi ghi xuong o dia. Khoa ma hoa duoc luan chuyen dinh ky 90 ngay va luu trong module bao mat phan cung tach biet voi may chu ung dung. Neu ai do co duoc ban sao cua o dia, ho van khong doc duoc gi.

Xac thuc hai lop khong phai de cho co

dang nhap vao Manclub yeu cau hai yeu to: mat khau va ma xac thuc. Ma OTP gom 6 chu so, co hieu luc trong 60 giay va chi dung duoc mot lan. Con so 60 khong phai tuy tien — do la khoang thoi gian du ngan de ke tan cong khong kip brute-force, nhung du dai de nguoi dung binh thuong thao tac thoai mai. He thong khoa tam thoi tai khoan sau 5 lan nhap sai lien tiep trong 10 phut, va ghi lai toan bo su kien nay vao nhat ky bao mat.

diem toi danh gia cao la Manclub khong dung OTP qua SMS lam phuong thuc mac dinh. SMS co lo hong SIM swap noi tieng, va o nhieu thi truong dong Nam a day van la kenh bi khai thac thuong xuyen. Thay vao do, he thong uu tien ung dung xac thuc theo chuan TOTP, von tao ma cuc bo tren thiet bi va khong phu thuoc vao nha mang. SMS van ton tai nhu phuong an du phong, nhung no nam o cuoi danh sach uu tien, khong phai dau.

Quan ly phien dang nhap va thiet bi

Mot trong nhung sai lam pho bien cua nguoi dung la dang nhap tren may tinh cong cong roi quen dang xuat. Manclub xu ly viec nay bang hai co che. Thu nhat, phien dang nhap mac dinh het han sau 30 phut khong hoat dong. Thu hai, muc "Thiet bi dang hoat dong" liet ke toan bo thiet bi, kem mo hinh may, he dieu hanh, vi tri uoc luong va thoi diem truy cap gan nhat. Chi voi mot cu nhap, nguoi dung co the dang xuat khoi moi thiet bi khac, ke ca thiet bi ma ho khong nhan ra.

Co lan mot nguoi quen cua toi nhan duoc canh bao dang nhap tu mot thanh pho cach 1.200 km. Anh ay vao kiem tra, thay phien la, bam dang xuat toan bo, doi mat khau va bat lai xac thuc hai lop trong vong chua day bon phut. Tai khoan khong mat mot dong. do la gia tri thuc te cua mot tinh nang ma nhieu nguoi bo qua.

Bao ve du lieu thanh toan

Du lieu the va tai khoan ngan hang la muc tieu so mot cua toi pham mang. Manclub khong luu so the day du tren he thong cua minh. Thong tin nhay cam duoc token hoa (tokenization), nghia la he thong chi giu mot chuoi dinh danh thay the, con du lieu goc nam o don vi xu ly thanh toan dat chuan PCI DSS. Ngay ca nhan vien van hanh co quyen truy cap co so du lieu cung khong the nhin thay so the cua ban.

Moi giao dich deu di kem kiem tra hai buoc: xac thuc mat khau giao dich va xac nhan OTP. He thong cung theo doi hanh vi bat thuong theo thuat toan cham diem rui ro. Vi du, mot tai khoan thuong nap 500.000 dong dot nhien yeu cau rut 50.000.000 dong vao luc 2 gio sang se bi dua vao hang cho xac minh thu cong. Quy trinh nay co the gay kho chiu, nhung no la ly do vi sao cac vu chiem doat tai khoan quy mo lon hiem khi xay ra o day.

Phat hien gian lan va chong tan cong tu dong

Phia sau giao dien nguoi dung la mot he thong giam sat chay lien tuc 24/7. He thong phan tich hon 40 tin hieu moi phien: dau van tay thiet bi, toc do nhap lieu, dia chi IP, mui gio, lich su hanh vi. Khi diem rui ro vuot nguong, phien bi tam dung va nguoi dung duoc yeu cau xac minh lai.

Ve phia ha tang, Manclub dung tuong lua ung dung web (WAF) de chan cac dot tan cong SQL injection, cross-site scripting va DDoS. Cac dot DDoS the tich lon duoc hap thu o lop bien nho mang phan phoi noi dung co kha nang chiu tai tren 1 Tbps. Voi brute-force, he thong ap dung gioi han tan suat theo IP va theo tai khoan, dong thoi dung CAPTCHA thich ung chi xuat hien khi co dau hieu bat thuong — khong lam phien nguoi dung binh thuong.

Nhung hieu lam thuong gap ve Bao Mat Manclub

Hieu lam thu nhat: bat xac thuc hai lop la du. Khong dung. Neu ban dung cung mot mat khau cho Manclub va muoi dich vu khac, ro ri tu mot dich vu nho cung du de mo cua tai khoan cua ban. Hay dung trinh quan ly mat khau va dat mat khau rieng biet, dai it nhat 12 ky tu.

Hieu lam thu hai: nhan vien Manclub co the xem mat khau cua toi. Cung khong dung. Mat khau duoc bam bang thuat toan bcrypt voi salt rieng cho tung tai khoan. Ngay ca khi toan bo co so du lieu bi lo, viec khoi phuc mat khau goc la bat kha thi ve mat tinh toan voi phan cung hien tai.

Hieu lam thu ba: cu co ma hoa la an toan. Ma hoa chi giai quyet bai toan tren duong truyen va khi luu tru. No khong ngan duoc ke lua dao thuyet phuc ban tu tay nhap OTP vao mot trang gia mao. day la ly do Manclub lien tuc canh bao nguoi dung kiem tra ten mien truoc khi dang nhap, va cam ket khong bao gio yeu cau OTP qua tin nhan, cuoc goi hay bat ky kenh nao khac.

Trach nhiem nam o ca hai phia

Bao Mat Manclub khong phai cau chuyen mot chieu. Nen tang xay tuong, nhung nguoi dung giu chia khoa. Ba thoi quen tao ra khac biet lon nhat: cap nhat ung dung ngay khi co ban va, khong dung Wi-Fi cong cong cho giao dich lon, va kiem tra muc thiet bi dang hoat dong moi tuan. Ca ba viec gop lai mat chua toi nam phut.

Ve phia Manclub, lo trinh duoc cong bo ro rang: mo rong ho tro khoa bao mat vat ly theo chuan FIDO2 trong nam toi, ap dung ma hoa dau cuoi cho phan chat ho tro, va dua toan bo nhat ky bao mat vao he thong phat hien xam nhap dua tren hoc may. day la nhung buoc di dung huong, phu hop voi tieu chuan ma cac to chuc tai chinh lon dang theo duoi.

Noi thang than, an toan thong tin la mot cuoc dua khong co vach dich. Ke tan cong co loi the vi chi can dung mot lan; nguoi phong thu phai dung moi lan. Voi cach Manclub xep lop phong ve — tu TLS 1.3, AES-256, tokenization, cho toi giam sat hanh vi 24/7 — nguoi dung co ly do chinh dang de yen tam. Nhung su yen tam do chi ben vung khi moi nguoi trong chung ta chiu bo ra vai phut moi tuan de tu kiem tra chinh minh. Bao mat, suy cho cung, la mot thoi quen chu khong phai mot nut bat.