guía sobre riesgos y buenas prácticas en autenticación online

Upload: inteco

Post on 04-Apr-2018

220 views

Category:

Documents


0 download

TRANSCRIPT

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    1/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ; gh ;Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Mxk zin~h ~ehzmiz u nxhfkz

    |~jwejkz hf kxwhfwejkjef ifbefh

    EFZWEWXWI FKJEIFKB GH WHJFIBIMKZ GHBK JIOXFEJKJEF

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    2/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk > gh >Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Hgejef0 Fitehon~h >

    Bk Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh ak zegi hbkni~kgk |i~ hb

    zemxehfwh h{xe|i gh w~knk`i ghb Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef !EFWHJI%0

    \knbi \~hp Zkf/@iz !ge~hjjef%

    Hgxk~gi btk~hp Kbifzi !jii~gefkjef%

    Zxzkfk gh bk Dxhfwh ^ig~mxhp

    J~ezwefk Mxwe~~hp Ni~mh

    Kzeoezoi" ak jifwkgi jif hb k|iui wjfeji gh Emfkjei Kbkoebbi !Kzw~hk Bk Efdi|ezwk @x~gejk% u

    ^ejk~g Ok~wfhp !Xfeth~zewkw gh Tkbfjek%

    Hb Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef !EFWHJI% hz xfk zijehgkg hzwkwkb

    kgzj~ewk kb Oefezwh~ei gh Efgxzw~ek" Hfh~mk u Wx~ezoi k w~ktz gh bk Zhj~hwk~k gh Hzwkgi gh

    Whbhjioxfejkjeifhz u |k~k bk Zijehgkg gh bk Efdi~okjef& Bk oezef gh EFWHJI hz ~hdi~pk~ bk

    jenh~zhmx~egkg" bk |~etkjegkg u bk jifdekfpk hf biz zh~tejeiz gh bk Zijehgkg gh bk Efdi~okjef"

    k|i~wkfgi tkbi~ k biz jexgkgkfiz" ho|~hzkz" KK&\\& u kb zhjwi~ WEJ" u jii~gefkfgi hzdxh~piz jif

    biz i~mkfezoiz fkjeifkbhz h efwh~fkjeifkbhz {xh w~knk`kf hf hzwk okwh~ek& Zx Inzh~tkwi~ei gh bk

    Zhmx~egkg gh bk Efdi~okjef !aww|0))inzh~tkwi~ei&efwhji&hz% wehfh jioi in`hweti ghzj~ene~" kfkbepk~"kzhzi~k~ u gedxfge~ bk jxbwx~k gh bk zhmx~egkg" bk |~etkjegkg u bk h/jifdekfpk&

    Bk ~hkbepkjef gh hzwh gijxohfwi zh ak defkfjekgi ghfw~i ghb |~iuhjwi ZH^\BKMI

    !Zh~tejeiz zin~h |bkwkdi~ok jbixg |k~k |~ijhziz ifbefh gh mineh~fi u kgoefezw~kjef

    hbhjw~fejiz% |i~ bk jiftijkwi~ek >

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    3/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk : gh :Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    ; EFW^IGXJJEF &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& 4> BK KXWHFWEJKJEF IFBEFH &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& 1

    >&; BIZ ^KZMIZ GH KXWHFWEJKJEF 1>&> DKJWI^HZ GH KXWHFWEJKJEF ;&: \^IJHZI GH ^HMEZW^I ;>>&7 \^IJHZI GH KXWHFWEJKJEF ;8

    : ^HMXBKJEF BHMKB GH BK KXWHFWEJKJEF GH BKEGHFWEGKG GEMEWKB &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& >>:&; HB ^HJIFIJEOEHFWI U KW^ENXJEF GH BK EGHFWEGKG >>:&> BK DE^OK HBHJW^FEJK >7:&: BIZ JH^WEDEJKGIZ GEMEWKBHZ >5:&7 HB GFE HBHJW^FEJI0 XF JKZI HZ\HJEKB :7:&8 BK EGHFWEDEJKJEF GEMEWKB D^HFWH K BK KGOEFEZW^KJEF :4

    7 ^EHZMIZ \K^K BK ZHMX^EGKG U BK \^ETKJEGKG &&&&&&&&&&&&&& :17&; \^EFJE\KBHZ H^^I^HZ :17&> ^EHZMIZ HF BIZ \^IJHZIZ GH KXWHFWEJKJEF :1

    8

    NXHFKZ \^JWEJKZ \K^K KGOEFEZW^KGI^HZ &&&&&&&&&&&&&&&&&& 7:

    8&; HBHJJEF KGHJXKGK GHB WE\I GH J^HGHFJEKB 7:8&> \^HTHFJEF D^HFWH K KWK[XHZ GH DXH^PK N^XWK 7:8&: ZEZWHOKZ ZHJXFGK^EIZ ZHMX^IZ 778&7 ^H[XEZEWI GH TH^EDEJKJEF GH EGHFWEGKG ^HKB 78

    8&8 HZWKNBHJH^ XFK NXHFK \IBWEJK GH HBHJJEF GHEGHFWEDEJKGI^HZ GH XZXK^EI 78

    fgejh

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    4/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 7 gh 7Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    8&4 HQEME^ JEH^WK JIO\BH@EGKG GH BKZ J^HGHFJEKBHZ 788&= JIO\^INKJEF GH J^HGHFJEKBHZ HF HB ^HMEZW^I 748&1 HZWKNBHJH^ OHGEGKZ GH ZHMX^EGKG KFWH JKONEIZ GHJ^HGHFJEKBHZ U IW^KZ OIGEDEJKJEIFHZ GH JKBKGI 748&5 EO\BEJKJEF GH WH^JH^IZ 748&;FI K\I^WK^ OZ EFDI^OKJEF GH BK GHNEGK ZIN^H BIZXZXK^EIZ 718&;:^H[XEZEWIZ BHMKBHZ 718&;7ZH^TEJEI OXBWE\BKWKDI^OK H EFWH^I\H^KNEBEGKG 758&;8KXWHFWEJKJEF NKZKGK HF JH^WEDEJKGIZ 75

    4 HQ\H^EHFJEKZ GH QEWI &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& 8

    = ^HJIOHFGKJEIFHZ \K^K BIZ XZXK^EIZ &&&&&&&&&&&&&&&&&&&&&&&&&& 87=&; XWEBEPK^ JIFW^KZHKZ INXZWKZ 87

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    5/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 8 gh 8Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    =&> FI JIO\K^WE^ FE \IFH^ KB KBJKFJH GH IW^IZ BKZJ^HGHFJEKBHZ 87=&: XWEBEPK^ GEDH^HFWHZ JIFW^KZHKZ \K^K JKGK ZH^TEJEI 88=&7 OIGEDEJK^ BKZ JIFW^KZHKZ HMXBK^OHFWH 88=&8 JIFDEMX^K^ KGHJXKGKOHFWH BKZ I\JEIFHZ GHZHMX^EGKG 88=&4 JIFWKJWK^ JIF HB KGOEFEZW^KGI^ HF JKZI GH EFJEGHFWH 88

    =&=

    MHZWEF ZHMX^K GH JH^WEDEJKGIZ 84

    =&1 XZK^ HB GFE HBHJW^FEJI \K^K DE^OK^ U \K^K W^OEWHZ 841 JIFJBXZEIFHZ &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& 8=5 MBIZK^EI &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& 4

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    6/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 4 gh 4Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    ; EFW^IGXJJEF

    Hf bk zijehgkg gh bk efdi~okjef fxhzw~k eghfwegkg jifzwewxuh xf hbhohfwi tkbeizi u

    oh~hjhgi~ gh |~iwhjjef `x~gejk& K bk ai~k gh ~hkbepk~ xfk jio|~k ifbefh" xf w~oewh

    kgoefezw~kweti k w~ktz gh Efwh~fhw i kb xwebepk~ bkz ~hghz zijekbhz" |i~ h`ho|bi" gez|ifh~ ghxfk eghfwegkg u |igh~ h`h~jh~ xf jifw~ib ~hkb zin~h zxz gezwefwiz kw~enxwiz jifzwewxuh xf

    hbhohfwi hzhfjekb |k~k mk~kfwepk~ fxhzw~iz gh~hjaiz& Oz kf" k ohgegk {xh bk

    htibxjef gh bkz whjfibimkz gh bk efdi~okjef mhfh~h fxhtiz |~igxjwiz u zh~tejeiz" bk

    mhzwef gh bk eghfwegkg hf hb hfwi~fi ifbefh zh jifth~we~ hf xf kz|hjwi j~weji u" |i~

    wkfwi" hb |~ijhzi gh kxwhfwejkjef gh bk oezok zh~ jkgk thp oz eo|i~wkfwh&

    Hb ~hjifijeoehfwi u bk jifde~okjef gh bk eghfwegkg gh biz xzxk~eiz hz xfk gh bkz wk~hkz

    oz hqwhfgegkz u fhjhzk~ekz hf bk |~hzwkjef gh zh~tejeiz u bk kxwi~epkjef gh kjjhziz&

    Hb in`hweti gh hzwkz wk~hkz hz {xh wkfwi biz zh~tejeiz jioi hb kjjhzi zibkohfwh |xhgkfzh~ xwebepkgiz |i~ biz bhmweoiz xzxk~eiz&

    Hb ghzk~~ibbi gh bk Zijehgkg gh bk Efdi~okjef u bk |~hzwkjef gh zh~tejeiz ifbefh akf

    w~kzbkgkgi hzwk fhjhzegkg ghb oxfgi iddbefh kb oxfgi ifbefh& Hzwi zh ghnh k {xh wkfwi

    biz zh~tejeiz }hn jioi bkz jxhfwkz u |h~debhz hf hbbiz wehfhf xf wewxbk~" {xh hz bk |h~zifk

    kxwi~epkgk |k~k kjjhgh~ k zx efdi~okjef u kjwxk~ k w~ktz gh hbbiz&

    Kfwh hzwk zewxkjef" ghzgh biz efejeiz gh Efwh~fhw zx~mh bk fhjhzegkg gh ~hzw~efme~ biz

    kjjhziz u gh jio|~ink~ {xh bkz |h~zifkz {xh zh jioxfejkf k w~ktz gh hzwh jkfkb zif

    ~hkbohfwh {xehfhz gejhf zh~& Hzwk jio|~inkjef hz gh hz|hjekb eo|i~wkfjek hf

    ghwh~oefkgiz jkziz" wkbhz jioi0

    Kgoefezw~kjef hbhjw~fejk& Hz oxu eo|i~wkfwh {xh jxkb{xeh~ we|i gh ~hbkjef jif

    bkz Kgoefezw~kjeifhz \nbejkz zh bbhth k jkni hqjbxzetkohfwh |i~ |k~wh gh bkz

    |h~zifkz {xh wehfhf gh~hjai k kjjhgh~ k bk efdi~okjef u |i~ biz |~i|eiz

    efwh~hzkgiz i zxz ~h|~hzhfwkfwhz bhmkbhz& Hzwh ~h{xh~eoehfwi hz wkf eo|i~wkfwh hf

    bkz ~hbkjeifhz |~hzhfjekbhz jioi hf bkz ~hbkjeifhz k w~ktz gh bkz fxhtkz

    whjfibimkz&

    Nkfjk ifbefh u jioh~jei hbhjw~feji& Hb kjjhzi k jxhfwkz nkfjk~ekz u bk

    |izenebegkg ~hkbepk~ w~kfzkjjeifhz hjifoejkz hqemh {xh zibkohfwh |xhgkf zh~

    bbhtkgkz k jkni |i~ bkz |h~zifkz jif bk kxwi~epkjef fhjhzk~ek |k~k hbbi& Ghb

    oezoi oigi" hzwk jio|~inkjef gh bk eghfwegkg gh {xehf tk k ~hkbepk~ hzwkz

    i|h~kjeifhz zh ghnh bbhtk~ k jkni wkonef jxkfgi hb ohgei xwebepkgi hz Efwh~fhw&

    De~ok gh gijxohfwiz& Wkonef zh ghnh kzhmx~k~ bk eghfwegkg gh {xehf de~ok xf

    gijxohfwi" wkfwi hf hb jkzi gh fhjhzewk~zh jio|~ink~ bk kxwi~k gh xf

    gijxohfwi jioi hf hb gh bk de~ok gh gijxohfwiz {xh zx|ifmkf kjxh~giztefjxbkfwhz i jifw~kwiz&

    ;&Efw~igxjjef

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    7/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk = gh =Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Kjjhzi k zh~tejeiz i hz|kjeiz }hn ~hzw~efmegiz& Hzwh hz hb jkzi gh bk okui~ |k~wh

    gh xziz gh Efwh~fhw" uk zh w~kwh ghb kjjhzi k jxhfwkz gh ji~~hi hbhjw~feji"

    |h~debhz hf ~hghz zijekbhz i jxkb{xeh~ iw~i zh~tejei& Gh fxhti" hzwh kjjhzi ghnh

    zh~ kxwi~epkgi fejkohfwh k bkz |h~zifkz {xh whfmkf |h~oezi |k~k hbbi" whfehfgi

    |i~ wkfwi {xh jio|~ink~zh zx eghfwegkg&

    Hf hzwiz u iw~iz jkziz" kb zh~ fhjhzk~ek bk jio|~inkjef gh bk eghfwegkg u gh zxz

    |h~oeziz" zh hzwknbhjhf gedh~hfwhz ohjkfezoiz gh kxwhfwejkjef {xh |h~oewhf jifde~ok~

    {xh bk |h~zifk {xh w~kwk gh ~hkbepk~ ghwh~oefkgkz kjjeifhz hz ~hkbohfwh bk kxwi~epkgk

    |k~k hbbi& Bk eo|i~wkfjek gh hzwiz ohjkfezoiz zh efj~hohfwk jifzwkfwhohfwh k ohgegk

    {xh ktkfpk bk eo|bkfwkjef u ghzk~~ibbi gh bk Zijehgkg gh bk Efdi~okjef" uk {xh biz

    jexgkgkfiz xwebepkf oz zh~tejeiz ifbefh u kbokjhfkf oz efdi~okjef hf gedh~hfwhz

    |h~debhz u jxhfwkz hf Efwh~fhw&

    \i~ hbbi" EFWHJI ak hbkni~kgi hzwk Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf

    kxwhfwejkjef ifbefh" jif hb |~i|zewi gh k|i~wk~ efdi~okjef gh xwebegkg {xh kuxgh k

    {xh hzwiz ohjkfezoiz gh eghfwedejkjef u th~edejkjef gh bk eghfwegkg hf Efwh~fhw zh

    eo|bkfwhf ji~~hjwkohfwh u zh xwebejhf gh oigi {xh jxo|bkf jif zx dxfjef ~hz|hwkfgi

    biz gh~hjaiz gh biz eo|bejkgiz&

    Hf hbbk zh hq|ifhf bkz jk~kjwh~zwejkz u biz kz|hjwiz k whfh~ hf jxhfwk ~hz|hjwi k biz

    |~ijhziz gh eghfwedejkjef u th~edejkjef" zxz gedh~hfwhz we|iz hf dxfjef k geth~ziz

    kz|hjwiz u bkz eo|bejkjeifhz bhmkbhz k jifzegh~k~& Kb oezoi weho|i" zh ghwh~oefkf jxbhz

    zif biz |~efje|kbhz ~ehzmiz u kohfkpkz hf ~hbkjef k hzwiz |~ijhziz u xfk zh~eh gh

    nxhfkz |~jwejkz u ~hjiohfgkjeifhz {xh kuxghf k biz xzxk~eiz u k biz ghzk~~ibbkgi~hz k

    htewk~biz&

    Hf wigi oiohfwi zh xwebepk hb w~oefi kxwhfwejkjef |k~k kz hfmbink~ giz |izenebegkghz

    gedh~hfwhz0 bk eghfwedejkjef !hb zezwhok ~hjifijh kb xzxk~ei u zx eghfwegkg% u bk th~edejkjef

    !hb zezwhok jifde~ok {xh hb xzxk~ei hz {xehf gejh zh~%& K |hzk~ gh hbbi" hz aknewxkb {xh zh

    xwebejh hb w~oefi eghfwedejkjef jioi zeffeoi gh kxwhfwejkjef" hfmbinkfgi bkz giz

    |izenebegkghz ohfjeifkgkz u ~hde~efgizh |i~ bi mhfh~kb k bk th~edejkjef" uk {xh hz hbjkzi oz aknewxkb&

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    8/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 1 gh 1Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    > BK KXWHFWEJKJEF IFBEFH

    Zef gxgk bk kxwhfwejkjef hz xfi gh biz |~efje|kbhz hbhohfwiz zin~h biz {xh zh kzehfwk

    Efwh~fhw u hz xfk |ehpk efgez|hfzknbh |k~k hb ghzk~~ibbi gh biz zh~tejeiz gh bk Zijehgkg gh

    bk Efdi~okjef& Nzejkohfwh jifzezwh hf jifzwkwk~ {xh {xehf w~kwk gh kjjhgh~ kghwh~oefkgk efdi~okjef i zh~tejeiz hz {xehf gejh zh~ u hzw bhmeweokgi |k~k hbbi& Biz

    |~ijhziz gh ~hmezw~i u kxwhfwejkjef mk~kfwepkf bk |~etkjegkg u hb kjjhzi hqjbxzeti k

    ghwh~oefkgiz zh~tejeiz h efdi~okjeifhz&

    K |hzk~ gh {xh hb ~hmezw~i u bk kxwhfwejkjef zif biz giz oiohfwiz jbkth |k~k hb kjjhzi

    gh biz xzxk~eiz k biz gedh~hfwhz xziz u zh~tejeiz ifbefh" hz fhjhzk~ei ~hji~gk~ {xh hqezwh

    iw~i |~ijhzi hzhfjekb" bk jifhqef hfw~h hb gez|izeweti {xh xwebepk hb xzxk~ei u biz

    zh~tegi~hz hf biz {xh zh hfjxhfw~k bk efdi~okjef k bk {xh {xeh~h kjjhgh~& \i~ hbbi" hz

    fhjhzk~ei jifijh~ efejekbohfwh jxbhz zif biz |kziz {xh zh zemxhf kb hzwknbhjh~ xfkjifhqef u joi zh jifde~ok {xh bk jifhqef zh bbhtk k jkni gh xf oigi zhmx~i&

    >&; BIZ ^KZMIZ GH KXWHFWEJKJEF

    Hb ho|bhi gh bkz whjfibimkz gh jioxfejkjef hbhjw~fejk {xh zi|i~wkf Efwh~fhw ~h{xeh~h

    gh efdi~okjeifhz {xh jifzwewxuhf ~kzmiz eghfwedejkgi~hz {xh |h~oewhf bk w~kpknebegkg gh

    biz xzxk~eiz" hz ghje~" hb zhmxeoehfwi ghb xzxk~ei k bi bk~mi gh gedh~hfwhz |kziz"

    ~hmezw~fgizh wigkz zxz kjjeifhz kb weho|i {xh zh jifde~ok {xh zh w~kwk ghb oezoi

    xzxk~ei" i kb ohfiz {xh bk jifhqef zh ~hkbepk jifwefxkohfwh ghzgh hb oezoi gez|izeweti&

    Kz" hzwiz hbhohfwiz fi zibi zh ~hdeh~hf kb |~i|ei xzxk~ei" uk {xh kb ~hkbepk~ jifhqeifhz

    hf Efwh~fhw hz fhjhzk~ei wkfwi kzhmx~k~ {xh hb xzxk~ei {xh kjjhgh wehfh |h~oeziz |k~k

    hbbi jioi hzwknbhjh~ xfk zh~eh gh bfhkz gh jioxfejkjef zhkbkfgi biz gez|izewetiz k

    jifhjwk~ u biz |xfwiz gh jifhqef hqkjwiz hf gedh~hfwhz fethbhz;0

    ; Xfk hq|bejkjef oz zeo|bh zin~h hb hzwknbhjeoehfwi gh jifhqeifhz hf Efwh~fhw u zx |~iwhjjef zh hfjxhfw~k hf hbk~wjxbi ghb Jxkgh~fi gh Fiwkz Ji~wkdxhmiz !de~h}kbbz%0 [x zif u |k~k {x ze~thf" gez|ifenbh hf0aww|0))}}}&efwhji&hz)Zhmx~egkg)Inzh~tkwi~ei)K~wejxbiz)XGYJi~wkdxhmiz&

    >&Bk kxwhfwejkjef ifbefh

    http://www.inteco.es/Seguridad/Observatorio/Articulos/UD_Cortafuegoshttp://www.inteco.es/Seguridad/Observatorio/Articulos/UD_Cortafuegoshttp://www.inteco.es/Seguridad/Observatorio/Articulos/UD_Cortafuegos
  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    9/64

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    10/64

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    11/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;; gh ;;Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Gh di~ok ~hzegxkb" u aknewxkbohfwh jioi xf ohjkfezoi gh kxwhfwejkjef gh hoh~mhfjek

    jxkfgi hqezwhf |~inbhokz kb xwebepk~ biz |~ijhgeoehfwiz |~efje|kbhz" zh ~hkbepkf

    ghwh~oefkgkz |~hmxfwkz jxukz ~hz|xhzwkz hzwf |~h/hzwknbhjegkz |i~ hb xzxk~ei& Kz" |i~

    h`ho|bi" hf jkzi gh {xh fi zhk |izenbh hb xzi ghb zezwhok |~efje|kb" zh |xhghf xwebepk~

    |~hmxfwkz |h~zifkbhz zin~h hb bhmweoi xzxk~ei" jioi jxb hz hb fion~h gh zx |~eoh~k

    okzjiwk i hb ghb jibhmei hf hb {xh hzwxge&

    Kbmxfiz zh~tejeiz |h~oewhf ohjkfezoiz gh kxwhfwejkjef oz zidezwejkgiz3 |i~ h`ho|bi"

    kjwxkbohfwh bkz ~hghz zijekbhz |xhghf ji~~ini~k~ bk eghfwegkg gh xf xzxk~ei oizw~fgibh

    eomhfhz gh zxz jifwkjwiz |k~k {xh zhkbh {xefhz zif hzkz |h~zifkz&

    Ghnegi k bk fhjhzegkg gh {xh hzwiz jifijeoehfwiz fejkohfwh |xhgkf zh~ ghoizw~kgiz

    |i~ hb bhmweoi xzxk~ei" kbmxfiz gh hzwiz ohjkfezoiz fi zh hzwf xwebepkfgiokzetkohfwh" kb w~kwk~zh gh efdi~okjef {xh |ig~k jifijh~ xfk |h~zifk jh~jkfk kb

    oezoi& Hz |i~ hbbi {xh |~hgioefk jbk~kohfwh hb xzi gh jifw~kzhkz&

    >&>&> \izhzef

    Hb zhmxfgi dkjwi~ {xh zh |xhgh xwebepk~ hf biz |~ijhziz gh kxwhfwejkjef hz bk |izhzef

    gh gedh~hfwhz hbhohfwiz& Ze nehf hb oz xwebepkgi hz bk |izhzef gh wk~`hwkz efwhbemhfwhz u"

    hf |k~wejxbk~" wk~`hwkz j~e|wim~dejkz1" fi inzwkfwh" hz ~hbkwetkohfwh zhfjebbi jifth~we~ xf

    zeo|bh gez|izeweti gh kbokjhfkoehfwi !ohoi~ek XZN% hf xfk bbkth 5 xwebepkfgi jeh~wkz

    k|bejkjeifhz efdi~owejkz&

    Gh hzwh oigi" hb xzxk~ei ghnh xwebepk~ xf gez|izeweti {xh hb zezwhok ~hjifijh~ |k~k

    kj~hgewk~ zx eghfwegkg& Bkz fhjhzegkghz ~hz|hjwi k hzwh zezwhok zh jhfw~kf hf {xh hb

    xzxk~ei zh kzhmx~h gh {xh fkgeh |xhgk kjjhgh~ k gejai gez|izeweti& Intekohfwh"

    wkonef hz xf ~h{xezewi efgez|hfzknbh {xh hb xzxk~ei whfmk hb gez|izeweti jifzemi zeho|~h

    {xh {xeh~k xwebepk~ hb zezwhok&

    Hf Hz|kk hb GFE hbhjw~feji hz hb gez|izeweti gh kxwhfwejkjef hbhjw~fejk oz

    hqwhfgegi" uk {xh kjwxkbohfwh bi |izhhf oz gh :< oebbifhz gh hz|kibhz u |xhgh zh~

    xwebepkgi jif hzwiz defhz hf gedh~hfwhz zh~tejeiz" hz|hjekbohfwh hf bkz ~hbkjeifhzhbhjw~fejkz jif bkz Kgoefezw~kjeifhz \nbejkz;&>&: Neiohw~k

    Hb wh~jh~ dkjwi~ xwebepkgi zh jhfw~k hf joi hz hb xzxk~ei h efjbxzi hf joi kjwk" zh w~kwk

    gh bk neiohw~k;;& Hzwiz zezwhokz xwebepkf biz ~kzmiz dzejiz i gh jio|i~wkoehfwi ghb

    1 Hzwkz wk~`hwkz |xhghf |~igxje~ j~hghfjekbhz oxu zhmx~kz" kz jioi de~okz gemewkbhz&5aww|0))newhbek&jio)>);

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    12/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;> gh ;>Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    xzxk~ei |k~k jifde~ok~ zx eghfwegkg" kb jifzegh~k~zh {xh gejaiz ~kzmiz zif" hf nxhfk

    ohgegk" fejiz |k~k jkgk |h~zifk h efeoewknbhz&

    Hqezwh m~kf tk~ehgkg gh wjfejkz neiow~ejkz" ghzgh biz kfbezez oz jifijegiz gh axhbbkgkjwebk~" e~ez i tip akzwk wjfejkz oz fithgizkz jioi hb hzjkfhi gh bkz thfkz gh bk

    okfi i bk jkghfjek gh bk hzj~ewx~k hf xf whjbkgi&

    Ghnegi k gedh~hfwhz jkxzkz" hzwkz wjfejkz gh kxwhfwejkjef wigktk zif oxu |iji

    xwebepkgkz hf biz |~ijhziz ifbefh" ghzweffgizh hz|hjekbohfwh kb kjjhzi dzeji k

    efzwkbkjeifhz&

    >&>&7 Oxbwe/dkjwi~

    Ze nehf biz w~hz dkjwi~hz hq|xhzwiz zif biz oz aknewxkbhz" hz |izenbh {xh zh hzwknbhpjkfzezwhokz hf biz {xh zh xwebejh xfk jionefkjef gh giz gh hbbiz h efjbxzi gh biz w~hz& Zh

    ghdefh jioi kxwhfwejkjef nkzkgk hf ginbh dkjwi~ i oxbwe/dkjwi~" u |i~ bi mhfh~kb efjbxuh

    zeho|~h hb dkjwi~ jifijeoehfwi& Kz" hz |iji aknewxkb {xh xf zezwhok gh kxwhfwejkjef zh

    jhfw~h hf bk |izhzef gh hbhohfwiz dzejiz i hf bk neiohw~k zef efjbxe~ xf zezwhok gh

    jifw~kzhkz&

    Hb xzi gh zezwhokz oxbwe/dkjwi~ kxohfwk jifzegh~knbhohfwh biz fethbhz gh zhmx~egkg&

    >&: \^IJHZI GH ^HMEZW^I

    Xfk thp {xh zh ak ghwh~oefkgi hb we|i gh efdi~okjef {xh zh xwebepk~ jioi j~hghfjekb gh

    kxwhfwejkjef" zh ghnh jifj~hwk~ hqkjwkohfwh jxb zh~ hzk j~hghfjekb& Hzwi zh

    hzwknbhjh hf hb |~ijhzi gh ~hmezw~i" hz ghje~" jxkfgi hb xzxk~ei hz efzj~ewi jioi xzxk~ei

    bhmweoi |i~ |~eoh~k thp hf hb zezwhok& K |hzk~ gh hbbi" aknewxkbohfwh hzwk ghwh~oefkjef

    fi hz ghdefewetk fe eftk~eknbh" uk {xh zh zxhbh gh`k~ kneh~wk bk |izenebegkg gh oigedejkjef u

    hf oxjaiz jkziz hz ~hjiohfgknbh {xh hzwk oigedejkjef zh ~hkbejh gh di~ok ~hmxbk~ ;>&

    >&:&; Hbhjjef gh j~hghfjekbhz

    Biz owigiz gh kxwhfwejkjef fi~okbohfwh zif ghjegegiz |i~ hb |~ithhgi~ gh zh~tejeiz i

    hb j~hkgi~ gh bkz k|bejkjeifhz xwebepkgkz hf hb |~ijhzi" |h~i bk ghwh~oefkjef gh bkefdi~okjef i j~hghfjekb hqkjwk |xhgh zh~ bbhtkgk k jkni |i~ gedh~hfwhz kjwi~hz&

    J~hghfjekbhz gh |~eoh~k |k~wh

    Bkz j~hghfjekbhz gh |~eoh~k |k~wh zif k{xhbbkz {xh hb xzxk~ei zh kzemfk k z oezoi& Gh

    hzwh oigi" bk |h~zifk ~hmezw~kgk u hb |~ithhgi~ gh j~hghfjekbhz gh eghfwegkg jiefjeghf&

    Hzwk hbhjjef zh ~hkbepk ben~hohfwh ghfw~i gh xfkz fi~okz ofeokz hqemegkz |i~ hb

    |~ithhgi~ gh zh~tejeiz i |i~ hb kgoefezw~kgi~ ghb zezwhok gh kxwhfwejkjef&

    ;> Hf jifj~hwi" hf hb jkzi gh bkz j~hghfjekbhz jifzezwhfwhz hf jifw~kzhkz hzwwejkz& Hf kbmxfiz jkziz" hzwh |~ijhgeoehfwigh jkonei gh jifw~kzhk hz bhmkbohfwh hqemenbh&

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    13/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;: gh ;:Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Hb oz jbk~i h`ho|bi gh hzwh we|i gh j~hghfjekbhz zif biz fion~hz gh xzxk~ei u

    jifw~kzhkz {xh zh hzwknbhjhf kb kn~e~ xfk jxhfwk gh ji~~hi hbhjw~feji i xf |h~deb hf

    ~hghz zijekbhz& Hb |~i|ei xzxk~ei ghjegh koniz hbhohfwiz jif bkz |izenbhz ~hzw~ejjeifhz

    hf jxkfwi k fi |igh~ xwebepk~ xf fion~h gh xzxk~ei uk hqezwhfwh i bkz hqemhfjekz ghbifmewxg u jio|bh`egkg gh bkz jifw~kzhkz |k~k hzwknbhjh~ xfiz fethbhz ofeoiz gh

    zhmx~egkg&

    J~hghfjekbhz gh zhmxfgk |k~wh

    Hzwkz j~hghfjekbhz zif k{xhbbkz {xh zif eo|xhzwkz |i~ hb |~ithhgi~ gh zh~tejeiz i |i~ hb

    kgoefezw~kgi~ ghb zezwhok gh kxwhfwejkjef& Hf hzwh jkzi" hb xzxk~ei fi wehfh jk|kjegkg

    gh hbhjjef&

    H`ho|biz gh hzwh we|i gh j~hghfjekbhz zif biz gez|izewetiz dzejiz gh eghfwedejkjef" jioi

    wk~`hwkz gh jii~ghfkgkz i wichfz" {xh hb |~ithhgi~ gh zh~tejeiz zxoefezw~h k zxz jbehfwhz|k~k zx kxwhfwejkjef& Hf hzwiz jkziz hb xzxk~ei fi jxhfwk jif jk|kjegkg gh ghjezef i

    oigedejkjef gh hzwiz gez|izewetiz&

    Ze nehf hb fion~h gh xzxk~ei zh |xhgh jifzegh~k~ jioi |k~wh gh bkz j~hghfjekbhz gh

    kxwhfwejkjef u zwh hf kbmxfkz ijkzeifhz hz eo|xhzwi kb xzxk~ei zhmf xfk |ibwejk |k~k

    zx j~hkjef" hf oxjaiz gh hzwiz jkziz hb xzxk~ei jxhfwk jif bk |izenebegkg gh

    oigedejkjef gh iw~k |k~wh gh bkz j~hghfjekbhz jioi zif bkz jifw~kzhkz& Hf hziz jkziz

    zh |ig~k w~kwk~ gh xfk zewxkjef efwh~ohgek hfw~h bkz j~hghfjekbhz gh |~eoh~k |k~wh u gh

    zhmxfgk |k~wh&

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    14/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;7 gh ;7Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    J~hghfjekbhz gh wh~jh~k |k~wh

    Bkz j~hghfjekbhz gh wh~jh~k |k~wh zif k{xhbbkz {xh fi zif ghwh~oefkgkz |i~ biz xzxk~eiz

    |h~i wko|iji |i~ hb |~ithhgi~ gh zh~tejeiz i hb kgoefezw~kgi~ ghb zezwhok ghkxwhfwejkjef {xh bkz tk k xwebepk~& Hf zx bxmk~" hzwkz j~hghfjekbhz zif ghwh~oefkgkz |i~

    xf |~ithhgi~ gh j~hghfjekbhz |k~k zx xzi hf bkz ~hbkjeifhz ghb xzxk~ei jif iw~kz

    |h~zifkz u i~mkfepkjeifhz gedh~hfwhz k gejai |~ithhgi~&

    Zh w~kwk gh bk efwh~ohgekjef gh xf wh~jh~i {xh iwi~mk kb xzxk~ei xfkz j~hghfjekbhz {xh

    |ig~ xzk~ hf iw~kz zewxkjeifhz u hf ~hbkjeifhz hf bkz {xh hzwh |~ithhgi~ gh

    j~hghfjekbhz fi zh th~ eo|bejkgi ge~hjwkohfwh&

    Hb |~efje|kb h`ho|bi gh hzwh we|i gh j~hghfjekbhz hz hb GFE hbhjw~feji" uk {xh zh w~kwk gh

    xf gijxohfwi kj~hgewkweti hzwknbhjegi |i~ xf |~ithhgi~ gh j~hghfjekbhz !hb Oefezwh~ei ghbEfwh~ei~ hf hzwh jkzi% |k~k zx xwebepkjef |i~ |k~wh ghb xzxk~ei |k~k |igh~ kwhzwemxk~ zx

    eghfwegkg d~hfwh k iw~iz kmhfwhz" zhkf zwiz |k~wejxbk~hz" ho|~hzkz" i~mkfepkjeifhz x

    iw~iz i~mkfezoiz gh bkz Kgoefezw~kjeifhz \nbejkz&

    >&:&> Ji~~hz|ifghfjek hfw~h eghfwegkg ~hkb h eghfwegkg gemewkb

    Kghoz gh bk hbhjjef gh bkz j~hghfjekbhz" hf hb |~ijhzi gh ~hmezw~i zh |bkfwhk xfk

    zewxkjef gh okui~ ~hbhtkfjek" bk jio|~inkjef gh {xh {xehf hzwknbhjh hb ~hmezw~i hz

    ~hkbohfwh {xehf gejh zh~& Hz ghje~" xf |~ijhzi gh th~edejkjef |~htei&

    Hzwk kjwxkjef zh |xhgh bbhtk~ k jkni gh gedh~hfwhz oigiz" |xgehfgi zx|ifh~ jkgk xfi

    xf okui~ i ohfi~ fethb gh jio|~inkjef gh hzwk ji~~hz|ifghfjek& K jifwefxkjef zh

    |~hzhfwkf kbmxfiz gh biz owigiz gh jio|~inkjef oz xwebepkgiz hf bk kjwxkbegkg&

    \h~deb i jxhfwk |~htekohfwh j~hkgk

    Xfi gh biz ohjkfezoiz oz xwebepkgiz hz hb xzi gh xfk jxhfwk uk j~hkgk hf iw~iz

    zh~tejeiz ifbefh" aknewxkbohfwh gh ji~~hi hbhjw~feji kxf{xh kjwxkbohfwh wkonef zh

    xwebepkf bkz jxhfwkz i |h~debhz hf ~hghz zijekbhz& Gh hzwh oigi" zh |xhgh hftek~ xf hfbkjh

    gh jio|~inkjef k bk jxhfwk gh ji~~hi {xh hb xzxk~ei efge{xh u hf jkzi gh {xh hzh

    hfbkjh zhk xwebepkgi zh hfwehfgh {xh hb xzxk~ei {xh zh ~hmezw~k hz wkonef hb bhmweoixzxk~ei gh hzk jxhfwk |~htek&

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    15/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;8 gh ;8Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Hf hzwiz jkziz fi zh |xhgh jifzegh~k~ {xh zh ~hkbejh xfk jio|~inkjef gh bk

    ji~~hz|ifghfjek hfw~h bk eghfwegkg ~hkb u bk eghfwegkg gemewkb" hz ghje~" fi zh hzw

    jio|~inkfgi {xh bk |h~zifk {xh zh hzw ~hmezw~kfgi hf hb zezwhok zhk ~hkbohfwh {xehf

    gejh zh~" zefi {xh fejkohfwh zh hzwf tefjxbkfgi hfw~h z gedh~hfwhz jxhfwkz hf gezwefwiz

    zh~tejeiz&

    Jio|~inkjef |~hzhfjekb

    Hf hzwh jkzi" hf kbmf oiohfwi ghb ~hmezw~i hz fhjhzk~ei {xh bk |h~zifk {xh zh hzw

    gkfgi gh kbwk hf hb zezwhok kjxgk k xf bxmk~ hf hb {xh zh jio|~ink~ zx eghfwegkg&

    H`ho|bi gh hzwk di~ok gh jio|~inkjef hz bk k|h~wx~k gh xfk jxhfwk gh nkfjk

    hbhjw~fejk" uk {xh aknewxkbohfwh zh ~hkbepk k |k~we~ gh xfk jxhfwk nkfjk~ek w~kgejeifkb"

    zehfgi fhjhzk~ei kjxge~ k xfk zxjx~zkb nkfjk~ek kb ohfiz |k~k zibejewk~ hb kjjhzi ifbefhu {xh zh bh hfw~hmxhf hf |h~zifk zxz j~hghfjekbhz&

    Xwebepkjef gh jh~wedejkjeifhz

    Hb wh~jh~ owigi gh jio|~inkjef gh hzwk ji~~hz|ifghfjek hz hb xzi gh jeh~wkz

    kj~hgewkjeifhz jioi hb GFEh {xh kwhzwemxkf bk eghfwegkg gh xfk |h~zifk& Gh hzwh oigi"

    u ghnegi k {xh hb GFE hz xf gijxohfwi idejekb" |h~zifkb h efw~kfzdh~enbh" gh jxui xzi hz

    ~hz|ifzknbh zx wewxbk~" zh |xhgh bbhmk~ k ~hkbepk~ xfk jio|~inkjef hdhjwetk zef fhjhzegkg

    gh kjxge~ dzejkohfwh k fefmf bxmk~ |k~k jio|bhwk~ hb |~ijhzi gh ~hmezw~i&

    >&7 \^IJHZI GH KXWHFWEJKJEF

    Xfk thp {xh hb xzxk~ei ak ~hkbepkgi hb ~hmezw~i efejekb hf xf zezwhok" hb kgoefezw~kgi~ gh

    gejai zezwhok ~h{xh~e~ kj~hgewk~ zx eghfwegkg jxkfgi {xeh~k kjjhgh~ kb oezoi& Gh hzwh

    oigi zh htewk {xh |h~zifkz fi kxwi~epkgkz kjjhgkf k hzwiz zh~tejeiz i {xh kbmxehf

    |xhgk akjh~zh |kzk~ |i~ xf xzxk~ei bhmweoi zx|bkfwkfgi zx eghfwegkg& Hz bi {xh zh

    ghfioefk kxwhfwejkjef&

    Bk kxwhfwejkjef |xhgh ~hkbepk~zh gh giz oigiz gezwefwiz" bk th~edejkjef u bk

    eghfwedejkjef" hf dxfjef gh bk efdi~okjef {xh whfmk {xh k|i~wk~ hb xzxk~ei&

    >&7&; Th~edejkjef

    Zh w~kwk ghb |~ijhgeoehfwi oz aknewxkb& Hf b" bk |h~zifk {xh {xeh~h kjjhgh~ kb zezwhok

    ghnh zhkbk~ {x xzxk~ei ~hmezw~kgi hz !ohgekfwh xf fion~h gh xzxk~ei" xfk jxhfwk gh

    ji~~hi hbhjw~feji i hb owigi {xh zh ghwh~oefkzh hf hb ~hmezw~i% u |~hzhfwk~ zxz

    j~hghfjekbhz gh kjjhzi !jifw~kzhk" hbhohfwi dzeji i ~kzmi |h~zifkb%& Gejai gh iw~i

    oigi" hb xzxk~ei efgejk {xef hz u bi ghoxhzw~k gh bk di~ok hzwknbhjegk&

    Kz" hb zezwhok fejkohfwh ghnh th~edejk~ {xh koniz hbhohfwiz jiefjeghf hf zxz nkzhz

    gh gkwiz" hz ghje~" {xh bkz j~hghfjekbhz gh kjjhzi |~hzhfwkgkz zif bkz oezokz {xh zh

    akf ~hmezw~kgi |~htekohfwh |k~k hb xzxk~ei zhkbkgi&

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    16/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;4 gh ;4Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Hf jkzi gh {xh konkz efdi~okjeifhz jifjxh~ghf zh jifzegh~k~ {xh bk |h~zifk {xh

    |~hwhfgh kjjhgh~ kb zezwhok hz ~hkbohfwh hb bhmweoi xzxk~ei u zh |h~oewe~ gejai kjjhzi&

    Hf jkzi gh {xh fi jiefjegkf bk ~hz|xhzwk gh|hfgh~ gh bi hzwknbhjegi |i~ hbkgoefezw~kgi~ ghb zezwhok" zehfgi bi oz aknewxkb zibejewk~ {xh zh ~h|ewk hb efwhfwi gh

    kjjhzi& Hf jkzi gh {xh bk efjifm~xhfjek zh |~igxpjk ~h|hwegkz thjhz" hz |izenbh {xh hb

    kgoefezw~kgi~ ghwh~oefh xf nbi{xhi kxwioweji gh bk jxhfwk u kn~k xfk fxhtk |izenebegkg

    gh kjjhzi" uk zhk xwebepkfgi xfk kxwhfwejkjef nkzkgk hf jifijeoehfwiz !kb ~hkbepk~

    |~hmxfwkz jxuk ~hz|xhzwk ghnh~k jifijh~ fejkohfwh hb bhmweoi xzxk~ei% i xfk

    kxwhfwejkjef nkzkgk hf bk |izhzef !|i~ h`ho|bi hftekfgi xf ohfzk`h k xfk jxhfwk gh

    ji~~hi hbhjw~feji i xf foh~i gh whbdifi |~htekohfwh tefjxbkgiz%&

    >&7&> EghfwedejkjefHzwh zhmxfgi we|i gh |~ijhgeoehfwi hz oz zhfjebbi |k~k hb xzxk~ei" |h~i oxjai oz

    jio|bh`i |k~k hb |~i|ei zezwhok kb ~h{xh~e~ okui~hz jk|kjegkghz gh jio|xwkjef& Hf b"

    hb xzxk~ei hf bxmk~ gh k|i~wk~ giz we|iz gh efdi~okjeifhz zibkohfwh k|i~wk zxz

    j~hghfjekbhz& Kz" hb zezwhok hz hb hfjk~mkgi gh eghfwedejk~ {x xzxk~ei ~hmezw~kgi hz hb

    {xh zh hzw kxwhfwejkfgi&

    Hzwh |~ijhgeoehfwi jifzezwh hf bk jio|k~kjef gh bkz j~hghfjekbhz {xh k|i~wk hb xzxk~ei

    jif wigkz bkz ~hmezw~kgkz hf hb zezwhok" bi jxkb eo|bejk okui~hz fhjhzegkghz hf bk

    jk|kjegkg gh jio|xwkjef ghb zezwhok u xf okui~ weho|i gh hz|h~k |k~k ~hkbepk~ bkeghfwedejkjef&

    Ghnegi k biz geth~ziz |~inbhokz {xh |ig~k kjk~~hk~ hzwh owigi hf jxkfwi k bkz

    |izenebegkghz gh zx|bkfwkjef gh eghfwegkg" hz |iji ji~~ehfwh" u hf jkzi gh zh~ xwebepkgi

    fejkohfwh bi zh~k hf zezwhokz {xh nkzkf bkz j~hghfjekbhz hf bk |izhzef gh hbhohfwiz

    dzejiz i hf biz ~kzmiz dzejiz" zehfgi hzwh zhmxfgi jkzi hb {xh okui~ zhmx~egkg

    k|i~wk~k&

    >&7&: Hzjhfk~eiz gh kxwhfwejkjef

    Ghb oezoi oigi {xh hqezwhf gedh~hfwhz di~okz gh ghwh~oefkjef gh j~hghfjekbhz u ghjio|~inkjef gh eghfwegkghz hf hb ~hmezw~i" hqezwhf w~hz hzjhfk~eiz gh kxwhfwejkjef

    ifbefh" hf dxfjef ghb ohjkfezoi ho|bhkgi u gh {xef zhk hb kmhfwh {xh bk bbhth k jkni&

    Kxwhfwejkjef ge~hjwk

    Biz zezwhokz gh kxwhfwejkjef ge~hjwk zif k{xhbbiz {xh zh nkzkf hf bk efwh~kjjef hfw~h

    hb xzxk~ei u bk i~mkfepkjef {xh fhjhzewk kxwhfwejk~bh u zxoefezw~k hb ohjkfezoi gh

    kxwhfwejkjef&

    Xfk m~kf |k~wh gh biz zezwhokz gh kxwhfwejkjef kjwxkbohfwh hqezwhfwhz zh nkzkf hf hb

    efwh~jkonei gh jifw~kzhkz u iw~kz efdi~okjeifhz jifijegkz |i~ konkz |k~whz

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    17/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;= gh ;=Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    !j~hghfjekbhz gh |~eoh~k i gh zhmxfgk |k~wh%" {xh zh ~hbkjeifkf gh di~ok ge~hjwk&

    ^hzxbwk d~hjxhfwh {xh bk ~hbkjef hfw~h hb xzxk~ei u hb |~ithhgi~ zh nkzh hf hzwh we|i gh

    zezwhokz&

    Kxwhfwejkjef jh~wedejkgk

    Hzwiz zezwhokz zh nkzkf hf hb ho|bhi gh jh~wedejkgiz hbhjw~fejiz gh jbkth |nbejk

    !aknewxkbohfwh j~hghfjekbhz gh wh~jh~k |k~wh%& Zx |~efje|kb thfwk`k hz bk |izenebegkg gh

    kxwhfwejk~ k xfk |h~zifk zef fhjhzegkg gh xf ~hmezw~i |~hzhfjekb" gkgi {xh zh |xhgh

    jifdek~ hf bk efdi~okjef gh eghfwedejkjef ghb jh~wedejkgi" hz|hjekbohfwh jxkfgi bk

    bhmezbkjef k|bejknbh hzwknbhjh jifwhfegiz ofeoiz" jioi hz hb jkzi ghb ghfioefkgi

    jh~wedejkgi hbhjw~feji ~hjifijegi& H`ho|biz gh hbbi zif hb GFE hbhjw~feji u iw~iz

    jh~wedejkgiz gh eghfwedejkjef jioi biz hq|hgegiz k ho|~hzk~eiz" w~knk`kgi~hz gh

    i~mkfepkjeifhz |nbejkz i |~etkgkz" i k |~idhzeifkbhz jibhmekgiz&

    Jxkfgi xfk |h~zifk gez|ifh gh xf jh~wedejkgi ~hjifijegi" |xhgh ~hbkjeifk~zh jif

    wh~jh~iz u |xhgh inwhfh~ gh di~ok w~kfz|k~hfwh zx kbwk hf xf fxhti zh~tejei" zef

    fhjhzegkg gh tibth~ k kj~hgewk~ zx eghfwegkg |~hzhfjekbohfwh" |i~ bi {xh bk jifdekfpk hf

    hb w~deji k w~ktz gh Efwh~fhw zh efj~hohfwk&

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    18/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;1 gh ;1Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Xf jh~wedejkgi hbhjw~feji hz xf gijxohfwi hbhjw~feji de~okgi ;: {xh mk~kfwepk" k bkz

    |h~zifkz {xh bi ~hjenhf i {xh bi xwebepkf" xfk zh~eh gh okfedhzwkjeifhz jifwhfegkz hf hb

    oezoi& Hzwkz okfedhzwkjeifhz |xhghf ~hdh~e~zh k bk eghfwegkg gh xfk |h~zifk" k bk

    wewxbk~egkg i |izhzef gh xfk jbkth |nbejk !u gh bk ji~~hz|ifgehfwh jbkth |~etkgk%" k zxz

    kxwi~epkjeifhz !hf di~ok gh ~ibhz i |h~oeziz%" k zx jk|kjegkg gh ~h|~hzhfwk~ k iw~k

    |h~zifk dzejk i `x~gejk" k zx jk|kjegkg gh |kmi" hwj&

    Hzwiz jh~wedejkgiz |xhghf zh~ hoewegiz wkfwi |i~ i~mkfepkjeifhz hqwh~fkz kb xzxk~ei u kb

    |~ithhgi~ gh zh~tejeiz !|i~ h`ho|bi hb GFEh% i |i~ hzwh oezoi |~ithhgi~ !|i~ h`ho|bi

    jh~wedejkgiz |k~k jbehfwhz i |k~k oehon~iz gh xfk km~x|kjef%&

    Hqezwh xfk m~kf jkfwegkg gh |izenbhz jh~wedejkgiz" gh biz jxkbhz zbi xfk |h{xhk |k~wh

    ak zegi ~hmxbkgk bhmkbohfwh" jif bk defkbegkg gh mk~kfwepk~ bk eghfwedejkjef u bk de~okhbhjw~fejk gh bkz |h~zifkz dzejkz u `x~gejkz u" oz ~hjehfwhohfwh" gh bkz

    Kgoefezw~kjeifhz \nbejkz" zxz ~mkfiz u hfwegkghz gh gh~hjai |nbeji&

    Ghzgh xfk |h~z|hjwetk wjfejk" biz jh~wedejkgiz zh |xhghf jbkzedejk~ hf w~hz m~x|iz0

    Biz jh~wedejkgiz gh kxwi~egkg gh jh~wedejkjef u gh xzxk~ei defkb& Hb

    jh~wedejkgi gh kxwi~egkg gh jh~wedejkjef zh hq|egh k xf jio|ifhfwh wjfeji gh

    gejak kxwi~egkg" jif bk defkbegkg gh hzwknbhjh~ xf oighbi gh jifdekfpk {xh

    |h~oewk jio|~ink~ u xwebepk~ biz jh~wedejkgiz mhfh~kgiz |i~ hbbk !kjwetegkg {xh zh

    ghfioefk |~hzwkjef gh zh~tejeiz gh jh~wedejkjef%&

    \i~ zx |k~wh" hb jh~wedejkgi gh xzxk~ei defkb zh hq|egh |i~ xfk kxwi~egkg gh

    jh~wedejkjef |k~k de~ok~" th~edejk~" jed~k~ i ghzjed~k~ gijxohfwiz |i~ |k~wh gh

    xzxk~eiz defkbhz ghb zh~tejei !d~hjxhfwhohfwh jifzxoegi~hz%&

    Biz jh~wedejkgiz gh de~ok hbhjw~fejk" gh jed~kgi u gh eghfwegkg& Hb

    jh~wedejkgi gh de~ok hbhjw~fejk hz xf jh~wedejkgi gh jbkth |nbejk gh xzxk~ei defkb

    {xh ze~th |k~k mhfh~k~ i |k~k th~edejk~ de~okz hbhjw~fejkz& Hb jh~wedejkgi gh

    jed~kgi hz zeoebk~" |h~i ze~th |k~k jed~k~ u ghzjed~k~ gijxohfwiz& \i~ zx |k~wh" hbjh~wedejkgi gh de~ok hbhjw~fejk u hb gh eghfwedejkjef zif egfwejiz hqjh|wi hf hb

    xzi kxwi~epkgi gh bk jbkth" {xh hf hb |~eoh~ jkzi zh ~hdeh~h k bk kjwxkjef

    di~okbepkgk gijxohfwkbohfwh" u hf hb zhmxfgi" fejkohfwh bk kxwhfwejkjef&

    Biz w~hz zh |xhghf jionefk~" gh di~ok {xh xf feji jh~wedejkgi |h~oewk ~hkbepk~

    wigkz hzwkz kjjeifhz& Ze kghoz hz ~hjifijegi" hb |~hzwkgi~ fi |ig~

    kbokjhfk~ bk jbkth |~etkgk {xh |h~oewh ghzjed~k~ gijxohfwiz&

    ;: \i~ hb |~hzwkgi~ gh zh~tejeiz gh jh~wedejkjef {xh bi hq|egh" jioi mk~kfwk gh zhmx~egkg u jifdekfpk hf bk oezoi" ghkjxh~gi jif bkz inbemkjeifhz bhmkbhz u" hf zx jkzi" jifthfjeifkbhz {xh ~hzxbwhf k|bejknbhz&

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    19/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;5 gh ;5Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Biz jh~wedejkgiz gh eghfwedejkjef gh gez|izeweti& Ghfw~i gh hzwk jkwhmi~k

    zh efjbxuhf wigiz biz jh~wedejkgiz {xh kj~hgewkf bk eghfwedejkjef gh xf zezwhok"

    k|bejkjef x in`hwi gemewkb gedh~hfwh gh xfk |h~zifk&

    Kbmxfiz h`ho|biz ~hbhtkfwhz zif biz jh~wedejkgiz gh zewei }hn" {xh kj~hgewkf bk

    wewxbk~egkg gh xfk X^B gh Efwh~fhw !efjbxuhfgi biz jh~wedejkgiz gh zh~tegi~

    zhmx~i jif tkbegkjef hqwhfgegk" ZZB HT% i biz jh~wedejkgiz gh de~ok gh jgemi"

    {xh jifde~okf bk kxwi~k gh xfk k|bejkjef ghzjk~mkgk kb h{xe|i i gez|izeweti&

    Kxwhfwejkjef dhgh~kgk

    Bk kxwhfwejkjef dhgh~kgk hz xf wh~jh~ oighbi gh kxwhfwejkjef hf hb jxkb xf jif`xfwi gh

    |~ithhgi~hz jio|k~whf bk efdi~okjef gh kxwhfwejkjef gh zxz xzxk~eiz u mhzweifkf

    jif`xfwkohfwh hzwh |~ijhzi&

    Bk mhzwef dhgh~kgk gh bk eghfwegkg hz xf jif`xfwi gh kjxh~giz" hzwfgk~hz u whjfibimkz

    {xh akjhf {xh bkz eghfwedejkjeifhz u bkz kw~enxjeifhz !|igh~hz" |h~oeziz" hwj&% zhkf

    w~kfz|i~wknbhz hfw~h gioefeiz kxwfioiz gh zhmx~egkg" ohgekfwh hb xzi gh kzh~jeifhz i

    kbhmkjeifhz gh eghfwegkg&

    Hf xf hfwi~fi dhgh~kgi" bk efdi~okjef gh eghfwegkg hz bijkb k jkgk zezwhok" hz ghje~" zh

    hfjxhfw~k hf biz h{xe|iz u zh~tegi~hz gh jkgk zezwhok" |h~i |xhgh hfbkpk~zh u

    ho|bhk~zh gh di~ok mbinkb" gh oigi {xh |ig~k zh~ kjjhzenbh |k~k iw~iz zezwhokzkzijekgiz&

    Hf xf hzjhfk~ei gh kxwhfwejkjef dhgh~kgk" hb xzxk~ei {xeh~h kjjhgh~ k xf zh~tejei

    hbhjw~feji gh xf |~ithhgi~ gh zh~tejeiz jif {xehf fi wehfh ~hbkjef |~htek& \k~k hbbi zh

    kxwhfwejk ge~hjwkohfwh d~hfwh k zx |~ithhgi~ gh j~hghfjekbhz" jif hb {xh uk ak ~hkbepkgi

    xf ~hmezw~i |~htei" {xh bh hfw~hmk xf foh~i |k~k {xh hb xzxk~ei bi hfw~hmxh kb wh~jh~i

    jif hb {xh fi hqezwk ~hbkjef |~htek&

    Ohgekfwh gejai foh~i" hb |~ithhgi~ gh zh~tejeiz |xhgh jifzxbwk~ kb |~ithhgi~ gh

    j~hghfjekbhz kjh~jk gh bk eghfwegkg ghb xzxk~ei& Defkbohfwh" hb |~ithhgi~ gh j~hghfjekbhz

    hq|egh xfk j~hghfjekb jifzezwhfwh hf xf gijxohfwi hbhjw~feji;7 gifgh zh efjbxuhf

    hzwkz efdi~okjeifhz zin~h hb xzxk~ei !bk kzh~jef%&

    Hzwh ohjkfezoi |h~oewh dhgh~k~ zh~tejeiz gh Efwh~fhw hf w~oefiz gh eghfwedejkjef u

    kxwhfwejkjef" u zh |xhgh ho|bhk~ |k~k {xh jxkb{xeh~ j~hghfjekb gh |~eoh~k i zhmxfgk

    |k~wh zh |xhgk ho|bhk~ jif wh~jh~iz;8&

    ;7 Mhfh~kbohfwh" hzwh gijxohfwi i kzh~jef gh eghfwegkg zh hfjxhfw~k de~okgi hbhjw~fejkohfwh |i~ hb |~ithhgi~" |k~kmk~kfwk ghb wh~jh~i kb jxkb zibejewk kjjhzi hb xzxk~ei&;8 Hz ghje~" |h~oewh jifth~we~ xf eghfwedejkgi~ gh |~eoh~k i gh zhmxfgk |k~wh hf xf eghfwedejkgi~ gh wh~jh~k |k~wh"

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    20/64

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    21/64

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    22/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk >> gh >>Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    : ^ HM XB KJ E F B HM KB G H B K KX WH F WE JK JE F G H B K EG HF WE GK G GE M EW KB

    :&; HB ^HJIFIJEOEHFWI U KW^ENXJEF GH BK EGHFWEGKG

    :&;&; Bk kw~enxjef gh zemfiz gh eghfwegkg k bkz |h~zifkz dzejkz&Ghzgh hb fkjeoehfwi u gx~kfwh bk |izwh~ei~ htibxjef gh bkz |h~zifkz zh di~okbepkf xfk

    zh~eh gh kjwiz `x~gejiz {xh |h~oewhf kb Hzwkgi whfh~ jifzwkfjek gh zx hqezwhfjek" u

    gh~etk~ bkz i|i~wxfkz jifzhjxhfjekz `x~gejkz" u zeoxbwfhkohfwh id~hjh~ k biz wh~jh~iz

    zhmx~egkg `x~gejk&

    Wigiz fxhzw~iz kjwiz `x~gejiz hf bk |~jwejk hzwf efhbxgenbhohfwh xfegiz k bk

    ghjbk~kjef i |~xhnk gh fxhzw~k eghfwegkg& \i~ h`ho|bi" |k~k ge~eme~fiz k jxkb{xeh~

    kgoefezw~kjef bk Bhu :" gh >4 gh fitehon~h gh ^meohf @x~geji gh bkz

    Kgoefezw~kjeifhz \nbejkz u ghb \~ijhgeoehfwi Kgoefezw~kweti Jiof hqemh {xh bk|hwejef jifwhfmk efgejkjef ghb fion~h u k|hbbegiz ghb efwh~hzkgi u" hf zx jkzi" gh bk

    |h~zifk {xh bi ~h|~hzhfwh" kz jioi bk eghfwedejkjef ghb ohgei |~hdh~hfwh i ghb bxmk~ {xh

    zh zhkbh k hdhjwiz gh fiwedejkjeifhz u bk de~ok ghb zibejewkfwh i kj~hgewkjef gh bk

    kxwhfwejegkg gh zx tibxfwkg hq|~hzkgk |i~ jxkb{xeh~ ohgei !k~w& =

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    23/64

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    24/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk >7 gh >7Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    zwh u gh bkz zxjx~zkbhz !ze bkz wxteh~h%" hb in`hwi gh zx ho|~hzk u bk dhjak gh jioehfpi

    gh bkz i|h~kjeifhz&

    \i~ iw~k |k~wh" bkz kzijekjeifhz kg{xeh~hf |h~zifkbegkg `x~gejk jif hb kjwk dxfgkjeifkbefjbxuhfgi hb gh~hjai gh kzijekjef zhmf hb k~wjxbi >7 gh bk Bhu I~mfejk ;)> BK DE^OK HBHJW^FEJK

    Bk |~xhnk gh bk eghfwegkg |xhgh ~hkbepk~zh k w~ktz gh biz ohgeiz {xh |~i|i~jeifkf bk

    de~ok hbhjw~fejk u biz jh~wedejkgiz gemewkbhz& Fi inzwkfwh" zxz dxfjeifkbegkghz tkf oxjai

    oz kbb" |i~ bi {xh |~ijhgh hq|ifh~ biz hbhohfwiz `x~gejiz nzejiz {xh |h~oewhf

    jk~kjwh~epk~ k jkgk xfk gh hbbiz&

    Biz w~oefiz gh de~ok gemewkb u de~ok hbhjw~fejk zh xwebepkf jif d~hjxhfjek jioi

    zeffeoiz" |h~i zh w~kwk gh xf h~~i~ |xhzwi {xh hzwf gedh~hfjekgiz;1&

    Bk de~ok gemewkb" zh ~hdeh~h kb jif`xfwi gh wjfejkz gh jigedejkjef u j~e|wim~kdk {xhkzijekf bk eghfwegkg gh xfk |h~zifk" hfwegkg i xf h{xe|i efdi~oweji kb ohfzk`h i

    gijxohfwi de~okgi& Xfk de~ok gemewkb gk kb ghzwefkwk~ei zhmx~egkg gh {xh hb ohfzk`h dxh

    j~hkgi |i~ hb ~hoewhfwh !kxwhfwejegkg gh i~emhf% u {xh fi dxh kbwh~kgi gx~kfwh bk

    w~kfzoezef !efwhm~egkg%&

    Bk de~ok hbhjw~fejk hz xf jifjh|wi oz ko|bei ghzgh xf |xfwi gh tezwk wjfeji uk {xh

    |xhgh jifwho|bk~ owigiz fi j~e|wim~dejiz& Bk fi~okwetk hz|kibk zh ~hdeh~h k hbbk gh

    di~ok mhf~ejk jioi k{xhb jif`xfwi gh gkwiz {xh |h~oewhf eghfwedejk~ kb de~okfwh" bi {xh

    efjbxe~k nk`i hzwh jifjh|wi we|ibimkz k`hfkz k bk jh~wedejkjef gemewkb" jioi bk de~okkxwm~kdk hzjkfhkgk i bk de~ok okfxzj~ewk gemewkbepkgk&

    Bk Bhu 85)>

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    25/64

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    26/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk >4 gh >4Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    |xhgh kjwxk~ jioi ze dxh~k bk d e~ok okfxzj~ewk gh xfk |h~zifk" ohgekfwh hb jifjh|wi

    whjfibmejkohfwh fhxw~kb gh bk de~ok hbhjw~fejk !ktkfpkgk i ~hjifijegk%&

    :&>&: Bk de~ok hbhjw~fejk ~hjifijegkDefkbohfwh" bk BDH jifwehfh xfk wh~jh~k ghdefejef gh de~ok hbhjw~fejk" hf zx k~wjxbi :&:"

    hf te~wxg ghb {xh zh jifzegh~k de~ok hbhjw~fejk ~hjifijegk k bk de~ok hbhjw~fejk

    ktkfpkgk nkzkgk hf xf jh~wedejkgi ~hjifijegi u {xh ak zegi |~igxjegk ohgekfwh xf

    gez|izeweti zhmx~i gh j~hkjef gh de~ok hbhjw~fejk" jkwhmi~k jxui ~hjifijeoehfwi zh

    ~hdeh~h k xfk |~hzxfjef gh egifhegkg {xh bk jxkbedejk hz|hjekbohfwh jioi h{xetkbhfwh k

    bk de~ok okfxzj~ewk" u zef {xh hbbi eo|be{xh bk gezj~eoefkjef gh biz ~hzwkfwh we|iz gh de~ok

    hbhjw~fejk&

    Zh w~kwk" gh fxhti" gh xfk ghdefejef efj~hohfwkb hf jxkfwi k biz ~h{xezewiz" {xh hqemh{xh bk whjfibimk gh de~ok hbhjw~fejk ~hjifijegk zhk hz|hjekbohfwh egfhk u kghjxkgk

    |k~k {xh xfk |h~zifk dzejk" gh ahjai w|ejkohfwh xf jexgkgkfi i |~idhzeifkb xzxk~ei gh

    zh~tejeiz |~etkgiz u |nbejiz" zh eghfwede{xh u de~oh&

    :&>&7 Iw~iz we|iz gh de~ok hbhjw~fejk

    Fi inzwkfwh" kghoz gh bkz jifwho|bkgkz hf bk BDH" |ighoiz jewk~ iw~iz we|iz gh de~ok

    hf dxfjef gh joi bkz jbkzede{xhoiz0

    Zhmf zx di~okwi0

    Dhjakgk !Weohzwko|%" uk {xh efji~|i~k xf zhbbi gh weho|i !KgHZ/W%&

    Tkbegkgk !jio|bhwh u Hqwhfghg%0 kkgh ~hdh~hfjekz |k~k jio|~ink~ bkz de~okz

    !KgHZ/J%3 i nehf {xh kghoz kkgh hb zhbbi gh weho|i k bkz ~hdh~hfjekz kkgegkz

    hf bk kfwh~ei~ !KgHZ/Q%&

    Bifmhtk !Hqwhfghg bifm/wh~o%" efjbxuh jh~wedejkgiz h efdi~okjef gh ~htijkjef

    kjwxkb |k~k zx jio|~inkjef k bk~mi |bkpi !KgHZ/Q/B%&

    Zhmf zx xnejkjef dzejk0

    Hq|bjewk !Ghwkjahg%& Bk de~ok zh mhfh~k jioi xf dejah~i efgh|hfgehfwh ghb

    dejah~i de~okgi& Jxkb{xeh~ dejah~i zh |xhgh de~ok~ gh hzwk di~ok& Aku tk~ekz

    k|bejkjeifhz |k~k mhfh~k~ hzwh we|i gh de~ok&

    Eo|bjewk i efj~xzwkgk !Kwwkjahg%& Bk de~ok tk efjbxegk hf hb gijxohfwi {xh tk

    de~okgi& Hz |izenbh ze bk k|bejkjef {xh j~hk hb dejah~i gh gkwiz bi |h~oewh&

    Zhmf zx `h~k~{xk0

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    27/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk >= gh >=Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Jxkfgi xf gijxohfwi ghnh zh~ de~okgi |i~ tk~eiz" |xhghf |~hzhfwk~zh giz we|iz gh

    de~okz hf dxfjef ghb jkzi jifj~hwi0

    @h~~{xejkz !Jixfwh~zefm%& Jxkfgi xf gijxohfwi ghnh de~ok~zh hf i~ghf& Xfkde~ok th~edejk i de~ok bkz kfwh~ei~hz&

    \k~kbhbk i jide~ok !JiZemf%& Wigkz bkz de~okz de~okf biz gkwiz& Fi aku i~ghf"

    zibi eo|i~wkf hb foh~i gh de~okz wiwkbhz&

    Zhmf hb bhfmxk`h ho|bhkgi

    Jxkfgi zh mhfh~k xfk de~ok gemewkb |ighoiz xwebepk~ giz bhfmxk`hz gezwefwiz" mhfh~kfgi

    giz di~okwiz gezwefwiz0

    JKgHZ0 JOZ !J~u|wim~kdej Ohzzkmh Zufwkq% Kgtkfjhg Hbhjw~ifej Zemfkwx~h&

    QkGHZ0 QOB !Hqwhfzenbh Ok~cx| Bkfmxkmh% Kgtkfjhg Hbhjw~ifej Zemfkwx~h&

    :&>&8 Biz hdhjwiz `x~gejiz gh bk de~ok hbhjw~fejk

    \~efje|ei gh tkbeghp mhfh~kb gh bk de~ok hbhjw~fejk

    Wigk de~ok hbhjw~fejk" jif efgh|hfghfjek gh zx jkbedejkjef jioi i~gefk~ek" ktkfpkgk

    i ~hjifijegk" hz emxkbohfwh de~ok hf bk ohgegk hf {xh ze~th kb in`hweti gh eo|xwk~ hb

    jifwhfegi ghb gijxohfwi k bk |h~zifk {xh bi kxwi~epk& Hf jifzhjxhfjek" hb k~wjxbi :&5 ghbk BDH efgejk {xh fi zh fhmk~f hdhjwiz `x~gejiz k xfk de~ok hbhjw~fejk {xh fi ~hfk

    biz ~h{xezewiz gh de~ok hbhjw~fejk ~hjifijegk" hf ~hbkjef k biz gkwiz k biz {xh hzw

    kzijekgk" |i~ hb oh~i ahjai gh |~hzhfwk~zh hf di~ok hbhjw~fejk&

    Kz |xhz" bk gedh~hfjek ~hkb hfw~h xfk zeo|bh de~ok hbhjw~fejk" xfk de~ok hbhjw~fejk

    ktkfpkgk i xfk de~ok hbhjw~fejk ~hjifijegk fi ~hzegh hf zx kgoezenebegkg `x~gejk" fe hf

    zx |iwhfjekb hdejkjek" zefi hf hb jif`xfwi gh ~h{xezewiz fhjhzk~eiz |k~k bim~k~ gejaiz

    hdhjwiz&

    \i~ wkfwi" kxf{xh zin~h bk de~ok ~hjifijegk ~hjkh xfk |~hzxfjef bhmkb {xh bk h{xe|k~k k

    bk de~ok okfxzj~ewk" xfk de~ok zeo|bh |xhgh jxo|be~ |h~dhjwkohfwh jif zx dxfjef kxf{xh

    |xhgkf zh~ fhjhzk~eiz hbhohfwiz kgejeifkbhz" jioi zx inwhfjef |~htek hf hb oxfgi

    dzeji kfwh xfk ~hz|ifzknbh gh bk ho|~hzk i kgoefezw~kjef&

    Hdejkjek gh bk de~ok hbhjw~fejk

    Bk BDH ~hmxbk biz hdhjwiz gh bk de~ok hbhjw~fejk ginbhohfwh0

    \i~ xfk |k~wh" hb k~wjxbi :&7 gh bk BDH ghwh~oefk {xh bk de~ok hbhjw~fejk

    ~hjifijegk whfg~" ~hz|hjwi gh biz gkwiz jifzemfkgiz hf di~ok hbhjw~fejk" hb

    oezoi tkbi~ {xh bk de~ok okfxzj~ewk hf ~hbkjef jif biz jifzemfkgiz hf |k|hb3

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    28/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk >1 gh >1Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    hzwi hz" {xh bk de~ok hbhjw~fejk {xh jxo|bh hzwiz ~h{xezewiz zh ~hjifijh

    bhmkbohfwh jioi h{xetkbhfwh k bk de~ok okfxzj~ewk&

    \i~ iw~k |k~wh" hb k~wjxbi :&5 gh bk BDH hzwknbhjh {xh fi zh fhmk~f hdhjwiz`x~gejiz k bk de~ok hbhjw~fejk {xh fi ~hfk biz ~h{xezewiz gh bk d e~ok hbhjw~fejk

    ~hjifijegk" hf ~hbkjef k biz gkwiz k biz {xh hzw kzijekgk |i~ hb oh~i ahjai gh

    |~hzhfwk~zh hf di~ok hbhjw~fejk& Hz ghje~" wigk de~ok |xhgh |iwhfjekbohfwh

    ~hjene~ hdhjwiz `x~gejiz" fi |xgehfgi zh~ fefmxfk whjfibimk gezj~eoefkgk |i~ zh~

    hbhjw~fejk&

    Hzwk jifjh|jef ginbh zh w~kgxjh hf biz giz |~efje|eiz mhfh~kbhz ghzj~e|wetiz gh bk

    hdejkjek gh bk de~ok hbhjw~fejk0 hb |~efje|ei gh fi gezj~eoefkjef" gh kjxh~gi jif hb jxkb bk

    |k~wh k {xehf efwh~hzk bk hdejkjek gh xfk de~ok hbhjw~fejk wehfh gh~hjai k {xh zh|~kjwe{xh xfk |~xhnk zxdejehfwh" {xh ghwh~oefh ze bk de~ok h~k zxdejehfwhohfwh deknbh jioi

    |k~k eo|xwk~ hb kjwi k bk |h~zifk {xh bk |~igx`i3 u hb |~efje|ei gh h{xetkbhfjek dxfjeifkb"

    {xh fi hbeoefk bk fhjhzegkg gh hzwk |~xhnk" |h~i bk ~hgxjh jifzegh~knbhohfwh" ohgekfwh

    bk |~hzxfjef gh bk hz|hjekb egifhegkg gh bk whjfibimk |k~k kjwxk~ jioi bk de~ok gh bk

    |h~zifk&

    Biz hdhjwiz" |i~ wkfwi" zh jifgejeifkf zeho|~h u hf wigi jkzi k bk |~xhnk gh bk

    kxwhfwejegkg gh bk de~ok" ghoizw~kgk bk jxkb bk de~ok |~igxje~ zx hdhjwi w|eji" {xh hz hb

    gh |h~oewe~ bk eo|xwkjef ghb gijxohfwi de~okgi k bk |h~zifk&

    Bk |~xhnk `xgejekb gh bk de~ok hbhjw~fejk

    Hz |~hjezkohfwh hzwk |~xhnk gh bk kxwhfwejegkg gh bk de~ok hbhjw~fejk bk {xh zh ghnh

    |~kjwejk~ hf jkzi gh ~h|xgei i ~hjakpi ghb gijxohfwi |i~ |k~wh ghb ghokfgkgi& Zh w~kwk

    gh bi oezoi {xh zxjhgh hf hb jkzi gh bk de~ok okfxzj~ewk" {xh hf jkzi gh jifdbejwi zh

    zxzwkfjek ohgekfwh xfk |~xhnk |h~ejekb jkbem~dejk&

    Kb hdhjwi" bk BDH ghwh~oefk xf w~kwkoehfwi hz|hjdeji gh bk |~xhnk gh bk kxwhfwejegkg gh bk

    de~ok hbhjw~fejk" hf biz jkziz gh bk de~ok ktkfpkgk u gh bk de~ok ~hjifijegk !fi kz gh bk

    de~ok i~gefk~ek%&

    Hf te~wxg ghb k~wjxbi :&1 gh bk BDH" hf jkzi gh eo|xmfk~zh bk kxwhfwejegkg gh bk de~ok

    hbhjw~fejk ~hjifijegk jif bk {xh zh akukf de~okgi biz gkwiz efji~|i~kgiz kb gijxohfwi

    hbhjw~feji" zh |~ijhgh~ k jio|~ink~ {xh0 zh w~kwk gh xfk de~ok hbhjw~fejk ktkfpkgk

    nkzkgk hf xf jh~wedejkgi ~hjifijegi" {xh jxo|bh wigiz biz ~h{xezewiz u jifgejeifhz

    hzwknbhjegiz hf hzwk Bhu |k~k hzwh we|i gh jh~wedejkgiz u {xh bk de~ok zh ak mhfh~kgi

    ohgekfwh xf gez|izeweti zhmx~i gh j~hkjef gh de~ok hbhjw~fejk&

    Bk inbemkjef gh ~hkbepk~ bkz jewkgkz jio|~inkjeifhz ji~~hz|ifgh k {xehf |~hzhfwh hbgijxohfwi hbhjw~feji de~okgi jif de~ok hbhjw~fejk ~hjifijegk&

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    29/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk >5 gh >5Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Ze gejakz jio|~inkjeifhz inwehfhf xf ~hzxbwkgi |izeweti" zh kzxoh bk kxwhfwejegkg gh bk

    de~ok hbhjw~fejk ~hjifijegk jif bk {xh zh ak de~okgi gejai gijxohfwi hbhjw~feji"

    whfehfgi {xh akjh~zh jk~mi gh bkz jizwkz" mkzwiz u gh~hjaiz {xh i~emefh bk

    jio|~inkjef {xehf axnehzh di~oxbkgi bk eo|xmfkjef& H efjbxzi" ze k `xejei ghb w~enxfkb

    bk eo|xmfkjef axnehzh zegi whoh~k~ek" |ig~ eo|ifh~bh kghoz xfk oxbwk gh hfw~h ;> Jh~wedejkgi gh |h~zifk dzejk" gh |h~zifk `x~gejk i gh hfwegkg zef|h~zifkbegkg `x~gejk

    Hb jh~wedejkgi gh |h~zifk dzejk hz hb {xh zh hq|egh k xf xzxk~ei efgetegxkb" {xh zh

    ghfioefk zxzj~e|wi~ ghb jh~wedejkgi" {xh zh~ hb de~okfwh !hf jh~wedejkgiz gh jbkth |nbejk

    gh de~ok% i hb {xh ghzjed~h biz gijxohfwiz |~iwhmegiz jif zx jbkth |nbejk !hf

    jh~wedejkgiz gh jed~kgi%&

    Hb jh~wedejkgi gh |h~zifk `x~gejk fi zh ~hjimh hf bk Ge~hjwetk 55)5:)JH" fe zh ghdefh

    hf bk Bhu 85)>< Hb jxzwigei gh xf jh~wedejkgi gh |h~zifk `x~gejk hz bk |h~zifk dzejk zibejewkfwh gh xf jh~wedejkgi gh |h~zifk `x~gejk" {xhgez|ifh gh xf gez|izeweti gh de~ok hbhjw~fejk u {xh" |i~ wkfwi" bi xwebepk |k~k |~igxje~ de~okz hbhjw~fejkz&

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    32/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk :> gh :>Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Fi inzwkfwh" bkz k|bejkjeifhz ghb jh~wedejkgi gh |h~zifk `x~gejk wehfhf oz {xh th~ jif

    bk |~igxjjef gh gijxohfwiz i~emefkbhz eo|xwknbhz k bk hfwegkg {xh jif bk de~ok hzj~ewk

    ghb ~h|~hzhfwkfwh bhmkb i tibxfwk~ei gh bk |h~zifk `x~gejk& Hzwk |izenebegkg inbemk k

    ~h|bkfwhk~ bk fhjhzegkg gh bk ~h|~hzhfwkjef hf bk ~hbkjef hbhjw~fejk hfw~h bkz |h~zifkz

    `x~gejkz u bkz Kgoefezw~kjeifhz \nbejkz" uk {xh bhmkbohfwh hz bk |h~zifk `x~gejk bk {xh

    ge~hjwkohfwh kjwk&

    Kghoz" hb jh~wedejkgi gh |h~zifk `x~gejk fi |ig~ kdhjwk~ kb ~meohf gh ~h|~hzhfwkjef

    i~mfejk i tibxfwk~ek ~hmxbkgi |i~ bk bhmezbkjef jeteb i oh~jkfweb k|bejknbh k jkgk |h~zifk

    `x~gejk" |~htezef {xh mhfh~k nkzwkfwhz |~inbhokz `x~gejiz |k~k ghbeoewk~ {x kjwiz

    |ig~kf hthfwxkbohfwh {xhgk~ hqjbxegiz gh bk de~ok gh |h~zifk `x~gejk hf bk ~hbkjef

    hbhjw~fejk jif bk Kgoefezw~kjef&

    Kz |xhz" zh ghnh efwh~|~hwk~ {xh hzwk |~htezef bhmkb zhkbk {xh |~hjezkohfwh hf bk

    kjwxkjef hbhjw~fejk gh bk |h~zifk `x~gejk ohgekfwh zx de~ok hbhjw~fejk fi hqezwh

    ~h|~hzhfwkjef" |i~ zh~ effhjhzk~ek u {xh" |i~ wkfwi" k gejak kjwxkjef fi zh bh ghnhf

    k|bejk~ bkz fi~okz zin~h bk ~h|~hzhfwkjef& Gh hzwh oigi" jxkfgi xfk fi~ok

    kgoefezw~kwetk zhkbh {xh" |i~ h`ho|bi" ghwh~oefkgi gijxohfwi ghnh zh~ de~okgi |i~ bk

    ho|~hzk i zx ~h|~hzhfwkfwh" zh~ |izenbh {xh kjwh ge~hjwkohfwh bk ho|~hzk jif zx

    de~ok gh |h~zifk `x~gejk i {xh kjwh xf ~h|~hzhfwkfwh ohgekfwh xf jh~wedejkgi gh

    |h~zifk dzejk" hf hzwh zhmxfgi jkzi kj~hgewkfgi zx ~h|~hzhfwkjef gh di~ok zxdejehfwh&

    Bk ~hmxbkjef ghb jh~wedejkgi gh |h~zifk `x~gejk fi zh k|bejk fe k biz jh~wedejkgiz gh bkz

    hfwegkghz gh jh~wedejkjef gh de~ok hbhjw~fejk fe k biz jh~wedejkgiz hoewegiz k bkz

    Kgoefezw~kjeifhz \nbejkz" {xh zh ~hme~f |i~ zx fi~okwetk hz|hjdejk !hf hb jkzi gh

    zwkz bweokz" bk bhu ;;)>

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    33/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk :: gh ::Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    hf biz {xh |ig~f hq|hge~zh jh~wedejkgiz hbhjw~fejiz k bkz hfwegkghz zef |h~zifkbegkg

    `x~gejk&

    Gejak I~ghf k|bejk k bkz hfwegkghz zef |h~zifkbegkg `x~gejk fi~okz kfbimkz k bkzk|bejknbhz |k~k biz jh~wedejkgiz gh |h~zifkz `x~gejkz" kxf{xh jif hz|hjekbegkghz& Hf

    |k~wejxbk~ ~hz|hjwi kb |~ijhgeoehfwi gh ~hmezw~i" jif bk defkbegkg gh kzhmx~k~ {xh zbi xf

    ~h|~hzhfwkfwh bhmkb i tibxfwk~ei gh bk hfwegkg zef |h~zifkbegkg" {xh kjwxk~ jioi

    jxzwigei" ~hjenh hb jh~wedejkgi&

    :&:&: Jh~wedejkgi |k~k kjwxk~ hf fion~h |~i|ei i |i~ ~h|~hzhfwkjef

    Hb jh~wedejkgi gh de~ok |xhgh zh~te~ |k~k kjwxk~ hf fion~h |~i|ei i hf ~h|~hzhfwkjef gh

    xfk |h~zifk" jioi ghwh~oefk hb k~wjxbi 4&> gh bk Bhu 85)>

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    34/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk :7 gh :7Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Kxf{xh fi k|k~hjh jewkgi hq|~hzkohfwh" hb jh~wedejkgi |h~zifkb wkonef |xhgh zh~

    ji~|i~kweti" jxkfgi efgejk xfk ~hbkjef gh tefjxbkjef gh hzwk fkwx~kbhpk jif iw~k

    |h~zifk" {xh zh |xhgh efjbxe~ ze bi `xzwedejk bk defkbegkg hz|hjdejk ghb jh~wedejkgi !k~wjxbi

    ;;&: gh bk Bhu 85)>;&

    Hb GFE hbhjw~feji" kghoz gh jifzwewxe~ xf ohgei zhmx~i u deknbh gh kj~hgewkjef gh bkeghfwegkg |h~zifkb hf hb onewi dzeji" kkgh bk dxfjeifkbegkg gh zx xwebepkjef jioi

    ohgei gh eghfwedejkjef dhakjehfwh hf hb onewi gemewkb0 ohgekfwh zx xzi hf gez|izewetiz

    hbhjw~fejiz" k w~ktz gh Efwh~fhw u hf ~hghz gh jioxfejkjeifhz |~etkgkz&

    Gh hzwk di~ok" biz giz jh~wedejkgiz hbhjw~fejiz {xh efji~|i~k hb GFE hbhjw~feji !gh

    kxwhfwejkjef ghb jexgkgkfi u gh de~ok gemewkb% {xh ~hzxbwkf tibxfwk~eiz" ze~thf |k~k

    kxwhfwejk~ bk eghfwegkg |h~zifkb gh zx wewxbk~ u |k~k |h~oewe~ bk de~ok hbhjw~fejk gh

    gijxohfwiz |i~ |k~wh ghb de~okfwh&

    Hb GFE hbhjw~feji efjbxuh xf jae| {xh |h~oewh eghfwedejk~zh k w~ktz gh jxkb{xeh~ zezwhokgh jioxfejkjeifhz hbhjw~fejkz" zeho|~h {xh zh ~h{xeh~k i zh fhjhzewh |k~k xfk

    i|h~kjef whbhowejk" kz jioi ~hkbepk~ i|h~kjeifhz jif mk~kfwk gh kxwhfwejkjef

    neiow~ejk nkzkgk hf axhbbk gkjwebk~&

    Biz jh~wedejkgiz gh eghfwegkg u de~ok hbhjw~fejk zif hoewegiz" jif jk~jwh~ hqjbxzeti" |i~

    hb Hzwkgi" |k~k bi jxkb zh ak jifzwewxegi xfk Kxwi~egkg gh Jh~wedejkjef hbhjw~fejk |~i|ek"

    >; Bk BDH de`k hb ok~ji fi~okweti nzeji ghb GFEh ~hoewefgizh k bk fi~okwetk hz|hjdejk hf jxkfwi k bkz |k~wejxbk~egkghzgh zx ~meohf `x~geji& Gh kjxh~gi jif bk ghdefejef efjbxegk hf hb k~wjxbi ;8&; BDH" hb gijxohfwi fkjeifkb gh eghfwegkghbhjw~feji hz hb gijxohfwi fkjeifkb gh eghfwegkg {xh kj~hgewk hbhjw~fejkohfwh bk eghfwegkg |h~zifkb gh zx wewxbk~ u|h~oewh bk de~ok hbhjw~fejk gh gijxohfwiz&

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    35/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk :8 gh :8Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    |h~zifkbepkgk hf hb Oefezwh~ei ghb Efwh~ei~ k w~ktz gh bk Ge~hjjef Mhfh~kb gh bk \ibejk

    Fkjeifkb& Kb ~hz|hjwi" hb k~wjxbi ;4&; BDH hzwknbhjh {xh biz ~mkfiz jio|hwhfwhz ghb

    Oefezwh~ei ghb Efwh~ei~ |k~k bk hq|hgejef ghb gijxohfwi fkjeifkb gh eghfwegkg hbhjw~feji

    jxo|be~f bkz inbemkjeifhz {xh bk |~hzhfwh Bhu eo|ifh k biz |~hzwkgi~hz gh zh~tejeiz gh

    jh~wedejkjef {xh hq|egkf jh~wedejkgiz ~hjifijegiz jif hqjh|jef gh bk ~hbkwetk k bk

    jifzwewxjef gh bk mk~kfwk k bk {xh zh ~hdeh~h hb k|k~wkgi > ghb k~wjxbi >&n%" ;8 u >; ghb |~i|ei whqwi&

    Bk gezw~enxjef ghb GFE hbhjw~feji ak kuxgkgi k bk eo|bkfwkjef gh bk de~ok hbhjw~fejk u

    ak |h~oewegi {xh zh jifipjk u zh diohfwh zx xwebepkjef& Kghoz" ak jifw~enxegi k {xh

    zh |~igxpjk xfk okui~ efw~igxjjef hf hb oh~jkgi gh k|bejkjeifhz {xh ~h{xeh~kf gh hzwk

    whjfibimk&

    Hb ghzk~~ibbi ~hmbkohfwk~ei ghb GFE hbhjw~feji zh ak ~hkbepkgi |i~ hb ^hkb Ghj~hwi

    ;88:)>

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    36/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk :4 gh :4Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Fkjeifkb gh Eghfwegkg u zxz jh~wedejkgiz gh de~ok hbhjw~fejk& Aku {xh ghzwkjk~ {xh"

    d~hfwh k bk temhfjek ghb Gijxohfwi Fkjeifkb gh Eghfwegkg" biz jh~wedejkgiz hbhjw~fejiz

    ~hjifijegiz efji~|i~kgiz kb oezoi whfg~f xf |h~igi gh temhfjek gh w~hefwk ohzhz

    !k~wjxbi ;> ghb ^hkb Ghj~hwi%&

    Xf GFE gx~k fi~okbohfwh gehp kiz" bi {xh zemfedejk {xh zh ghnhf |~igxje~ w~hz

    ~hfitkjeifhz i~gefk~ekz gh biz jh~wedejkgiz hf zx efwh~ei~" zeho|~h {xh fi akuk

    efjeghfjekz {xh hqe`kf bk |~htek ~htijkjef gh biz oezoiz !u zx ~hhoezef |izwh~ei~" zin~h

    bk oezok wk~`hwk%&

    Hzwk je~jxfzwkfjek ~hzxbwk eo|i~wkfwh" uk {xh" kxf{xh efejekbohfwh xf GFE hbhjw~feji zhk

    hoewegi jif biz giz jh~wedejkgiz hf zx efwh~ei~" hz fhjhzk~ei {xh hb jexgkgkfi ~hfxhth gh

    di~ok ~hmxbk~ zxz jh~wedejkgiz i" hf jkzi jifw~k~ei" fi |ig~ akjh~ xzi gh gejakzdxfjeifkbegkghz& Bkz ~hfitkjeifhz {xh ghnhf ~hkbepk~zh hf bkz Jioezk~kz gh \ibejk"

    ho|bhkfgi biz h{xe|koehfwiz gez|xhzwiz kb hdhjwi&

    :&8 BK EGHFWEDEJKJEF GEMEWKB D^HFWH K BK KGOEFEZW^KJEF

    Bk Bhu ;;)>

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    37/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk := gh :=Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Bk Bhu wkonef ~hmxbk biz zezwhokz |k~k bk eghfwedejkjef hbhjw~fejk gh bkz

    Kgoefezw~kjeifhz \nbejkz u |k~k bk kxwhfwejkjef gh biz gijxohfwiz hbhjw~fejiz {xh

    |~igxpjkf0

    Zezwhokz gh de~ok hbhjw~fejk nkzkgiz hf bk xwebepkjef gh jh~wedejkgiz gh

    gez|izeweti zhmx~i i ohgei h{xetkbhfwh {xh |h~oewk eghfwedejk~ bk zhgh hbhjw~fejk

    u hb hzwknbhjeoehfwi jif hbbk gh jioxfejkjeifhz zhmx~kz&

    Zezwhokz gh de~ok hbhjw~fejk |k~k bk kjwxkjef kgoefezw~kwetk kxwiokwepkgk&

    De~ok hbhjw~fejk ghb |h~zifkb kb zh~tejei gh bkz Kgoefezw~kjeifhz \nbejkz&

    Efwh~jkonei hbhjw~feji gh gkwiz hf hfwi~fiz jh~~kgiz gh jioxfejkjef"

    jifdi~oh k bi hz|hjdejkohfwh kji~gkgi hfw~h bkz |k~whz&

    Hf jxkfwi k biz dxfjeifk~eiz" |xhghf xwebepk~ de~okz hbhjw~fejkz |~itezwkz |i~ bk |~i|ek

    Kgoefezw~kjef {xh |xhgkf eghfwedejk~ gh di~ok jif`xfwk kb wewxbk~ ghb |xhzwi gh w~knk`i i

    jk~mi u k bk Kgoefezw~kjef x ~mkfi hf bk {xh |~hzwk zxz zh~tejeiz" i bk de~ok hbhjw~fejk

    nkzkgk hf hb Gijxohfwi Fkjeifkb gh Eghfwegkg&

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    38/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk :1 gh :1Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    7 ^ EH ZM IZ \ K K BK ZH MX EG KG U BK \^ ET KJ EG KG

    7&; \^EFJE\KBHZ H^^I^HZ

    Hf hb |~ijhzi gh kxwhfwejkjef |xhghf jifjx~~e~ gedh~hfwhz ~ehzmiz i |~inbhokz hf~hbkjef k bk zhmx~egkg" zehfgi biz |~efje|kbhz bk kzemfkjef efji~~hjwk gh eghfwegkg" zhk

    hzwk |~itijkgk !zx|bkfwkjef% i |i~ h~~i~" u hb fi ~hjifijeoehfwi gh bk eghfwegkg gh xfk

    |h~zifk" hz ghje~" biz jifijegiz jioi dkbziz |izewetiz u biz dkbziz fhmkwetiz&

    K |hzk~ gh zh~ biz giz jkziz oz aknewxkbhz" hz fhjhzk~ei zhkbk~ {xh biz |izenbhz

    ~ehzmiz |xhghf ghnh~zh k iw~kz je~jxfzwkfjekz" hz|hjekbohfwh hf ~hbkjef k bk mhzwef gh

    biz gedh~hfwhz kz|hjwiz ~hbkjeifkgiz jif bk kxwhfwejkjef&

    7&;&; Dkbziz fhmkwetiz

    Xf dkbzi fhmkweti hf xf |~ijhzi gh kxwhfwejkjef zx|ifh {xh k xf xzxk~ei bhmweoi fi zhbh ~hjifijh jioi wkb" fhmfgizhbh hb kjjhzi kb zezwhok& Ze nehf hf |~efje|ei bkz

    jifzhjxhfjekz gh hzwh h~~i~ zh beoewkf k hzk ghfhmkjef gh kjjhzi" hzwi |xhgh whfh~

    iw~kz jifzhjxhfjekz hf jkzi gh {xh bk ghfhmkjef gh kjjhzi zhk |h~okfhfwh&

    \i~ h`ho|bi" |xhgh |h~gh~zh efdi~okjef eo|i~wkfwh ze hb kjjhzi hz ghfhmkgi

    |h~okfhfwhohfwh u zibkohfwh hzw kbi`kgk hf hzh zh~tejei& \i~ iw~i bkgi" ze bk jxhfwk i

    hb zh~tejei kb {xh zh ghzhk kjjhgh~ zh xwebepk |k~k mhzweifk~ gefh~i" |ig~kf |~igxje~zh

    |~gegkz hjifoejkz&

    7&;&> Dkbziz |izewetiz

    Hb iw~i we|i gh h~~i~ {xh |xhgh gk~zh hf hb |~ijhzi gh kxwhfwejkjef hz hb dkbzi |izeweti"

    hz ghje~" bk kjh|wkjef jioi xzxk~ei bhmweoi k xfi {xh fi bi hz" |i~ bi {xh zh bh |h~oewh

    hb kjjhzi k xf zezwhok u xfk efdi~okjef {xh fi ghnh~k whfh~& Hf hb jkzi gh bk de~ok

    gemewkb" zh hzwk~k kde~okfgi xfk kxwi~k dkbzk&

    Hzwk zewxkjef |xhgh mhfh~k~ gedh~hfwhz |~inbhokz" jioi hb ~ini gh efdi~okjef" bk

    zx|bkfwkjef gh eghfwegkg i jkziz gh d~kxgh ifbefh&

    7&> ^EHZMIZ HF BIZ \^IJHZIZ GH KXWHFWEJKJEF

    Biz gedh~hfwhz ~ehzmiz |k~k bk zhmx~egkg u bk |~etkjegkg ~hbkjeifkgiz jif biz |~ijhziz gh

    kxwhfwejkjef zif oxu geth~ziz" |xgehfgi zh~ jifzhjxhfjek gh biz dkbziz |izewetiz" biz

    dkbziz fhmkwetiz i ghnh~zh k iw~iz kz|hjwiz ~hbkjeifkgiz jif hb gezhi u bk mhzwef gh biz

    |~ijhziz gh kxwhfwejkjef&

    7&>&; Kxzhfjek i gdejew gh ohgegkz gh zhmx~egkg

    Hf hzwk jkwhmi~k zh hfmbinkf gedh~hfwhz kz|hjwiz {xh" hf zx okui~k" |xhghf zh~

    zibthfwkgiz |i~ {xehf gezhk hb zezwhok gh th~edejkjef& Zh w~kwk hf wigi jkzi gh

    ohgegkz |~hthfwetkz {xh kuxgkf k okfwhfh~ hbhtkgiz fethbhz gh zhmx~egkg& Hfw~h biz

    |izenbhz |~inbhokz hf hzwh jif`xfwi ghzwkjkf0

    7&7& ^ehzmiz |k~k bk zhmx~egkg u bk |~etkjegkg

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    39/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk :5 gh :5Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    J~hghfjekbhz |iji ~inxzwkz& Hz |izenbh {xh bkz j~hghfjekbhz ghdefegkz |k~k

    |h~oewe~ i ghfhmk~ hb kjjhzi k xf zh~tejei ifbefh fi kbjkfjhf xfiz ofeoiz

    hqemenbhz gh zhmx~egkg& Hf hb jkzi gh bkz jifw~kzhkz hzwiz fethbhz zh |xhghf

    tkbi~k~ hf dxfjef gh zx jio|bh`egkg u zx hqwhfzef&

    \izenebegkg gh kwk{xhz gh dxh~pk n~xwk& Kjwxkbohfwh hz |izenbh kxwiokwepk~ hb

    efwhfwi gh kjjhzi k xf zh~tejei" |~inkfgi jehfwiz gh j~hghfjekbhz |i~ zhmxfgi

    akzwk jifzhmxe~ bk i|jef kjh~wkgk u jif hbbk hb kjjhzi& Hf jkzi gh {xh hb

    zezwhok fi jxhfwh jif xf ohjkfezoi gh nbi{xhi ghb kjjhzi kfwh bk ~hewh~kjef

    gh h~~i~hz |ig~k dkjebewk~zh hzwh we|i gh kwk{xhz&

    ^ini gh j~hghfjekbhz& Bkz j~hghfjekbhz {xh |h~oewhf bk kxwhfwejkjef gh jkgk

    xzxk~ei zxhbhf zh~ kbokjhfkgkz hf biz zezwhokz ghb kgoefezw~kgi~& \i~ hbbi" hz ghhz|hjekb eo|i~wkfjek {xh hb kjjhzi k gejaiz zezwhokz jxhfwh jif kbwkz ohgegkz

    gh zhmx~egkg" gh oigi {xh fkgeh |xhgk kjjhgh~ k gejakz j~hghfjekbhz&

    Kxzhfjek gh ohgegkz gh |~iwhjjef hf bk jioxfejkjef& Iw~i gh biz kz|hjwiz

    k whfh~ hf jxhfwk hz {xh bk w~kfzoezef gh bkz j~hghfjekbhz ghzgh hb gez|izeweti

    ghb xzxk~ei akzwk biz h{xe|iz ghb |~ithhgi~ zh ~hkbejh jif ohgegkz gh zhmx~egkg

    {xh fi |h~oewkf k wh~jh~iz kjjhgh~ k hbbkz& Hb h`ho|bi oz jbk~i hz hb jed~kgi gh

    hzwkz jioxfejkjeifhz&

    7&>&> Ghwh~ei~i" oigedejkjef eftibxfwk~ek u ibtegi gh j~hghfjekbhz&

    Hf hzwh m~x|i |xhghf efjbxe~zh gedh~hfwhz zewxkjeifhz hf bkz {xh bkz j~hghfjekbhz

    hzwknbhjegkz gh`kf gh zh~ tbegkz i fi |xhghf xwebepk~zh&

    Hb h`ho|bi oz nzeji hz hb ibtegi gh bkz jifw~kzhkz" |h~i wkonef |xhghf ijx~~e~ iw~iz

    efjeghfwhz jioi biz gkiz hf biz wichfz i wk~`hwkz gh kjjhzi& Hf hb jkzi gh bk neiohw~k

    |xhghf gk~zh oigedejkjeifhz dzejkz jioi" |i~ h`ho|bi" bhzeifhz {xh gedejxbwhf bk bhjwx~k

    gh bkz axhbbkz gkjwebk~hz i hb xzi gh bhfwhz gh jifwkjwi {xh gedejxbwhf hz hzjkfhi ghb e~ez&

    7&>&: Kxzhfjek i efhdhjwetegkg gh zezwhokz zhjxfgk~eiz&Uk zhk |i~ hb nbi{xhi ghb zezwhok |~efje|kb i |i~ fi |igh~zh xwebepk~ bkz j~hghfjekbhz"

    zxhbh zh~ fhjhzk~ei hzwknbhjh~ xf zezwhok zhjxfgk~ei gh kxwhfwejkjef !h`0 |~hmxfwk gh

    zhmx~egkg%& Hzwh zezwhok zhjxfgk~ei ghnh gh zh~ wkf ~inxzwi jioi hb zezwhok |~efje|kb"

    uk {xh hf jkzi jifw~k~ei |izenebewk~k xf kjjhzi zhfjebbi k xzxk~eiz fi kxwi~epkgiz&

    Bk efhqezwhfjek gh hzwiz zezwhokz zhjxfgk~eiz |xhgh eo|hge~ bk kxwhfwejkjef gh xzxk~eiz

    bhmweoiz" oehfw~kz {xh bk dkbwk gh zhmx~egkg hf hbbiz |xhgh |h~oewe~ dkbziz |izewetiz&

    7&>&7 H~~i~hz hf hb ~hmezw~i efejekb

    Hb ~hmezw~i efejekb hz xf oiohfwi j~weji |k~k biz dxwx~iz |~ijhziz gh kxwhfwejkjef" |i~

    hbbi jxkb{xeh~ h~~i~ hf b |xhgh kjk~~hk~ |~inbhokz |izwh~ei~ohfwh& Gh hz|hjekb

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    40/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 7< gh 7&8 H~~i~hz hf bk kxwhfwejkjef

    Ghb oezoi oigi {xh zh |xhghf |~igxje~ h~~i~hz hf hb ~hmezw~i" zwiz |xhghf ijx~~e~ hf hb

    oezoi oiohfwi gh bk kxwhfwejkjef& Mhfh~kbohfwh zxhbh w~kwk~zh gh bk|zxz kb efw~igxje~

    biz eghfwedejkgi~hz gh xzxk~ei i bkz j~hghfjekbhz& Wkonef |xhgh w~kwk~zh gh kth~kz i

    kxzhfjek gh biz hbhohfwiz fhjhzk~eiz |k~k efw~igxje~ bk efdi~okjef fhjhzk~ek !whjbkgiz"bhjwi~hz gh wk~`hwkz efwhbemhfwhz" zhfzi~hz u hzjfh~hz neiow~ejiz" hwj&%&

    7&>&4 Kxzhfjek gh xf |~ijhzi gh jifde~okjef kfwh bk oigedejkjef gh

    j~hghfjekbhz u iw~iz jkoneiz zxzwkfjekbhz

    Xfk thp {xh zh |h~oewh {xh xf xzxk~ei zef kxwi~epkjef kjjhgk k xf zezwhok" hz |izenbh

    {xh w~kwh gh ~hkbepk~ jkoneiz jioi bk oigedejkjef gh bkz j~hghfjekbhz gh kjjhzi& Gh

    hzwh oigi" biz xzxk~eiz bhmweoiz fi |ig~kf kjjhgh~ u zx jxhfwk" |h~deb i ~hmezw~i gh

    xzxk~ei {xhgk~k zhjxhzw~kgi& Oz kf" hfw~h hzwkz |izenbhz oigedejkjeifhz hzwk~ bk

    |~i|ek hbeoefkjef gh bk jxhfwk i |h~deb gh xzxk~ei&

    \i~ hbbi" zxhbh zh~ ~hjiohfgknbh {xh hzwh we|i gh oigedejkjeifhz jxhfwhf jif xfiz

    ~h{xezewiz {xh tkukf oz kbb {xh bk oh~k |~hzhfwkjef gh bkz j~hghfjekbhz gh kjjhzi"

    |i~ h`ho|bi bk jifde~okjef k w~ktz gh iw~k jxhfwk i zh~tejei |~htekohfwh tefjxbkgi |h~i

    efgh|hfgehfwh&

    7&>&= Txbfh~kjeifhz gh bk fi~okwetk zin~h |~iwhjjef gh gkwiz |h~zifkbhz

    Bk hbhjjef ghb oighbi gh kxwhfwejkjef u gh bk jkfwegkg gh efdi~okjef {xh zh zibejewk kb

    xzxk~ei" |xhghf whfh~ jifzhjxhfjekz gh geth~zk fgibh h efjbxzi |bkfwhk~ xfk

    txbfh~kjef gh bk fi~okwetk zin~h bk |~iwhjjef gh gkwiz |h~zifkbhz& Hzwi zh ghnh hf

    m~kf ohgegk k bk fhjhzegkg gh efdi~ok~ ghnegkohfwh kb xzxk~ei zin~h bk efdi~okjef {xh

    zh tk k xwebepk~ u biz xziz {xh zh bh tkf k gk~" kghoz gh xfk zh~eh gh inbemkjeifhz hf hb

    kbokjhfkoehfwi u w~kwkoehfwi gh hzwkz efdi~okjeifhz&

    Iw~i gh biz |izenbhz |~inbhokz ~hbkjeifkgiz jif bk |~iwhjjef gh gkwiz u bk |~etkjegkg hf

    biz |~ijhziz gh kxwhfwejkjef hz {xh hb kgoefezw~kgi~ ghzthbh oz efdi~okjef gh bk {xh

    ~hkbohfwh hz hzw~ejwkohfwh fhjhzk~ek& Xf h`ho|bi gh hzwk zewxkjef hz bk efdi~okjef {xh

    zh |xhgh |~i|i~jeifk~ kb zhkbk~ k xf xzxk~ei {xh efwhfwk kn~e~ xfk jxhfwk jif xfk

    ge~hjjef gh ji~~hi hbhjw~feji {xh uk hqezwh xfk jxhfwk kzijekgk k gejak ge~hjjef i {xhfi hqezwh fefmxfk& Bk oh~k jioxfejkjef gh hzwk efdi~okjef tk ji~~hi hbhjw~feji

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    41/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 7; gh 7;Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    hbeoefk~k hf nxhfk ohgegk hzwh ~ehzmi" uk {xh zibkohfwh zh~k tezenbh |k~k {xehf |xhgk

    kjjhgh~ k gejak jxhfwk&

    7&>&1 ^ini i |~gegk gh gkwiz |h~zifkbhzJxkfgi xfk |h~zifk fi kxwi~epkgk kjjhgh kb zezwhok u k bk efdi~okjef jifwhfegk hf b"

    zh jio|~iohwh bk jifdeghfjekbegkg gh bk efdi~okjef& Xfk gh zxz |izenbhz jifzhjxhfjekz

    oz hteghfwhz hf hzwiz jkziz hz bk |~gegk gh |~etkjegkg&

    Iw~i ~ehzmi gh~etkgi ghb h~~i~ hf bk kxwi~epkjef hz bk |~gegk gh bk |~i|ek efdi~okjef" uk

    {xh biz gkwiz |ig~kf zh~ hbeoefkgiz" eo|egefgizh kz {xh biz xzxk~eiz bhmweoiz

    kjjhgeh~kf k hbbk !|~inbhok gh gez|ifenebegkg gh bk efdi~okjef%&

    Hzwh ~ehzmi hz gh hz|hjekb ~hbhtkfjek wkfwi hf onewiz ho|~hzk~ekbhz" gifgh bk |~gegkgh jifdeghfjekbegkg gh bk efdi~okjef |xhgh |ifh~ hf ~ehzmi bk teknebegkg u hb dxwx~i gh

    xfk ho|~hzk" jioi hf bkz |bkwkdi~okz gh ~hghz zijekbhz" uk {xh hf hbbkz zxhbh kbi`k~zh

    oxjak efdi~okjef |h~zifkb&

    7&>&5 Zx|bkfwkjef gh eghfwegkg

    Hb oh~i kjjhzi k xf zezwhok |i~ |k~wh gh xfk |h~zifk fi kxwi~epkgk akjefgizh |kzk~

    |i~ xf xzxk~ei bhmweoi |ig~k jifzegh~k~zh hf z xfk zx|bkfwkjef gh eghfwegkg" |h~i

    hzwk zx|bkfwkjef |xhgh e~ oz kbb ze hb efw~xzi kjwk gh oigi {xh zxz kjjeifhz

    |k~hpjkf zh~ ~hkbepkgkz |i~ hb xzxk~ei bhmweoi&

    Ze nehf hzwh kjjhzi k biz zh~tejeiz u jxhfwkz gh iw~k |h~zifk hz xfk gh bkz |~efje|kbhz

    di~okz gh zx|bkfwkjef gh eghfwegkg" zwk |xhgh gk~zh gh iw~iz oigiz" hzhfjekbohfwh

    ~hmezw~kfgi xfk jxhfwk" |h~deb i xzxk~ei hf fion~h gh iw~k |h~zifk& Gh hzwh oigi" bk

    |h~zifk zx|bkfwkgk |ig~k efjbxzi ghzjifijh~ wkb zx|bkfwkjef&

    Ghnh whfh~zh hf jxhfwk {xh bkz tjweokz gh xfk zx|bkfwkjef fi wehfhf |i~{x zh~

    fejkohfwh |k~wejxbk~hz i |h~zifkz dzejkz" zefi {xh wkonef zh |xhgh zx|bkfwk~ bk

    eghfwegkg gh xfk hfwegkg x i~mkfepkjef" |i~ h`ho|bi ohgekfwh kwk{xhz gh ghdkjefmk

    xfk |mefk }hn" i gh zx|bkfwkjef gh bk eghfwegkg ghb zh~tegi~ }hn" jioi hfhfthfhfkoehfwi GFZ i hb |ak~oefm&

    Tk~ekz zif bkz jifzhjxhfjekz oz hteghfwhz gh xfk zewxkjef gh zx|bkfwkjef gh

    eghfwegkg0

    D~kxgh0 Bk zx|bkfwkjef gh eghfwegkg |xhgh whfh~ jioi in`hweti hb d~kxgh

    hjifoeji" |i~ h`ho|bi hf jkzi gh {xh zh zx|bkfwh k xfk ho|~hzk x

    i~mkfepkjef {xh |~hzwh xfiz zh~tejeiz k jkonei gh jifw~k|~hzwkjeifhz

    hjifoejkz& Hf hzwh jkzi hb xzx~|kgi~ |xhgh bbhmk~ k ~hjene~ biz efm~hziz {xh

    hdhjwkf xzxk~eiz zef id~hjh~ k jkonei biz zh~tejeiz kfxfjekgiz&

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    42/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 7> gh 7>Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Jioezef gh ghbewiz0 Hb hqw~hoi oz m~kth gh bk zx|bkfwkjef gh eghfwegkg hz bk

    jioezef gh ghbewiz" gh oigi {xh hb zx|bkfwkgi~ |ig~k {xhn~kfwk~ bk bhu gh wkb

    di~ok {xh |k~hpjk {xh {xehf bi akjh hz bk |h~zifk zx|bkfwkgk& Hzwh hqw~hoi hz

    oz m~kth ze jknh jxkfgi bk zx|bkfwkjef zh bbhtk k jkni xwebepkfgi efdi~okjef

    neiow~ejk" uk {xh zh w~kwk gh xfk efdi~okjef oxu gedjeb gh zeoxbk~ u |i~ wkfwi gh

    ~h|~ink~ hf xf |~ijhzi `xgejekb&

    Gkiz hf bk eokmhf |nbejk0 Biz hdhjwiz gh {xh xfk |h~zifk zx|bkfwh bk

    eghfwegkg gh iw~k |xhghf zh~ tk~eiz" |h~i jbk~kohfwh |xhghf |~igxje~zh gkiz k

    zx eokmhf |nbejk& Hf oxjakz ijkzeifhz bk k|~i|ekjef gh xfk eghfwegkg zh

    tefjxbk jif kjiziz jxui in`hweti hz |~itijk~ xf gki k bk |h~zifk zx|bkfwkgk&

    Hf hzwiz jkziz bk zx|bkfwkjef hz xf |~eoh~ |kzi efzw~xohfwkb k xfk jifgxjwk

    oz jio|bh`k {xh |xhgh kgi|wk~ obwe|bhz okfedhzwkjeifhz& \i~ h`ho|bi" hbzx|bkfwkgi~ |xhgh kgi|wk~ jifgxjwkz hzjkfgkbizkz" okfedhzwk~ i|efeifhz

    zijekbohfwh efkjh|wknbhz" efwh~kjwxk~ jif biz jifwkjwiz gh bk tjweok gh oigi

    km~hzeti" hwj& Wigkz hzwkz jifgxjwkz zxhbhf |h~zhmxe~ hb in`hweti gh id~hjh~ xfk

    dkbzk eokmhf |nbejk ghb zx|bkfwkgi jif hb in`hweti gh kwkjk~ zx ~h|xwkjef&

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    43/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 7: gh 7:Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    8 N XHF KZ \ J WEJ KZ \ K K KG OEF EZ W KGI H Z

    Bkz hfwegkghz {xh mhzweifkf zezwhokz gh kxwhfwejkjef wehfhf bk ~hz|ifzknebegkg gh

    hzwknbhjh~ xf oighbi wjfeji" i~mkfepkweti u `x~geji ~hz|hwxizi jif biz gh~hjaiz gh bkz

    |h~zifkz eo|bejkgkz |k~k hzwknbhjh~ xfk ~hbkjef gh jifdekfpk" kz jioi gh eo|bhohfwk~bkz ohgegkz gh zhmx~egkg zxdejehfwhz |k~k |~iwhmh~ kghjxkgkohfwh bk efdi~okjef

    |h~zifkbhz gh zxz xzxk~eiz&

    \k~k hbbi" k jifwefxkjef zh zhkbk xfk zh~eh gh nxhfkz |~jwejkz u ~hjiohfgkjeifhz

    ~hdh~egkz k bk kxwhfwejkjef gh bk eghfwegkg {xh ghnh~kf zh~ whfegkz hf jxhfwk |i~ |k~wh

    gh biz mhzwi~hz u ghzk~~ibbkgi~hz gh zezwhokz gh kxwhfwejkjef&

    8&; HBHJJEF KGHJXKGK GHB WE\I GH J^HGHFJEKB

    Ghzgh xfk |h~z|hjwetk gh zhmx~egkg" bk ghwh~oefkjef ghb we|i gh efdi~okjef {xh tk kzh~ xwebepkgk |k~k bk kxwhfwejkjef hz xf |~eoh~ |kzi hzhfjekb" uk {xh hf nxhfk ohgegk

    beoewk~ biz ~ehzmiz& Kz" hb xzi gh zezwhokz gh ginbh dkjwi~ zeho|~h {xh zhk |izenbh

    kxohfwk jifzegh~knbhohfwh biz fethbhz gh zhmx~egkg d~hfwh k |izenbhz kjjhziz fi

    kxwi~epkgiz i dkbziz |izewetiz&

    Ze nehf hz jeh~wi {xh biz zezwhokz gh kxwhfwejkjef nkzkgiz hf bk neiohw~k zif kbwkohfwh

    deknbhz" hz fhjhzk~ei ~hji~gk~ {xh" kghoz gh eo|bejk~ okui~hz fhjhzegkghz hf jxkfwi k

    ~hjx~ziz jio|xwkjeifkbhz" biz gkwiz neiow~ejiz |xhghf jifzegh~k~zh gkwiz gh jk~jwh~

    |h~zifkb gh hz|hjekb |~iwhjjef" |i~ bi {xh zx xzi jifbbhtk xfk zh~eh gh inbemkjeifhzbhmkbhz zx|h~ei~hz k bkz gh~etkgkz gh bk xwebepkjef gh gez|izewetiz dzejiz i jifw~kzhkz&

    Hf hzwk hbhjjef zh ghnh jifzegh~k~ k zx thp biz gedh~hfwhz we|iz gh gez|izewetiz ghzgh

    biz {xh zh tk k w~kwk~ gh kjjhgh~ kb zezwhok" uk {xh hz |izenbh {xh fi hf wigiz biz jkziz

    zhk dkjwenbh bk xwebepkjef gh gedh~hfwhz hbhohfwiz dzejiz |k~k bk kxwhfwejkjef& K hzwh

    ~hz|hjwi zh ghnh zhkbk~ hb jifzwkfwh ghzk~~ibbi gh fxhtkz zibxjeifhz |k~k dkjebewk~ bk

    xwebepkjef gh biz gedh~hfwhz hbhohfwiz k w~ktz gh gedh~hfwhz ohgeiz& Jioi h`ho|bi gh

    hbbi |xhgh fion~k~zh hb |~iuhjwi GFEh G~ieg" ghzk~~ibbkgi |i~ EFWHJI |k~k |h~oewe~ bk

    xwebepkjef ghb GFE hbhjw~feji hf zok~w|aifhz {xh jxhfwhf jif hb zezwhok i|h~kweti

    Kfg~ieg>>&

    8&> \^HTHFJEF D^HFWH K KWK[XHZ GH DXH^PK N^XWK

    Kfwh bk |izenebegkg gh {xh xf kwkjkfwh w~kwh gh kjjhgh~ k xf zezwhok |~inkfgi gedh~hfwhz

    j~hghfjekbhz" hz ~hjiohfgknbh hzwknbhjh~ xf zezwhok gh nbi{xhi {xh eo|egk jxkb{xeh~

    kjjhzi w~kz ~hmezw~k~zh ghwh~oefkgi foh~i gh efwhfwiz dkbbegiz& Hzwh boewh ghnh |h~oewe~

    {xh hb xzxk~ei kjjhgk |hzh k aknh~ jiohwegi kbmf h~~i~ kb w~kwk~ gh kjjhgh~" |i~ hbbi hb

    nbi{xhi mhfh~kbohfwh fi zh |~igxjh akzwk xf {xefwi efwhfwi dkbbegi&

    >>aww|0))}}}&efwhji&hz)|~hzz^iio)\~hfzk)KjwxkbegkgYEFWHJI)GFEhYG~ieg

    8& Nxhfkz |~jwejkz |k~k kgoefezw~kgi~hz

    http://www.inteco.es/pressRoom/Prensa/Actualidad_INTECO/DNIe_Droidhttp://www.inteco.es/pressRoom/Prensa/Actualidad_INTECO/DNIe_Droidhttp://www.inteco.es/pressRoom/Prensa/Actualidad_INTECO/DNIe_Droidhttp://www.inteco.es/pressRoom/Prensa/Actualidad_INTECO/DNIe_Droid
  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    44/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 77 gh 77Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    W~kz bbhtk~zh k jkni hzwh nbi{xhi zh ghnhf aknebewk~ zezwhokz zhjxfgk~eiz gh

    kxwhfwejkjef" uk zhk |k~k hb kjjhzi i |k~k bk ~hghdefejef gh fxhtkz j~hghfjekbhz&

    Jioi kbwh~fkwetk kb nbi{xhi" uk {xh zwh jifteh~wh kb bhmweoi xzxk~ei hf bk tjweok kb fi|igh~ kjjhgh~ k zxz zh~tejeiz i |h~debhz" i gh di~ok jio|bhohfwk~ek zh |xhgh jifzegh~k~

    bk efji~|i~kjef gh zezwhokz jioi biz jifijegiz jioi jk|wjakz" {xh hqemhf xfk

    jio|~inkjef gh {xh {xehf w~kwk gh kxwhfwejk~zh hz xf axokfi" fi xf zezwhok

    efdi~oweji {xh |xhgk kxwiokwepk~ biz kwk{xhz gh dxh~pk n~xwk& Hzwiz zezwhokz |xhghf

    jifzezwe~ hf ghzjed~k~ xfk |kbkn~k i jifw~kzhk {xh zh |~hzhfwk gezwi~zeifkfgi zxz

    jk~kjwh~hz i hqeme~ bk ~hz|xhzwk gh xfk |~hmxfwk jioi |i~ h`ho|bi xfk zxok&

    8&: ZEZWHOKZ ZHJXFGK^EIZ ZHMX^IZ

    Hz fhjhzk~ei {xh zh eo|bkfwhf zezwhokz zhjxfgk~eiz {xh |izenebewhf hb kjjhzi hf jkzi gh{xh hb zezwhok |~efje|kb fi |xhgk xwebepk~zh |i~ jxkb{xeh~ oiweti& Hzwiz zezwhokz

    zhjxfgk~eiz |xhghf bbhmk~ efjbxzi k xf wh~jh~ fethb hf jkzi gh {xh hb zezwhok zhjxfgk~ei

    hzwknbhjegi fi |xhgk zh~ web& H`ho|bi gh hbbi hz bk |izenebegkg gh {xh hb zezwhok

    zhjxfgk~ei hzwknbhjegi jifzezwk hf hb hfti gh xfkz fxhtkz j~hghfjekbhz" i gh xf kjjhzi

    |k~k ~hghdefe~bkz" k xfk jxhfwk gh ji~~hi" |xgehfgi hb xzxk~ei aknh~ jkfjhbkgi gejak

    ge~hjjef i |h~gegi zx jifw~ib&

    Biz zezwhokz zhjxfgk~eiz gh kxwhfwejkjef ghnhf jifwk~ jif hb oezoi fethb gh zhmx~egkg

    {xh zh hqemh hf hb ohjkfezoi |~efje|kb" uk {xh hf jkzi gh ~h{xh~e~ ohfi~hz hqemhfjekz|ig~kf jifth~we~zh hf xfk |xh~wk kneh~wk gh jk~k k |izenbhz zx|bkfwkjeifhz&

    Xfi gh biz zezwhokz zhjxfgk~eiz oz xwebepkgiz hz di~oxbk~ xfk |~hmxfwk {xh hb xzxk~ei

    ak ghwh~oefkgi jif kfwh~ei~egkg `xfwi k zx ~hz|xhzwk& Hf oxjaiz jkziz zh zxmeh~hf

    kbmxfkz |~hmxfwkz {xh ~hkbohfwh fi |xhghf jifzegh~k~zh zhmx~kz kb |igh~ zh~

    ~hz|ifgegkz |i~ jxkb{xeh~ |h~zifk {xh jifipjk ofeokohfwh kb xzxk~ei" gh oigi {xh

    |ig~k bbhmk~ k zx|bkfwk~ zx eghfwegkg u kjjhgh~ k zx |h~deb i jxhfwk zef zx

    jifzhfweoehfwi& H`ho|bi gh hzwkz |~hmxfwkz gh zhmx~egkg zif hb fion~h gh kbmf

    dkoebek~" gh xfk okzjiwk" gh zx |~eoh~ jibhmei i gh zx |hbjxbk dkti~ewk&

    Wko|iji |xhgh jifzegh~k~zh zhmx~i xf zezwhok gh kxwhfwejkjef zhjxfgk~ei hf hb {xh

    zh xwebejh k iw~iz xzxk~eiz jioi mk~kfwhz gh xfk eghfwegkg" uk {xh zh dkjebewk~k xf kwk{xh

    ohgekfwh efmhfeh~k zijekb |k~k kjjhgh~ k xf ghwh~oefkgi zh~tejei& Xf h`ho|bi gh hbbi

    zh~k xf zh~tejei ifbefh {xh |k~k ~hzwknbhjh~ xfk jifw~kzhk hf jkzi gh ibtegi |egk {xh

    zh zhkbhf ghwh~oefkgiz xzxk~eiz {xh zh jifzegh~hf jifwkjwiz gh jifdekfpk |k~k {xh

    th~ede{xhf bk eghfwegkg gh {xehf {xeh~h ~hzwknbhjh~ bk jifw~kzhk& Hzwh zezwhok dkjebewk~k

    kjjhziz efghnegiz uk {xh ghbhmk hf iw~iz xzxk~eiz bk kxwhfwejkjef" zhkf hzwiz jifwkjwiz

    ~hkbhz i j~hkgiz |k~k hzwknbhjh~ xf kwk{xh ohgekfwh efmhfeh~k zijekb&

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    45/64

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    46/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 74 gh 74Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Gh hzwh oigi" bk hbhjjef gh jifw~kzhkz ghnh efjbxe~ xfkz jifgejeifhz gh jio|bh`egkg

    jioi |xhghf zh~ xfk bifmewxg ofeok u bk efjbxzef gh okuzjxbkz" oefzjxbkz"

    foh~iz u zonibiz&

    Ghb oezoi oigi" hz ~hjiohfgknbh eo|hge~ hb xzi gh jionefkjeifhz ghokzekgi

    zhfjebbkz" jioxfhz i djebhz gh kgetefk~ !|i~ h`ho|bi0 |kzz}i~g" jifw~kzhk" {}h~wu"

    ;>:784" knj;>:%&

    \i~ iw~i bkgi" ghnh ~hjiohfgk~zh k biz xzxk~eiz defkbhz {xh htewhf {xh bkz jifw~kzhkz

    zhkf i efjbxukf gkwiz |h~zifkbhz& Hzwk ~hjiohfgkjef |xhgh bbhmk~ k jifth~we~zh hf xfk

    |~iaenejef hf kbmxfiz jkziz" jioi |i~ h`ho|bi hf bi {xh ~hz|hjwk kb xzi gh biz oezoiz

    gkwiz {xh zh akf k|i~wkgi hf hb ~hmezw~i !fion~h" dhjak gh fkjeoehfwi" foh~i gh

    whbdifi" hwj&%&

    \i~ iw~i bkgi" biz mhzwi~hz gh biz zezwhokz ghnhf |~ioith~" h efjbxzi hqeme~" bk

    ~hfitkjef gh bkz jifw~kzhkz jkgk jeh~wi weho|i&

    8&= JIO\^INKJEF GH J^HGHFJEKBHZ HF HB ^HMEZW^I

    Hf hb ~hmezw~i ghnhf hzwknbhjh~zh jbk~kohfwh bkz efdi~okjeifhz {xh zh xwebepk~f |k~k

    |izwh~ei~hz kjjhziz u kxwhfwejkjeifhz& \i~ hbbi zh ghnh |~hzwk~ hz|hjekb kwhfjef kb

    jio|~ink~ {xh hb xzxk~ei fi jiohwh h~~i~hz {xh bh |xhgkf eo|hge~ hb kjjhzi hf hb

    dxwx~i&

    Xf h`ho|bi gh hzwk zewxkjef hz whjbhk~ h~~fhkohfwh xfk jifw~kzhk hf hb |~ijhzi gh

    ~hmezw~i& Hzwk zewxkjef |xhgh htewk~zh hqemehfgi {xh bk oezok zhk whjbhkgk giz thjhz u

    jio|~inkfgi {xh jifjxh~gk" kghoz gh ktezk~ kb xzxk~ei hf jkzi gh {xh hb whjbkgi

    okfwhfmk kjwetk kbmxfk dxfjef jioi bk hzj~ewx~k hf okuzjxbkz&

    8&1 HZWKNBHJH^ OHGEGKZ GH ZHMX^EGKG KFWH JKONEIZ GH

    J^HGHFJEKBHZ U IW^KZ OIGEDEJKJEIFHZ GH JKBKGI

    Hz fhjhzk~ei {xh ghwh~oefkgiz jkoneiz hf bk jifdemx~kjef gh xzxk~ei" jioi |i~

    h`ho|bi bk oigedejkjef gh j~hghfjekbhz i bk hbeoefkjef gh bk jxhfwk i |h~deb" zh|~igxpjkf w~kz jio|~ink~zh fxhtkohfwh bk eghfwegkg ghb xzxk~ei&

    Gejak jio|~inkjef ghnh~k ~hkbepk~zh ohgekfwh xf zezwhok gedh~hfwh kb ho|bhkgi |k~k

    hb kjjhzi" gh oigi {xh hf jkzi gh {xh xf kwkjkfwh |xgeh~k zx|h~k~ hb zezwhok gh

    kxwhfwejkjef efejekb fi |xhgk eo|hge~ kb bhmweoi xzxk~ei hb kjjhzi&

    8&5 EO\BEJKJEF GH WH^JH^IZ

    Bk eo|bejkjef gh iw~iz kmhfwhz hf hb |~ijhzi gh kxwhfwejkjef ghnh bbhtk~zh k jkni jif

    hz|hjekb jkxwhbk" uk {xh |xhgh bbhmk~ k |h~oewe~zh {xh hzwiz wh~jh~iz jifipjkfghwh~oefkgiz gkwiz gh eghfwedejkjef&

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    47/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 7= gh 7=Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    Bk kxwhfwejkjef dhgh~kgk hz xf jbk~i h`ho|bi hf hb {xh bk kxwhfwejkjef zh bbhtk k jkni

    jifwkfgi jif oz kmhfwhz eo|bejkgiz {xh hb |~i|ei xzxk~ei u hb |~ithhgi~ gh zh~tejeiz&

    Hzwh we|i gh kxwhfwejkjef hz ~hjiohfgknbh zeho|~h {xh hb kmhfwh th~edejkgi~ i

    kxwhfwejkgi~ |~hzhfwh mk~kfwkz hf ~hdh~hfjek kb ~hz|hwi gh bk |~etkjegkg gh biz xzxk~eiz&

    Hf jxkb{xeh~ jkzi" hb kjjhzi k bk efdi~okjef gh eghfwedejkjef zh ghnh beoewk~ k wh~jh~iz

    {xh whfmkf xfk |izejef `xzwedejkgk u deknbh hf jkgk jkzi&

    8&;< KBOKJHFKOEHFWI ZHMX^I

    Bk efdi~okjef gh kxwhfwejkjef hz kbokjhfkgk hf biz zezwhokz ghb kmhfwh hfjk~mkgi ghb

    |~ijhzi gh kxwhfwejkjef |k~k kz |igh~ xwebepk~bk kb jio|~ink~ bk jifji~gkfjek gh zwk

    jif bk k|i~wkgk |i~ biz xzxk~eiz ghb zh~tejei& Hzwi inbemk k {xh gejai kbokjhfkoehfwi

    jxhfwh jif kbwkz ohgegkz gh zhmx~egkg |k~k {xh fkgeh |xhgk kjjhgh~ k hbbk zefkxwi~epkjef&

    Hzwkz ohgegkz ghnhf eo|hge~ {xh fkgeh |xhgk kjjhgh~ k bkz j~hghfjekbhz ghb ~hzwi gh

    xzxk~eiz" |h~i ghnhf hzwknbhjh~ wkonef {x |h~zifkz i |h~debhz gh xzxk~ei ghfw~i bk

    i~mkfepkjef |~hzwkgi~k gh zh~tejeiz |xhghf kjjhgh~ k hbbkz& Hz ghje~" hf bk ghdefejef gh

    ~ibhz u ~hz|ifzknebegkghz gh bk i~mkfepkjef zh ghnh ghbeoewk~ hb kjjhzi k bkz

    j~hghfjekbhz gh biz xzxk~eiz jbehfwhz&

    Hf jxkb{xeh~ jkzi" zeho|~h hz kjifzh`knbh {xh bk efdi~okjef kbokjhfkgk hzw jed~kgk"

    gh oigi {xh efjbxzi hf jkzi gh {xh kbmxehf |xgeh~k zx|h~k~ bkz gedh~hfwhz ohgegkz gh

    zhmx~egkg" zwh fi |xgeh~k kjjhgh~ k bkz j~hghfjekbhz&

    Hz fhjhzk~ei whfh~ hf jxhfwk k zx thp hb bxmk~ gifgh zh bijkbepkf biz zh~tegi~hz hf biz

    {xh zh kbokjhfk~ bk efdi~okjef gh kxwhfwejkjef" ghnegi hz|hjekbohfwh k bkz gedh~hfwhz

    bhmezbkjeifhz k|bejknbhz hf jkgk |kz ~hz|hjwi k biz zezwhokz gh zhmx~egkg u bk

    |~iwhjjef gh gkwiz |h~zifkbhz&

    8&;; W^KFZOEZEF JED^KGK

    Hb efwh~jkonei gh efdi~okjef hfw~h biz gez|izewetiz gh biz xzxk~eiz u biz h{xe|iz hf biz{xh zh kbi`k hb zezwhok" u hz|hjekbohfwh hb efwh~jkonei gh j~hghfjekbhz" ghnh ~hkbepk~zh

    gh oigi {xh fkgeh k`hfi k hzwh efwh~jkonei |xhgk jifijh~ hzwk efdi~okjef& \k~k hbbi"

    zh kjifzh`k {xh hzwk efdi~okjef zh jed~h" gh oigi {xh hf jkzi gh {xh kbmxehf |xhgk

    kjjhgh~ k bkz j~hghfjekbhz hftekgkz fi zhk jk|kp gh efwh~|~hwk~bkz&

    Hzwk nxhfk |~jwejk hz gh hz|hjekb ~hbhtkfjek hf hb ghzk~~ibbi gh k|bejkjeifhz u zh~tejeiz

    |k~k gez|izewetiz otebhz" uk {xh xwebepkf whjfibimkz efkbon~ejkz u |i~ wkfwi zxz

    w~kfzoezeifhz zif oz djebhz gh efwh~jh|wk~& Zh akf ghwhjwkgi fxoh~iziz jkziz hf biz

    {xh bk efdi~okjef zh w~kfzoewh hf whqwi |bkfi" |bhfkohfwh bhmenbh |k~k jxkb{xeh~k"|ifehfgi kz hf ~ehzmi bk |~etkjegkg gh hzwkz j~hghfjekbhz&

  • 7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online

    48/64

    Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 71 gh 71Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef

    8&;> FI K\I^WK^ OZ EFDI^OKJEF GH BK GHNEGK ZIN^H BIZ XZXK^EIZ

    Bk kjwxkjef gh biz |~hzwkgi~hz gh zh~tejeiz u gh biz kmhfwhz hfjk~mkgiz gh bk

    kxwhfwejkjef ghnh whfh~ hfw~h zxz |~hoezkz bk jifzh~tkjef gh bk |~etkjegkg gh bizxzxk~eiz" |i~ bi {xh fi ghnhf k|i~wk~ efdi~okjef kjh~jk gh hbbiz zkbti hf jkziz

    wiwkbohfwh eo|~hzjefgenbhz&

    \i~ h`ho|bi" hz aknewxkb {xh kb w~kwk~ gh ~hkbepk~ xf fxhti ~hmezw~i hf hb {xh zh xwebejh

    efdi~okjef uk ~hmezw~kgk zh ktezh gh hzwk zewxkjef" |i~ h`ho|bi efdi~okfgi gh {xh bk

    ge~hjjef gh ji~~hi hbhjw~feji {xh zh efwhfwk xwebepk~ |k~k ~hmezw~k~zh hf xf zh~tejei uk ak

    zegi xwebepkgk |k~k ~hmezw~k~zh kfwh~ei~ohfwh& Hzw |~jwejk k|i~wk oz efdi~okjef gh bk

    {xh ghnh~k zin~h biz xzxk~eiz ghb zezwhok" uk {xh hf hb jkzi gh jeh~wiz gkwiz {xh

    |ig~kf eghfwedejk~ k xfk |h~zifk" |i~ h`ho|bi zx ge~hjjef gh ji~~hi hbhjw~feji"

    |ifg~kf hf hteghfjek {xh gejak |h~zifk zh ak ~hmezw~kgi hf hb zh~tejei&

    Hzwk zewxkjef zh |xhgh htewk~" |i~ h`ho|bi" ~hkbepkfgi gejak fiwedejkjef ohgekfwh xf

    ji~~hi hbhjw~feji" gh oigi {xh zibkohfwh |xgeh~k jifijh~ hzwh ktezi hb xzxk~ei jif

    kjjhzi k hzk jxhfwk gh ji~~hi&

    Ghb oezoi oigi {xh fi zh ghnh~k efdi~ok~ zin~h ze xfk efdi~okjef uk ak zegi

    ~hmezw~kgk" wko|iji zh ghnh~k efdi~ok~ hf jkzi gh {xh fi bi hzwxteh~k& Hf hzwh jkzi bk

    zewxkjef efkghjxkgk |ig~k ijx~~e~ wkfwi hf hb |~ijhzi gh ~hmezw~i jioi hf hb |~ijhzi gh

    kxwhfwejkjef&

    8&;: ^H[XEZEWIZ BHMKBHZ

    Kb mhzweifk~ biz zezwhokz gh kxwhfwejkjef zh ghnh whfh~ hf jxhfwk {xh wkfwi bk

    efdi~okjef xwebepkgk hf hb |~ijhzi gh kxwhfwejkjef jioi bk efdi~okjef {xh zh |~iwhmh

    ohgekfwh hzwh ohjkfezoi" h efjbxzi biz zh~tejeiz k biz {xh zh gk kjjhzi" |xhghf jifwk~

    jif ghwh~oefkgiz ~h{xezewiz bhmkbhz&

    Gh hzwh oigi" hz fhjhzk~ei tkbi~k~ hf jkgk jkzi jxbhz zif bkz eo|bejkjeifhz bhmkbhz k

    bkz {xh zh ghnh akjh~ d~hfwh" |xgehfgi hf oxjaiz jkziz zh~ fhjhzk~ei ~h|bkfwhk~ghwh~oefkgiz kz|hjwiz ghb |~ijhzi gh kxwhfwejkjef gezhkgi&

    Xf jbk~i h`ho|bi gh hzwkz zewxkjeifhz hz hb xzi gh ghwh~oefkgkz efdi~okjeifhz

    neiow~ejkz {xh" kb |igh~ bbhmk~ k zhkbk~ kz|hjwiz zin~h bk zkbxg i hb i~emhf wfeji"

    |ig~kf fhjhzewk~ xf w~kwkoehfwi hz|hjekb |k~k |igh~ jxo|be~ biz ~h{xezewiz hzwknbhjegiz

    |i~ bk Bhu I~mfejk gh \~iwhjjef gh Gkwiz gh Jk~jwh~ \h~zifkb !BI\G%&

    Bkz oezokz jifzegh~kjeifhz zh ghnhf whfh~ hf jxhfwk hf hb |~ijhzi gh ~hmezw~i" uk {xh