Post on 04-Apr-2018
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
1/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ; gh ;Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Mxk zin~h ~ehzmiz u nxhfkz
|~jwejkz hf kxwhfwejkjef ifbefh
EFZWEWXWI FKJEIFKB GH WHJFIBIMKZ GHBK JIOXFEJKJEF
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
2/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk > gh >Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Hgejef0 Fitehon~h >
Bk Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh ak zegi hbkni~kgk |i~ hb
zemxehfwh h{xe|i gh w~knk`i ghb Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef !EFWHJI%0
\knbi \~hp Zkf/@iz !ge~hjjef%
Hgxk~gi btk~hp Kbifzi !jii~gefkjef%
Zxzkfk gh bk Dxhfwh ^ig~mxhp
J~ezwefk Mxwe~~hp Ni~mh
Kzeoezoi" ak jifwkgi jif hb k|iui wjfeji gh Emfkjei Kbkoebbi !Kzw~hk Bk Efdi|ezwk @x~gejk% u
^ejk~g Ok~wfhp !Xfeth~zewkw gh Tkbfjek%
Hb Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef !EFWHJI% hz xfk zijehgkg hzwkwkb
kgzj~ewk kb Oefezwh~ei gh Efgxzw~ek" Hfh~mk u Wx~ezoi k w~ktz gh bk Zhj~hwk~k gh Hzwkgi gh
Whbhjioxfejkjeifhz u |k~k bk Zijehgkg gh bk Efdi~okjef& Bk oezef gh EFWHJI hz ~hdi~pk~ bk
jenh~zhmx~egkg" bk |~etkjegkg u bk jifdekfpk hf biz zh~tejeiz gh bk Zijehgkg gh bk Efdi~okjef"
k|i~wkfgi tkbi~ k biz jexgkgkfiz" ho|~hzkz" KK&\\& u kb zhjwi~ WEJ" u jii~gefkfgi hzdxh~piz jif
biz i~mkfezoiz fkjeifkbhz h efwh~fkjeifkbhz {xh w~knk`kf hf hzwk okwh~ek& Zx Inzh~tkwi~ei gh bk
Zhmx~egkg gh bk Efdi~okjef !aww|0))inzh~tkwi~ei&efwhji&hz% wehfh jioi in`hweti ghzj~ene~" kfkbepk~"kzhzi~k~ u gedxfge~ bk jxbwx~k gh bk zhmx~egkg" bk |~etkjegkg u bk h/jifdekfpk&
Bk ~hkbepkjef gh hzwh gijxohfwi zh ak defkfjekgi ghfw~i ghb |~iuhjwi ZH^\BKMI
!Zh~tejeiz zin~h |bkwkdi~ok jbixg |k~k |~ijhziz ifbefh gh mineh~fi u kgoefezw~kjef
hbhjw~fejiz% |i~ bk jiftijkwi~ek >
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
3/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk : gh :Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
; EFW^IGXJJEF &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& 4> BK KXWHFWEJKJEF IFBEFH &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& 1
>&; BIZ ^KZMIZ GH KXWHFWEJKJEF 1>&> DKJWI^HZ GH KXWHFWEJKJEF ;&: \^IJHZI GH ^HMEZW^I ;>>&7 \^IJHZI GH KXWHFWEJKJEF ;8
: ^HMXBKJEF BHMKB GH BK KXWHFWEJKJEF GH BKEGHFWEGKG GEMEWKB &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& >>:&; HB ^HJIFIJEOEHFWI U KW^ENXJEF GH BK EGHFWEGKG >>:&> BK DE^OK HBHJW^FEJK >7:&: BIZ JH^WEDEJKGIZ GEMEWKBHZ >5:&7 HB GFE HBHJW^FEJI0 XF JKZI HZ\HJEKB :7:&8 BK EGHFWEDEJKJEF GEMEWKB D^HFWH K BK KGOEFEZW^KJEF :4
7 ^EHZMIZ \K^K BK ZHMX^EGKG U BK \^ETKJEGKG &&&&&&&&&&&&&& :17&; \^EFJE\KBHZ H^^I^HZ :17&> ^EHZMIZ HF BIZ \^IJHZIZ GH KXWHFWEJKJEF :1
8
NXHFKZ \^JWEJKZ \K^K KGOEFEZW^KGI^HZ &&&&&&&&&&&&&&&&&& 7:
8&; HBHJJEF KGHJXKGK GHB WE\I GH J^HGHFJEKB 7:8&> \^HTHFJEF D^HFWH K KWK[XHZ GH DXH^PK N^XWK 7:8&: ZEZWHOKZ ZHJXFGK^EIZ ZHMX^IZ 778&7 ^H[XEZEWI GH TH^EDEJKJEF GH EGHFWEGKG ^HKB 78
8&8 HZWKNBHJH^ XFK NXHFK \IBWEJK GH HBHJJEF GHEGHFWEDEJKGI^HZ GH XZXK^EI 78
fgejh
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
4/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 7 gh 7Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
8&4 HQEME^ JEH^WK JIO\BH@EGKG GH BKZ J^HGHFJEKBHZ 788&= JIO\^INKJEF GH J^HGHFJEKBHZ HF HB ^HMEZW^I 748&1 HZWKNBHJH^ OHGEGKZ GH ZHMX^EGKG KFWH JKONEIZ GHJ^HGHFJEKBHZ U IW^KZ OIGEDEJKJEIFHZ GH JKBKGI 748&5 EO\BEJKJEF GH WH^JH^IZ 748&;FI K\I^WK^ OZ EFDI^OKJEF GH BK GHNEGK ZIN^H BIZXZXK^EIZ 718&;:^H[XEZEWIZ BHMKBHZ 718&;7ZH^TEJEI OXBWE\BKWKDI^OK H EFWH^I\H^KNEBEGKG 758&;8KXWHFWEJKJEF NKZKGK HF JH^WEDEJKGIZ 75
4 HQ\H^EHFJEKZ GH QEWI &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& 8
= ^HJIOHFGKJEIFHZ \K^K BIZ XZXK^EIZ &&&&&&&&&&&&&&&&&&&&&&&&&& 87=&; XWEBEPK^ JIFW^KZHKZ INXZWKZ 87
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
5/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 8 gh 8Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
=&> FI JIO\K^WE^ FE \IFH^ KB KBJKFJH GH IW^IZ BKZJ^HGHFJEKBHZ 87=&: XWEBEPK^ GEDH^HFWHZ JIFW^KZHKZ \K^K JKGK ZH^TEJEI 88=&7 OIGEDEJK^ BKZ JIFW^KZHKZ HMXBK^OHFWH 88=&8 JIFDEMX^K^ KGHJXKGKOHFWH BKZ I\JEIFHZ GHZHMX^EGKG 88=&4 JIFWKJWK^ JIF HB KGOEFEZW^KGI^ HF JKZI GH EFJEGHFWH 88
=&=
MHZWEF ZHMX^K GH JH^WEDEJKGIZ 84
=&1 XZK^ HB GFE HBHJW^FEJI \K^K DE^OK^ U \K^K W^OEWHZ 841 JIFJBXZEIFHZ &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& 8=5 MBIZK^EI &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& 4
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
6/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 4 gh 4Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
; EFW^IGXJJEF
Hf bk zijehgkg gh bk efdi~okjef fxhzw~k eghfwegkg jifzwewxuh xf hbhohfwi tkbeizi u
oh~hjhgi~ gh |~iwhjjef `x~gejk& K bk ai~k gh ~hkbepk~ xfk jio|~k ifbefh" xf w~oewh
kgoefezw~kweti k w~ktz gh Efwh~fhw i kb xwebepk~ bkz ~hghz zijekbhz" |i~ h`ho|bi" gez|ifh~ ghxfk eghfwegkg u |igh~ h`h~jh~ xf jifw~ib ~hkb zin~h zxz gezwefwiz kw~enxwiz jifzwewxuh xf
hbhohfwi hzhfjekb |k~k mk~kfwepk~ fxhzw~iz gh~hjaiz& Oz kf" k ohgegk {xh bk
htibxjef gh bkz whjfibimkz gh bk efdi~okjef mhfh~h fxhtiz |~igxjwiz u zh~tejeiz" bk
mhzwef gh bk eghfwegkg hf hb hfwi~fi ifbefh zh jifth~we~ hf xf kz|hjwi j~weji u" |i~
wkfwi" hb |~ijhzi gh kxwhfwejkjef gh bk oezok zh~ jkgk thp oz eo|i~wkfwh&
Hb ~hjifijeoehfwi u bk jifde~okjef gh bk eghfwegkg gh biz xzxk~eiz hz xfk gh bkz wk~hkz
oz hqwhfgegkz u fhjhzk~ekz hf bk |~hzwkjef gh zh~tejeiz u bk kxwi~epkjef gh kjjhziz&
Hb in`hweti gh hzwkz wk~hkz hz {xh wkfwi biz zh~tejeiz jioi hb kjjhzi zibkohfwh |xhgkfzh~ xwebepkgiz |i~ biz bhmweoiz xzxk~eiz&
Hb ghzk~~ibbi gh bk Zijehgkg gh bk Efdi~okjef u bk |~hzwkjef gh zh~tejeiz ifbefh akf
w~kzbkgkgi hzwk fhjhzegkg ghb oxfgi iddbefh kb oxfgi ifbefh& Hzwi zh ghnh k {xh wkfwi
biz zh~tejeiz }hn jioi bkz jxhfwkz u |h~debhz hf hbbiz wehfhf xf wewxbk~" {xh hz bk |h~zifk
kxwi~epkgk |k~k kjjhgh~ k zx efdi~okjef u kjwxk~ k w~ktz gh hbbiz&
Kfwh hzwk zewxkjef" ghzgh biz efejeiz gh Efwh~fhw zx~mh bk fhjhzegkg gh ~hzw~efme~ biz
kjjhziz u gh jio|~ink~ {xh bkz |h~zifkz {xh zh jioxfejkf k w~ktz gh hzwh jkfkb zif
~hkbohfwh {xehfhz gejhf zh~& Hzwk jio|~inkjef hz gh hz|hjekb eo|i~wkfjek hf
ghwh~oefkgiz jkziz" wkbhz jioi0
Kgoefezw~kjef hbhjw~fejk& Hz oxu eo|i~wkfwh {xh jxkb{xeh~ we|i gh ~hbkjef jif
bkz Kgoefezw~kjeifhz \nbejkz zh bbhth k jkni hqjbxzetkohfwh |i~ |k~wh gh bkz
|h~zifkz {xh wehfhf gh~hjai k kjjhgh~ k bk efdi~okjef u |i~ biz |~i|eiz
efwh~hzkgiz i zxz ~h|~hzhfwkfwhz bhmkbhz& Hzwh ~h{xh~eoehfwi hz wkf eo|i~wkfwh hf
bkz ~hbkjeifhz |~hzhfjekbhz jioi hf bkz ~hbkjeifhz k w~ktz gh bkz fxhtkz
whjfibimkz&
Nkfjk ifbefh u jioh~jei hbhjw~feji& Hb kjjhzi k jxhfwkz nkfjk~ekz u bk
|izenebegkg ~hkbepk~ w~kfzkjjeifhz hjifoejkz hqemh {xh zibkohfwh |xhgkf zh~
bbhtkgkz k jkni |i~ bkz |h~zifkz jif bk kxwi~epkjef fhjhzk~ek |k~k hbbi& Ghb
oezoi oigi" hzwk jio|~inkjef gh bk eghfwegkg gh {xehf tk k ~hkbepk~ hzwkz
i|h~kjeifhz zh ghnh bbhtk~ k jkni wkonef jxkfgi hb ohgei xwebepkgi hz Efwh~fhw&
De~ok gh gijxohfwiz& Wkonef zh ghnh kzhmx~k~ bk eghfwegkg gh {xehf de~ok xf
gijxohfwi" wkfwi hf hb jkzi gh fhjhzewk~zh jio|~ink~ bk kxwi~k gh xf
gijxohfwi jioi hf hb gh bk de~ok gh gijxohfwiz {xh zx|ifmkf kjxh~giztefjxbkfwhz i jifw~kwiz&
;&Efw~igxjjef
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
7/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk = gh =Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Kjjhzi k zh~tejeiz i hz|kjeiz }hn ~hzw~efmegiz& Hzwh hz hb jkzi gh bk okui~ |k~wh
gh xziz gh Efwh~fhw" uk zh w~kwh ghb kjjhzi k jxhfwkz gh ji~~hi hbhjw~feji"
|h~debhz hf ~hghz zijekbhz i jxkb{xeh~ iw~i zh~tejei& Gh fxhti" hzwh kjjhzi ghnh
zh~ kxwi~epkgi fejkohfwh k bkz |h~zifkz {xh whfmkf |h~oezi |k~k hbbi" whfehfgi
|i~ wkfwi {xh jio|~ink~zh zx eghfwegkg&
Hf hzwiz u iw~iz jkziz" kb zh~ fhjhzk~ek bk jio|~inkjef gh bk eghfwegkg u gh zxz
|h~oeziz" zh hzwknbhjhf gedh~hfwhz ohjkfezoiz gh kxwhfwejkjef {xh |h~oewhf jifde~ok~
{xh bk |h~zifk {xh w~kwk gh ~hkbepk~ ghwh~oefkgkz kjjeifhz hz ~hkbohfwh bk kxwi~epkgk
|k~k hbbi& Bk eo|i~wkfjek gh hzwiz ohjkfezoiz zh efj~hohfwk jifzwkfwhohfwh k ohgegk
{xh ktkfpk bk eo|bkfwkjef u ghzk~~ibbi gh bk Zijehgkg gh bk Efdi~okjef" uk {xh biz
jexgkgkfiz xwebepkf oz zh~tejeiz ifbefh u kbokjhfkf oz efdi~okjef hf gedh~hfwhz
|h~debhz u jxhfwkz hf Efwh~fhw&
\i~ hbbi" EFWHJI ak hbkni~kgi hzwk Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf
kxwhfwejkjef ifbefh" jif hb |~i|zewi gh k|i~wk~ efdi~okjef gh xwebegkg {xh kuxgh k
{xh hzwiz ohjkfezoiz gh eghfwedejkjef u th~edejkjef gh bk eghfwegkg hf Efwh~fhw zh
eo|bkfwhf ji~~hjwkohfwh u zh xwebejhf gh oigi {xh jxo|bkf jif zx dxfjef ~hz|hwkfgi
biz gh~hjaiz gh biz eo|bejkgiz&
Hf hbbk zh hq|ifhf bkz jk~kjwh~zwejkz u biz kz|hjwiz k whfh~ hf jxhfwk ~hz|hjwi k biz
|~ijhziz gh eghfwedejkjef u th~edejkjef" zxz gedh~hfwhz we|iz hf dxfjef k geth~ziz
kz|hjwiz u bkz eo|bejkjeifhz bhmkbhz k jifzegh~k~& Kb oezoi weho|i" zh ghwh~oefkf jxbhz
zif biz |~efje|kbhz ~ehzmiz u kohfkpkz hf ~hbkjef k hzwiz |~ijhziz u xfk zh~eh gh
nxhfkz |~jwejkz u ~hjiohfgkjeifhz {xh kuxghf k biz xzxk~eiz u k biz ghzk~~ibbkgi~hz k
htewk~biz&
Hf wigi oiohfwi zh xwebepk hb w~oefi kxwhfwejkjef |k~k kz hfmbink~ giz |izenebegkghz
gedh~hfwhz0 bk eghfwedejkjef !hb zezwhok ~hjifijh kb xzxk~ei u zx eghfwegkg% u bk th~edejkjef
!hb zezwhok jifde~ok {xh hb xzxk~ei hz {xehf gejh zh~%& K |hzk~ gh hbbi" hz aknewxkb {xh zh
xwebejh hb w~oefi eghfwedejkjef jioi zeffeoi gh kxwhfwejkjef" hfmbinkfgi bkz giz
|izenebegkghz ohfjeifkgkz u ~hde~efgizh |i~ bi mhfh~kb k bk th~edejkjef" uk {xh hz hbjkzi oz aknewxkb&
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
8/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 1 gh 1Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
> BK KXWHFWEJKJEF IFBEFH
Zef gxgk bk kxwhfwejkjef hz xfi gh biz |~efje|kbhz hbhohfwiz zin~h biz {xh zh kzehfwk
Efwh~fhw u hz xfk |ehpk efgez|hfzknbh |k~k hb ghzk~~ibbi gh biz zh~tejeiz gh bk Zijehgkg gh
bk Efdi~okjef& Nzejkohfwh jifzezwh hf jifzwkwk~ {xh {xehf w~kwk gh kjjhgh~ kghwh~oefkgk efdi~okjef i zh~tejeiz hz {xehf gejh zh~ u hzw bhmeweokgi |k~k hbbi& Biz
|~ijhziz gh ~hmezw~i u kxwhfwejkjef mk~kfwepkf bk |~etkjegkg u hb kjjhzi hqjbxzeti k
ghwh~oefkgiz zh~tejeiz h efdi~okjeifhz&
K |hzk~ gh {xh hb ~hmezw~i u bk kxwhfwejkjef zif biz giz oiohfwiz jbkth |k~k hb kjjhzi
gh biz xzxk~eiz k biz gedh~hfwhz xziz u zh~tejeiz ifbefh" hz fhjhzk~ei ~hji~gk~ {xh hqezwh
iw~i |~ijhzi hzhfjekb" bk jifhqef hfw~h hb gez|izeweti {xh xwebepk hb xzxk~ei u biz
zh~tegi~hz hf biz {xh zh hfjxhfw~k bk efdi~okjef k bk {xh {xeh~h kjjhgh~& \i~ hbbi" hz
fhjhzk~ei jifijh~ efejekbohfwh jxbhz zif biz |kziz {xh zh zemxhf kb hzwknbhjh~ xfkjifhqef u joi zh jifde~ok {xh bk jifhqef zh bbhtk k jkni gh xf oigi zhmx~i&
>&; BIZ ^KZMIZ GH KXWHFWEJKJEF
Hb ho|bhi gh bkz whjfibimkz gh jioxfejkjef hbhjw~fejk {xh zi|i~wkf Efwh~fhw ~h{xeh~h
gh efdi~okjeifhz {xh jifzwewxuhf ~kzmiz eghfwedejkgi~hz {xh |h~oewhf bk w~kpknebegkg gh
biz xzxk~eiz" hz ghje~" hb zhmxeoehfwi ghb xzxk~ei k bi bk~mi gh gedh~hfwhz |kziz"
~hmezw~fgizh wigkz zxz kjjeifhz kb weho|i {xh zh jifde~ok {xh zh w~kwk ghb oezoi
xzxk~ei" i kb ohfiz {xh bk jifhqef zh ~hkbepk jifwefxkohfwh ghzgh hb oezoi gez|izeweti&
Kz" hzwiz hbhohfwiz fi zibi zh ~hdeh~hf kb |~i|ei xzxk~ei" uk {xh kb ~hkbepk~ jifhqeifhz
hf Efwh~fhw hz fhjhzk~ei wkfwi kzhmx~k~ {xh hb xzxk~ei {xh kjjhgh wehfh |h~oeziz |k~k
hbbi jioi hzwknbhjh~ xfk zh~eh gh bfhkz gh jioxfejkjef zhkbkfgi biz gez|izewetiz k
jifhjwk~ u biz |xfwiz gh jifhqef hqkjwiz hf gedh~hfwhz fethbhz;0
; Xfk hq|bejkjef oz zeo|bh zin~h hb hzwknbhjeoehfwi gh jifhqeifhz hf Efwh~fhw u zx |~iwhjjef zh hfjxhfw~k hf hbk~wjxbi ghb Jxkgh~fi gh Fiwkz Ji~wkdxhmiz !de~h}kbbz%0 [x zif u |k~k {x ze~thf" gez|ifenbh hf0aww|0))}}}&efwhji&hz)Zhmx~egkg)Inzh~tkwi~ei)K~wejxbiz)XGYJi~wkdxhmiz&
>&Bk kxwhfwejkjef ifbefh
http://www.inteco.es/Seguridad/Observatorio/Articulos/UD_Cortafuegoshttp://www.inteco.es/Seguridad/Observatorio/Articulos/UD_Cortafuegoshttp://www.inteco.es/Seguridad/Observatorio/Articulos/UD_Cortafuegos7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
9/64
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
10/64
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
11/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;; gh ;;Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Gh di~ok ~hzegxkb" u aknewxkbohfwh jioi xf ohjkfezoi gh kxwhfwejkjef gh hoh~mhfjek
jxkfgi hqezwhf |~inbhokz kb xwebepk~ biz |~ijhgeoehfwiz |~efje|kbhz" zh ~hkbepkf
ghwh~oefkgkz |~hmxfwkz jxukz ~hz|xhzwkz hzwf |~h/hzwknbhjegkz |i~ hb xzxk~ei& Kz" |i~
h`ho|bi" hf jkzi gh {xh fi zhk |izenbh hb xzi ghb zezwhok |~efje|kb" zh |xhghf xwebepk~
|~hmxfwkz |h~zifkbhz zin~h hb bhmweoi xzxk~ei" jioi jxb hz hb fion~h gh zx |~eoh~k
okzjiwk i hb ghb jibhmei hf hb {xh hzwxge&
Kbmxfiz zh~tejeiz |h~oewhf ohjkfezoiz gh kxwhfwejkjef oz zidezwejkgiz3 |i~ h`ho|bi"
kjwxkbohfwh bkz ~hghz zijekbhz |xhghf ji~~ini~k~ bk eghfwegkg gh xf xzxk~ei oizw~fgibh
eomhfhz gh zxz jifwkjwiz |k~k {xh zhkbh {xefhz zif hzkz |h~zifkz&
Ghnegi k bk fhjhzegkg gh {xh hzwiz jifijeoehfwiz fejkohfwh |xhgkf zh~ ghoizw~kgiz
|i~ hb bhmweoi xzxk~ei" kbmxfiz gh hzwiz ohjkfezoiz fi zh hzwf xwebepkfgiokzetkohfwh" kb w~kwk~zh gh efdi~okjef {xh |ig~k jifijh~ xfk |h~zifk jh~jkfk kb
oezoi& Hz |i~ hbbi {xh |~hgioefk jbk~kohfwh hb xzi gh jifw~kzhkz&
>&>&> \izhzef
Hb zhmxfgi dkjwi~ {xh zh |xhgh xwebepk~ hf biz |~ijhziz gh kxwhfwejkjef hz bk |izhzef
gh gedh~hfwhz hbhohfwiz& Ze nehf hb oz xwebepkgi hz bk |izhzef gh wk~`hwkz efwhbemhfwhz u"
hf |k~wejxbk~" wk~`hwkz j~e|wim~dejkz1" fi inzwkfwh" hz ~hbkwetkohfwh zhfjebbi jifth~we~ xf
zeo|bh gez|izeweti gh kbokjhfkoehfwi !ohoi~ek XZN% hf xfk bbkth 5 xwebepkfgi jeh~wkz
k|bejkjeifhz efdi~owejkz&
Gh hzwh oigi" hb xzxk~ei ghnh xwebepk~ xf gez|izeweti {xh hb zezwhok ~hjifijh~ |k~k
kj~hgewk~ zx eghfwegkg& Bkz fhjhzegkghz ~hz|hjwi k hzwh zezwhok zh jhfw~kf hf {xh hb
xzxk~ei zh kzhmx~h gh {xh fkgeh |xhgk kjjhgh~ k gejai gez|izeweti& Intekohfwh"
wkonef hz xf ~h{xezewi efgez|hfzknbh {xh hb xzxk~ei whfmk hb gez|izeweti jifzemi zeho|~h
{xh {xeh~k xwebepk~ hb zezwhok&
Hf Hz|kk hb GFE hbhjw~feji hz hb gez|izeweti gh kxwhfwejkjef hbhjw~fejk oz
hqwhfgegi" uk {xh kjwxkbohfwh bi |izhhf oz gh :< oebbifhz gh hz|kibhz u |xhgh zh~
xwebepkgi jif hzwiz defhz hf gedh~hfwhz zh~tejeiz" hz|hjekbohfwh hf bkz ~hbkjeifhzhbhjw~fejkz jif bkz Kgoefezw~kjeifhz \nbejkz;&>&: Neiohw~k
Hb wh~jh~ dkjwi~ xwebepkgi zh jhfw~k hf joi hz hb xzxk~ei h efjbxzi hf joi kjwk" zh w~kwk
gh bk neiohw~k;;& Hzwiz zezwhokz xwebepkf biz ~kzmiz dzejiz i gh jio|i~wkoehfwi ghb
1 Hzwkz wk~`hwkz |xhghf |~igxje~ j~hghfjekbhz oxu zhmx~kz" kz jioi de~okz gemewkbhz&5aww|0))newhbek&jio)>);
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
12/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;> gh ;>Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
xzxk~ei |k~k jifde~ok~ zx eghfwegkg" kb jifzegh~k~zh {xh gejaiz ~kzmiz zif" hf nxhfk
ohgegk" fejiz |k~k jkgk |h~zifk h efeoewknbhz&
Hqezwh m~kf tk~ehgkg gh wjfejkz neiow~ejkz" ghzgh biz kfbezez oz jifijegiz gh axhbbkgkjwebk~" e~ez i tip akzwk wjfejkz oz fithgizkz jioi hb hzjkfhi gh bkz thfkz gh bk
okfi i bk jkghfjek gh bk hzj~ewx~k hf xf whjbkgi&
Ghnegi k gedh~hfwhz jkxzkz" hzwkz wjfejkz gh kxwhfwejkjef wigktk zif oxu |iji
xwebepkgkz hf biz |~ijhziz ifbefh" ghzweffgizh hz|hjekbohfwh kb kjjhzi dzeji k
efzwkbkjeifhz&
>&>&7 Oxbwe/dkjwi~
Ze nehf biz w~hz dkjwi~hz hq|xhzwiz zif biz oz aknewxkbhz" hz |izenbh {xh zh hzwknbhpjkfzezwhokz hf biz {xh zh xwebejh xfk jionefkjef gh giz gh hbbiz h efjbxzi gh biz w~hz& Zh
ghdefh jioi kxwhfwejkjef nkzkgk hf ginbh dkjwi~ i oxbwe/dkjwi~" u |i~ bi mhfh~kb efjbxuh
zeho|~h hb dkjwi~ jifijeoehfwi& Kz" hz |iji aknewxkb {xh xf zezwhok gh kxwhfwejkjef zh
jhfw~h hf bk |izhzef gh hbhohfwiz dzejiz i hf bk neiohw~k zef efjbxe~ xf zezwhok gh
jifw~kzhkz&
Hb xzi gh zezwhokz oxbwe/dkjwi~ kxohfwk jifzegh~knbhohfwh biz fethbhz gh zhmx~egkg&
>&: \^IJHZI GH ^HMEZW^I
Xfk thp {xh zh ak ghwh~oefkgi hb we|i gh efdi~okjef {xh zh xwebepk~ jioi j~hghfjekb gh
kxwhfwejkjef" zh ghnh jifj~hwk~ hqkjwkohfwh jxb zh~ hzk j~hghfjekb& Hzwi zh
hzwknbhjh hf hb |~ijhzi gh ~hmezw~i" hz ghje~" jxkfgi hb xzxk~ei hz efzj~ewi jioi xzxk~ei
bhmweoi |i~ |~eoh~k thp hf hb zezwhok& K |hzk~ gh hbbi" aknewxkbohfwh hzwk ghwh~oefkjef
fi hz ghdefewetk fe eftk~eknbh" uk {xh zh zxhbh gh`k~ kneh~wk bk |izenebegkg gh oigedejkjef u
hf oxjaiz jkziz hz ~hjiohfgknbh {xh hzwk oigedejkjef zh ~hkbejh gh di~ok ~hmxbk~ ;>&
>&:&; Hbhjjef gh j~hghfjekbhz
Biz owigiz gh kxwhfwejkjef fi~okbohfwh zif ghjegegiz |i~ hb |~ithhgi~ gh zh~tejeiz i
hb j~hkgi~ gh bkz k|bejkjeifhz xwebepkgkz hf hb |~ijhzi" |h~i bk ghwh~oefkjef gh bkefdi~okjef i j~hghfjekb hqkjwk |xhgh zh~ bbhtkgk k jkni |i~ gedh~hfwhz kjwi~hz&
J~hghfjekbhz gh |~eoh~k |k~wh
Bkz j~hghfjekbhz gh |~eoh~k |k~wh zif k{xhbbkz {xh hb xzxk~ei zh kzemfk k z oezoi& Gh
hzwh oigi" bk |h~zifk ~hmezw~kgk u hb |~ithhgi~ gh j~hghfjekbhz gh eghfwegkg jiefjeghf&
Hzwk hbhjjef zh ~hkbepk ben~hohfwh ghfw~i gh xfkz fi~okz ofeokz hqemegkz |i~ hb
|~ithhgi~ gh zh~tejeiz i |i~ hb kgoefezw~kgi~ ghb zezwhok gh kxwhfwejkjef&
;> Hf jifj~hwi" hf hb jkzi gh bkz j~hghfjekbhz jifzezwhfwhz hf jifw~kzhkz hzwwejkz& Hf kbmxfiz jkziz" hzwh |~ijhgeoehfwigh jkonei gh jifw~kzhk hz bhmkbohfwh hqemenbh&
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
13/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;: gh ;:Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Hb oz jbk~i h`ho|bi gh hzwh we|i gh j~hghfjekbhz zif biz fion~hz gh xzxk~ei u
jifw~kzhkz {xh zh hzwknbhjhf kb kn~e~ xfk jxhfwk gh ji~~hi hbhjw~feji i xf |h~deb hf
~hghz zijekbhz& Hb |~i|ei xzxk~ei ghjegh koniz hbhohfwiz jif bkz |izenbhz ~hzw~ejjeifhz
hf jxkfwi k fi |igh~ xwebepk~ xf fion~h gh xzxk~ei uk hqezwhfwh i bkz hqemhfjekz ghbifmewxg u jio|bh`egkg gh bkz jifw~kzhkz |k~k hzwknbhjh~ xfiz fethbhz ofeoiz gh
zhmx~egkg&
J~hghfjekbhz gh zhmxfgk |k~wh
Hzwkz j~hghfjekbhz zif k{xhbbkz {xh zif eo|xhzwkz |i~ hb |~ithhgi~ gh zh~tejeiz i |i~ hb
kgoefezw~kgi~ ghb zezwhok gh kxwhfwejkjef& Hf hzwh jkzi" hb xzxk~ei fi wehfh jk|kjegkg
gh hbhjjef&
H`ho|biz gh hzwh we|i gh j~hghfjekbhz zif biz gez|izewetiz dzejiz gh eghfwedejkjef" jioi
wk~`hwkz gh jii~ghfkgkz i wichfz" {xh hb |~ithhgi~ gh zh~tejeiz zxoefezw~h k zxz jbehfwhz|k~k zx kxwhfwejkjef& Hf hzwiz jkziz hb xzxk~ei fi jxhfwk jif jk|kjegkg gh ghjezef i
oigedejkjef gh hzwiz gez|izewetiz&
Ze nehf hb fion~h gh xzxk~ei zh |xhgh jifzegh~k~ jioi |k~wh gh bkz j~hghfjekbhz gh
kxwhfwejkjef u zwh hf kbmxfkz ijkzeifhz hz eo|xhzwi kb xzxk~ei zhmf xfk |ibwejk |k~k
zx j~hkjef" hf oxjaiz gh hzwiz jkziz hb xzxk~ei jxhfwk jif bk |izenebegkg gh
oigedejkjef gh iw~k |k~wh gh bkz j~hghfjekbhz jioi zif bkz jifw~kzhkz& Hf hziz jkziz
zh |ig~k w~kwk~ gh xfk zewxkjef efwh~ohgek hfw~h bkz j~hghfjekbhz gh |~eoh~k |k~wh u gh
zhmxfgk |k~wh&
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
14/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;7 gh ;7Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
J~hghfjekbhz gh wh~jh~k |k~wh
Bkz j~hghfjekbhz gh wh~jh~k |k~wh zif k{xhbbkz {xh fi zif ghwh~oefkgkz |i~ biz xzxk~eiz
|h~i wko|iji |i~ hb |~ithhgi~ gh zh~tejeiz i hb kgoefezw~kgi~ ghb zezwhok ghkxwhfwejkjef {xh bkz tk k xwebepk~& Hf zx bxmk~" hzwkz j~hghfjekbhz zif ghwh~oefkgkz |i~
xf |~ithhgi~ gh j~hghfjekbhz |k~k zx xzi hf bkz ~hbkjeifhz ghb xzxk~ei jif iw~kz
|h~zifkz u i~mkfepkjeifhz gedh~hfwhz k gejai |~ithhgi~&
Zh w~kwk gh bk efwh~ohgekjef gh xf wh~jh~i {xh iwi~mk kb xzxk~ei xfkz j~hghfjekbhz {xh
|ig~ xzk~ hf iw~kz zewxkjeifhz u hf ~hbkjeifhz hf bkz {xh hzwh |~ithhgi~ gh
j~hghfjekbhz fi zh th~ eo|bejkgi ge~hjwkohfwh&
Hb |~efje|kb h`ho|bi gh hzwh we|i gh j~hghfjekbhz hz hb GFE hbhjw~feji" uk {xh zh w~kwk gh
xf gijxohfwi kj~hgewkweti hzwknbhjegi |i~ xf |~ithhgi~ gh j~hghfjekbhz !hb Oefezwh~ei ghbEfwh~ei~ hf hzwh jkzi% |k~k zx xwebepkjef |i~ |k~wh ghb xzxk~ei |k~k |igh~ kwhzwemxk~ zx
eghfwegkg d~hfwh k iw~iz kmhfwhz" zhkf zwiz |k~wejxbk~hz" ho|~hzkz" i~mkfepkjeifhz x
iw~iz i~mkfezoiz gh bkz Kgoefezw~kjeifhz \nbejkz&
>&:&> Ji~~hz|ifghfjek hfw~h eghfwegkg ~hkb h eghfwegkg gemewkb
Kghoz gh bk hbhjjef gh bkz j~hghfjekbhz" hf hb |~ijhzi gh ~hmezw~i zh |bkfwhk xfk
zewxkjef gh okui~ ~hbhtkfjek" bk jio|~inkjef gh {xh {xehf hzwknbhjh hb ~hmezw~i hz
~hkbohfwh {xehf gejh zh~& Hz ghje~" xf |~ijhzi gh th~edejkjef |~htei&
Hzwk kjwxkjef zh |xhgh bbhtk~ k jkni gh gedh~hfwhz oigiz" |xgehfgi zx|ifh~ jkgk xfi
xf okui~ i ohfi~ fethb gh jio|~inkjef gh hzwk ji~~hz|ifghfjek& K jifwefxkjef zh
|~hzhfwkf kbmxfiz gh biz owigiz gh jio|~inkjef oz xwebepkgiz hf bk kjwxkbegkg&
\h~deb i jxhfwk |~htekohfwh j~hkgk
Xfi gh biz ohjkfezoiz oz xwebepkgiz hz hb xzi gh xfk jxhfwk uk j~hkgk hf iw~iz
zh~tejeiz ifbefh" aknewxkbohfwh gh ji~~hi hbhjw~feji kxf{xh kjwxkbohfwh wkonef zh
xwebepkf bkz jxhfwkz i |h~debhz hf ~hghz zijekbhz& Gh hzwh oigi" zh |xhgh hftek~ xf hfbkjh
gh jio|~inkjef k bk jxhfwk gh ji~~hi {xh hb xzxk~ei efge{xh u hf jkzi gh {xh hzh
hfbkjh zhk xwebepkgi zh hfwehfgh {xh hb xzxk~ei {xh zh ~hmezw~k hz wkonef hb bhmweoixzxk~ei gh hzk jxhfwk |~htek&
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
15/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;8 gh ;8Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Hf hzwiz jkziz fi zh |xhgh jifzegh~k~ {xh zh ~hkbejh xfk jio|~inkjef gh bk
ji~~hz|ifghfjek hfw~h bk eghfwegkg ~hkb u bk eghfwegkg gemewkb" hz ghje~" fi zh hzw
jio|~inkfgi {xh bk |h~zifk {xh zh hzw ~hmezw~kfgi hf hb zezwhok zhk ~hkbohfwh {xehf
gejh zh~" zefi {xh fejkohfwh zh hzwf tefjxbkfgi hfw~h z gedh~hfwhz jxhfwkz hf gezwefwiz
zh~tejeiz&
Jio|~inkjef |~hzhfjekb
Hf hzwh jkzi" hf kbmf oiohfwi ghb ~hmezw~i hz fhjhzk~ei {xh bk |h~zifk {xh zh hzw
gkfgi gh kbwk hf hb zezwhok kjxgk k xf bxmk~ hf hb {xh zh jio|~ink~ zx eghfwegkg&
H`ho|bi gh hzwk di~ok gh jio|~inkjef hz bk k|h~wx~k gh xfk jxhfwk gh nkfjk
hbhjw~fejk" uk {xh aknewxkbohfwh zh ~hkbepk k |k~we~ gh xfk jxhfwk nkfjk~ek w~kgejeifkb"
zehfgi fhjhzk~ei kjxge~ k xfk zxjx~zkb nkfjk~ek kb ohfiz |k~k zibejewk~ hb kjjhzi ifbefhu {xh zh bh hfw~hmxhf hf |h~zifk zxz j~hghfjekbhz&
Xwebepkjef gh jh~wedejkjeifhz
Hb wh~jh~ owigi gh jio|~inkjef gh hzwk ji~~hz|ifghfjek hz hb xzi gh jeh~wkz
kj~hgewkjeifhz jioi hb GFEh {xh kwhzwemxkf bk eghfwegkg gh xfk |h~zifk& Gh hzwh oigi"
u ghnegi k {xh hb GFE hz xf gijxohfwi idejekb" |h~zifkb h efw~kfzdh~enbh" gh jxui xzi hz
~hz|ifzknbh zx wewxbk~" zh |xhgh bbhmk~ k ~hkbepk~ xfk jio|~inkjef hdhjwetk zef fhjhzegkg
gh kjxge~ dzejkohfwh k fefmf bxmk~ |k~k jio|bhwk~ hb |~ijhzi gh ~hmezw~i&
>&7 \^IJHZI GH KXWHFWEJKJEF
Xfk thp {xh hb xzxk~ei ak ~hkbepkgi hb ~hmezw~i efejekb hf xf zezwhok" hb kgoefezw~kgi~ gh
gejai zezwhok ~h{xh~e~ kj~hgewk~ zx eghfwegkg jxkfgi {xeh~k kjjhgh~ kb oezoi& Gh hzwh
oigi zh htewk {xh |h~zifkz fi kxwi~epkgkz kjjhgkf k hzwiz zh~tejeiz i {xh kbmxehf
|xhgk akjh~zh |kzk~ |i~ xf xzxk~ei bhmweoi zx|bkfwkfgi zx eghfwegkg& Hz bi {xh zh
ghfioefk kxwhfwejkjef&
Bk kxwhfwejkjef |xhgh ~hkbepk~zh gh giz oigiz gezwefwiz" bk th~edejkjef u bk
eghfwedejkjef" hf dxfjef gh bk efdi~okjef {xh whfmk {xh k|i~wk~ hb xzxk~ei&
>&7&; Th~edejkjef
Zh w~kwk ghb |~ijhgeoehfwi oz aknewxkb& Hf b" bk |h~zifk {xh {xeh~h kjjhgh~ kb zezwhok
ghnh zhkbk~ {x xzxk~ei ~hmezw~kgi hz !ohgekfwh xf fion~h gh xzxk~ei" xfk jxhfwk gh
ji~~hi hbhjw~feji i hb owigi {xh zh ghwh~oefkzh hf hb ~hmezw~i% u |~hzhfwk~ zxz
j~hghfjekbhz gh kjjhzi !jifw~kzhk" hbhohfwi dzeji i ~kzmi |h~zifkb%& Gejai gh iw~i
oigi" hb xzxk~ei efgejk {xef hz u bi ghoxhzw~k gh bk di~ok hzwknbhjegk&
Kz" hb zezwhok fejkohfwh ghnh th~edejk~ {xh koniz hbhohfwiz jiefjeghf hf zxz nkzhz
gh gkwiz" hz ghje~" {xh bkz j~hghfjekbhz gh kjjhzi |~hzhfwkgkz zif bkz oezokz {xh zh
akf ~hmezw~kgi |~htekohfwh |k~k hb xzxk~ei zhkbkgi&
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
16/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;4 gh ;4Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Hf jkzi gh {xh konkz efdi~okjeifhz jifjxh~ghf zh jifzegh~k~ {xh bk |h~zifk {xh
|~hwhfgh kjjhgh~ kb zezwhok hz ~hkbohfwh hb bhmweoi xzxk~ei u zh |h~oewe~ gejai kjjhzi&
Hf jkzi gh {xh fi jiefjegkf bk ~hz|xhzwk gh|hfgh~ gh bi hzwknbhjegi |i~ hbkgoefezw~kgi~ ghb zezwhok" zehfgi bi oz aknewxkb zibejewk~ {xh zh ~h|ewk hb efwhfwi gh
kjjhzi& Hf jkzi gh {xh bk efjifm~xhfjek zh |~igxpjk ~h|hwegkz thjhz" hz |izenbh {xh hb
kgoefezw~kgi~ ghwh~oefh xf nbi{xhi kxwioweji gh bk jxhfwk u kn~k xfk fxhtk |izenebegkg
gh kjjhzi" uk zhk xwebepkfgi xfk kxwhfwejkjef nkzkgk hf jifijeoehfwiz !kb ~hkbepk~
|~hmxfwkz jxuk ~hz|xhzwk ghnh~k jifijh~ fejkohfwh hb bhmweoi xzxk~ei% i xfk
kxwhfwejkjef nkzkgk hf bk |izhzef !|i~ h`ho|bi hftekfgi xf ohfzk`h k xfk jxhfwk gh
ji~~hi hbhjw~feji i xf foh~i gh whbdifi |~htekohfwh tefjxbkgiz%&
>&7&> EghfwedejkjefHzwh zhmxfgi we|i gh |~ijhgeoehfwi hz oz zhfjebbi |k~k hb xzxk~ei" |h~i oxjai oz
jio|bh`i |k~k hb |~i|ei zezwhok kb ~h{xh~e~ okui~hz jk|kjegkghz gh jio|xwkjef& Hf b"
hb xzxk~ei hf bxmk~ gh k|i~wk~ giz we|iz gh efdi~okjeifhz zibkohfwh k|i~wk zxz
j~hghfjekbhz& Kz" hb zezwhok hz hb hfjk~mkgi gh eghfwedejk~ {x xzxk~ei ~hmezw~kgi hz hb
{xh zh hzw kxwhfwejkfgi&
Hzwh |~ijhgeoehfwi jifzezwh hf bk jio|k~kjef gh bkz j~hghfjekbhz {xh k|i~wk hb xzxk~ei
jif wigkz bkz ~hmezw~kgkz hf hb zezwhok" bi jxkb eo|bejk okui~hz fhjhzegkghz hf bk
jk|kjegkg gh jio|xwkjef ghb zezwhok u xf okui~ weho|i gh hz|h~k |k~k ~hkbepk~ bkeghfwedejkjef&
Ghnegi k biz geth~ziz |~inbhokz {xh |ig~k kjk~~hk~ hzwh owigi hf jxkfwi k bkz
|izenebegkghz gh zx|bkfwkjef gh eghfwegkg" hz |iji ji~~ehfwh" u hf jkzi gh zh~ xwebepkgi
fejkohfwh bi zh~k hf zezwhokz {xh nkzkf bkz j~hghfjekbhz hf bk |izhzef gh hbhohfwiz
dzejiz i hf biz ~kzmiz dzejiz" zehfgi hzwh zhmxfgi jkzi hb {xh okui~ zhmx~egkg
k|i~wk~k&
>&7&: Hzjhfk~eiz gh kxwhfwejkjef
Ghb oezoi oigi {xh hqezwhf gedh~hfwhz di~okz gh ghwh~oefkjef gh j~hghfjekbhz u ghjio|~inkjef gh eghfwegkghz hf hb ~hmezw~i" hqezwhf w~hz hzjhfk~eiz gh kxwhfwejkjef
ifbefh" hf dxfjef ghb ohjkfezoi ho|bhkgi u gh {xef zhk hb kmhfwh {xh bk bbhth k jkni&
Kxwhfwejkjef ge~hjwk
Biz zezwhokz gh kxwhfwejkjef ge~hjwk zif k{xhbbiz {xh zh nkzkf hf bk efwh~kjjef hfw~h
hb xzxk~ei u bk i~mkfepkjef {xh fhjhzewk kxwhfwejk~bh u zxoefezw~k hb ohjkfezoi gh
kxwhfwejkjef&
Xfk m~kf |k~wh gh biz zezwhokz gh kxwhfwejkjef kjwxkbohfwh hqezwhfwhz zh nkzkf hf hb
efwh~jkonei gh jifw~kzhkz u iw~kz efdi~okjeifhz jifijegkz |i~ konkz |k~whz
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
17/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;= gh ;=Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
!j~hghfjekbhz gh |~eoh~k i gh zhmxfgk |k~wh%" {xh zh ~hbkjeifkf gh di~ok ge~hjwk&
^hzxbwk d~hjxhfwh {xh bk ~hbkjef hfw~h hb xzxk~ei u hb |~ithhgi~ zh nkzh hf hzwh we|i gh
zezwhokz&
Kxwhfwejkjef jh~wedejkgk
Hzwiz zezwhokz zh nkzkf hf hb ho|bhi gh jh~wedejkgiz hbhjw~fejiz gh jbkth |nbejk
!aknewxkbohfwh j~hghfjekbhz gh wh~jh~k |k~wh%& Zx |~efje|kb thfwk`k hz bk |izenebegkg gh
kxwhfwejk~ k xfk |h~zifk zef fhjhzegkg gh xf ~hmezw~i |~hzhfjekb" gkgi {xh zh |xhgh
jifdek~ hf bk efdi~okjef gh eghfwedejkjef ghb jh~wedejkgi" hz|hjekbohfwh jxkfgi bk
bhmezbkjef k|bejknbh hzwknbhjh jifwhfegiz ofeoiz" jioi hz hb jkzi ghb ghfioefkgi
jh~wedejkgi hbhjw~feji ~hjifijegi& H`ho|biz gh hbbi zif hb GFE hbhjw~feji u iw~iz
jh~wedejkgiz gh eghfwedejkjef jioi biz hq|hgegiz k ho|~hzk~eiz" w~knk`kgi~hz gh
i~mkfepkjeifhz |nbejkz i |~etkgkz" i k |~idhzeifkbhz jibhmekgiz&
Jxkfgi xfk |h~zifk gez|ifh gh xf jh~wedejkgi ~hjifijegi" |xhgh ~hbkjeifk~zh jif
wh~jh~iz u |xhgh inwhfh~ gh di~ok w~kfz|k~hfwh zx kbwk hf xf fxhti zh~tejei" zef
fhjhzegkg gh tibth~ k kj~hgewk~ zx eghfwegkg |~hzhfjekbohfwh" |i~ bi {xh bk jifdekfpk hf
hb w~deji k w~ktz gh Efwh~fhw zh efj~hohfwk&
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
18/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;1 gh ;1Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Xf jh~wedejkgi hbhjw~feji hz xf gijxohfwi hbhjw~feji de~okgi ;: {xh mk~kfwepk" k bkz
|h~zifkz {xh bi ~hjenhf i {xh bi xwebepkf" xfk zh~eh gh okfedhzwkjeifhz jifwhfegkz hf hb
oezoi& Hzwkz okfedhzwkjeifhz |xhghf ~hdh~e~zh k bk eghfwegkg gh xfk |h~zifk" k bk
wewxbk~egkg i |izhzef gh xfk jbkth |nbejk !u gh bk ji~~hz|ifgehfwh jbkth |~etkgk%" k zxz
kxwi~epkjeifhz !hf di~ok gh ~ibhz i |h~oeziz%" k zx jk|kjegkg gh ~h|~hzhfwk~ k iw~k
|h~zifk dzejk i `x~gejk" k zx jk|kjegkg gh |kmi" hwj&
Hzwiz jh~wedejkgiz |xhghf zh~ hoewegiz wkfwi |i~ i~mkfepkjeifhz hqwh~fkz kb xzxk~ei u kb
|~ithhgi~ gh zh~tejeiz !|i~ h`ho|bi hb GFEh% i |i~ hzwh oezoi |~ithhgi~ !|i~ h`ho|bi
jh~wedejkgiz |k~k jbehfwhz i |k~k oehon~iz gh xfk km~x|kjef%&
Hqezwh xfk m~kf jkfwegkg gh |izenbhz jh~wedejkgiz" gh biz jxkbhz zbi xfk |h{xhk |k~wh
ak zegi ~hmxbkgk bhmkbohfwh" jif bk defkbegkg gh mk~kfwepk~ bk eghfwedejkjef u bk de~okhbhjw~fejk gh bkz |h~zifkz dzejkz u `x~gejkz u" oz ~hjehfwhohfwh" gh bkz
Kgoefezw~kjeifhz \nbejkz" zxz ~mkfiz u hfwegkghz gh gh~hjai |nbeji&
Ghzgh xfk |h~z|hjwetk wjfejk" biz jh~wedejkgiz zh |xhghf jbkzedejk~ hf w~hz m~x|iz0
Biz jh~wedejkgiz gh kxwi~egkg gh jh~wedejkjef u gh xzxk~ei defkb& Hb
jh~wedejkgi gh kxwi~egkg gh jh~wedejkjef zh hq|egh k xf jio|ifhfwh wjfeji gh
gejak kxwi~egkg" jif bk defkbegkg gh hzwknbhjh~ xf oighbi gh jifdekfpk {xh
|h~oewk jio|~ink~ u xwebepk~ biz jh~wedejkgiz mhfh~kgiz |i~ hbbk !kjwetegkg {xh zh
ghfioefk |~hzwkjef gh zh~tejeiz gh jh~wedejkjef%&
\i~ zx |k~wh" hb jh~wedejkgi gh xzxk~ei defkb zh hq|egh |i~ xfk kxwi~egkg gh
jh~wedejkjef |k~k de~ok~" th~edejk~" jed~k~ i ghzjed~k~ gijxohfwiz |i~ |k~wh gh
xzxk~eiz defkbhz ghb zh~tejei !d~hjxhfwhohfwh jifzxoegi~hz%&
Biz jh~wedejkgiz gh de~ok hbhjw~fejk" gh jed~kgi u gh eghfwegkg& Hb
jh~wedejkgi gh de~ok hbhjw~fejk hz xf jh~wedejkgi gh jbkth |nbejk gh xzxk~ei defkb
{xh ze~th |k~k mhfh~k~ i |k~k th~edejk~ de~okz hbhjw~fejkz& Hb jh~wedejkgi gh
jed~kgi hz zeoebk~" |h~i ze~th |k~k jed~k~ u ghzjed~k~ gijxohfwiz& \i~ zx |k~wh" hbjh~wedejkgi gh de~ok hbhjw~fejk u hb gh eghfwedejkjef zif egfwejiz hqjh|wi hf hb
xzi kxwi~epkgi gh bk jbkth" {xh hf hb |~eoh~ jkzi zh ~hdeh~h k bk kjwxkjef
di~okbepkgk gijxohfwkbohfwh" u hf hb zhmxfgi" fejkohfwh bk kxwhfwejkjef&
Biz w~hz zh |xhghf jionefk~" gh di~ok {xh xf feji jh~wedejkgi |h~oewk ~hkbepk~
wigkz hzwkz kjjeifhz& Ze kghoz hz ~hjifijegi" hb |~hzwkgi~ fi |ig~
kbokjhfk~ bk jbkth |~etkgk {xh |h~oewh ghzjed~k~ gijxohfwiz&
;: \i~ hb |~hzwkgi~ gh zh~tejeiz gh jh~wedejkjef {xh bi hq|egh" jioi mk~kfwk gh zhmx~egkg u jifdekfpk hf bk oezoi" ghkjxh~gi jif bkz inbemkjeifhz bhmkbhz u" hf zx jkzi" jifthfjeifkbhz {xh ~hzxbwhf k|bejknbhz&
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
19/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk ;5 gh ;5Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Biz jh~wedejkgiz gh eghfwedejkjef gh gez|izeweti& Ghfw~i gh hzwk jkwhmi~k
zh efjbxuhf wigiz biz jh~wedejkgiz {xh kj~hgewkf bk eghfwedejkjef gh xf zezwhok"
k|bejkjef x in`hwi gemewkb gedh~hfwh gh xfk |h~zifk&
Kbmxfiz h`ho|biz ~hbhtkfwhz zif biz jh~wedejkgiz gh zewei }hn" {xh kj~hgewkf bk
wewxbk~egkg gh xfk X^B gh Efwh~fhw !efjbxuhfgi biz jh~wedejkgiz gh zh~tegi~
zhmx~i jif tkbegkjef hqwhfgegk" ZZB HT% i biz jh~wedejkgiz gh de~ok gh jgemi"
{xh jifde~okf bk kxwi~k gh xfk k|bejkjef ghzjk~mkgk kb h{xe|i i gez|izeweti&
Kxwhfwejkjef dhgh~kgk
Bk kxwhfwejkjef dhgh~kgk hz xf wh~jh~ oighbi gh kxwhfwejkjef hf hb jxkb xf jif`xfwi gh
|~ithhgi~hz jio|k~whf bk efdi~okjef gh kxwhfwejkjef gh zxz xzxk~eiz u mhzweifkf
jif`xfwkohfwh hzwh |~ijhzi&
Bk mhzwef dhgh~kgk gh bk eghfwegkg hz xf jif`xfwi gh kjxh~giz" hzwfgk~hz u whjfibimkz
{xh akjhf {xh bkz eghfwedejkjeifhz u bkz kw~enxjeifhz !|igh~hz" |h~oeziz" hwj&% zhkf
w~kfz|i~wknbhz hfw~h gioefeiz kxwfioiz gh zhmx~egkg" ohgekfwh hb xzi gh kzh~jeifhz i
kbhmkjeifhz gh eghfwegkg&
Hf xf hfwi~fi dhgh~kgi" bk efdi~okjef gh eghfwegkg hz bijkb k jkgk zezwhok" hz ghje~" zh
hfjxhfw~k hf biz h{xe|iz u zh~tegi~hz gh jkgk zezwhok" |h~i |xhgh hfbkpk~zh u
ho|bhk~zh gh di~ok mbinkb" gh oigi {xh |ig~k zh~ kjjhzenbh |k~k iw~iz zezwhokzkzijekgiz&
Hf xf hzjhfk~ei gh kxwhfwejkjef dhgh~kgk" hb xzxk~ei {xeh~h kjjhgh~ k xf zh~tejei
hbhjw~feji gh xf |~ithhgi~ gh zh~tejeiz jif {xehf fi wehfh ~hbkjef |~htek& \k~k hbbi zh
kxwhfwejk ge~hjwkohfwh d~hfwh k zx |~ithhgi~ gh j~hghfjekbhz" jif hb {xh uk ak ~hkbepkgi
xf ~hmezw~i |~htei" {xh bh hfw~hmk xf foh~i |k~k {xh hb xzxk~ei bi hfw~hmxh kb wh~jh~i
jif hb {xh fi hqezwk ~hbkjef |~htek&
Ohgekfwh gejai foh~i" hb |~ithhgi~ gh zh~tejeiz |xhgh jifzxbwk~ kb |~ithhgi~ gh
j~hghfjekbhz kjh~jk gh bk eghfwegkg ghb xzxk~ei& Defkbohfwh" hb |~ithhgi~ gh j~hghfjekbhz
hq|egh xfk j~hghfjekb jifzezwhfwh hf xf gijxohfwi hbhjw~feji;7 gifgh zh efjbxuhf
hzwkz efdi~okjeifhz zin~h hb xzxk~ei !bk kzh~jef%&
Hzwh ohjkfezoi |h~oewh dhgh~k~ zh~tejeiz gh Efwh~fhw hf w~oefiz gh eghfwedejkjef u
kxwhfwejkjef" u zh |xhgh ho|bhk~ |k~k {xh jxkb{xeh~ j~hghfjekb gh |~eoh~k i zhmxfgk
|k~wh zh |xhgk ho|bhk~ jif wh~jh~iz;8&
;7 Mhfh~kbohfwh" hzwh gijxohfwi i kzh~jef gh eghfwegkg zh hfjxhfw~k de~okgi hbhjw~fejkohfwh |i~ hb |~ithhgi~" |k~kmk~kfwk ghb wh~jh~i kb jxkb zibejewk kjjhzi hb xzxk~ei&;8 Hz ghje~" |h~oewh jifth~we~ xf eghfwedejkgi~ gh |~eoh~k i gh zhmxfgk |k~wh hf xf eghfwedejkgi~ gh wh~jh~k |k~wh"
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
20/64
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
21/64
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
22/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk >> gh >>Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
: ^ HM XB KJ E F B HM KB G H B K KX WH F WE JK JE F G H B K EG HF WE GK G GE M EW KB
:&; HB ^HJIFIJEOEHFWI U KW^ENXJEF GH BK EGHFWEGKG
:&;&; Bk kw~enxjef gh zemfiz gh eghfwegkg k bkz |h~zifkz dzejkz&Ghzgh hb fkjeoehfwi u gx~kfwh bk |izwh~ei~ htibxjef gh bkz |h~zifkz zh di~okbepkf xfk
zh~eh gh kjwiz `x~gejiz {xh |h~oewhf kb Hzwkgi whfh~ jifzwkfjek gh zx hqezwhfjek" u
gh~etk~ bkz i|i~wxfkz jifzhjxhfjekz `x~gejkz" u zeoxbwfhkohfwh id~hjh~ k biz wh~jh~iz
zhmx~egkg `x~gejk&
Wigiz fxhzw~iz kjwiz `x~gejiz hf bk |~jwejk hzwf efhbxgenbhohfwh xfegiz k bk
ghjbk~kjef i |~xhnk gh fxhzw~k eghfwegkg& \i~ h`ho|bi" |k~k ge~eme~fiz k jxkb{xeh~
kgoefezw~kjef bk Bhu :" gh >4 gh fitehon~h gh ^meohf @x~geji gh bkz
Kgoefezw~kjeifhz \nbejkz u ghb \~ijhgeoehfwi Kgoefezw~kweti Jiof hqemh {xh bk|hwejef jifwhfmk efgejkjef ghb fion~h u k|hbbegiz ghb efwh~hzkgi u" hf zx jkzi" gh bk
|h~zifk {xh bi ~h|~hzhfwh" kz jioi bk eghfwedejkjef ghb ohgei |~hdh~hfwh i ghb bxmk~ {xh
zh zhkbh k hdhjwiz gh fiwedejkjeifhz u bk de~ok ghb zibejewkfwh i kj~hgewkjef gh bk
kxwhfwejegkg gh zx tibxfwkg hq|~hzkgk |i~ jxkb{xeh~ ohgei !k~w& =
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
23/64
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
24/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk >7 gh >7Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
zwh u gh bkz zxjx~zkbhz !ze bkz wxteh~h%" hb in`hwi gh zx ho|~hzk u bk dhjak gh jioehfpi
gh bkz i|h~kjeifhz&
\i~ iw~k |k~wh" bkz kzijekjeifhz kg{xeh~hf |h~zifkbegkg `x~gejk jif hb kjwk dxfgkjeifkbefjbxuhfgi hb gh~hjai gh kzijekjef zhmf hb k~wjxbi >7 gh bk Bhu I~mfejk ;)> BK DE^OK HBHJW^FEJK
Bk |~xhnk gh bk eghfwegkg |xhgh ~hkbepk~zh k w~ktz gh biz ohgeiz {xh |~i|i~jeifkf bk
de~ok hbhjw~fejk u biz jh~wedejkgiz gemewkbhz& Fi inzwkfwh" zxz dxfjeifkbegkghz tkf oxjai
oz kbb" |i~ bi {xh |~ijhgh hq|ifh~ biz hbhohfwiz `x~gejiz nzejiz {xh |h~oewhf
jk~kjwh~epk~ k jkgk xfk gh hbbiz&
Biz w~oefiz gh de~ok gemewkb u de~ok hbhjw~fejk zh xwebepkf jif d~hjxhfjek jioi
zeffeoiz" |h~i zh w~kwk gh xf h~~i~ |xhzwi {xh hzwf gedh~hfjekgiz;1&
Bk de~ok gemewkb" zh ~hdeh~h kb jif`xfwi gh wjfejkz gh jigedejkjef u j~e|wim~kdk {xhkzijekf bk eghfwegkg gh xfk |h~zifk" hfwegkg i xf h{xe|i efdi~oweji kb ohfzk`h i
gijxohfwi de~okgi& Xfk de~ok gemewkb gk kb ghzwefkwk~ei zhmx~egkg gh {xh hb ohfzk`h dxh
j~hkgi |i~ hb ~hoewhfwh !kxwhfwejegkg gh i~emhf% u {xh fi dxh kbwh~kgi gx~kfwh bk
w~kfzoezef !efwhm~egkg%&
Bk de~ok hbhjw~fejk hz xf jifjh|wi oz ko|bei ghzgh xf |xfwi gh tezwk wjfeji uk {xh
|xhgh jifwho|bk~ owigiz fi j~e|wim~dejiz& Bk fi~okwetk hz|kibk zh ~hdeh~h k hbbk gh
di~ok mhf~ejk jioi k{xhb jif`xfwi gh gkwiz {xh |h~oewhf eghfwedejk~ kb de~okfwh" bi {xh
efjbxe~k nk`i hzwh jifjh|wi we|ibimkz k`hfkz k bk jh~wedejkjef gemewkb" jioi bk de~okkxwm~kdk hzjkfhkgk i bk de~ok okfxzj~ewk gemewkbepkgk&
Bk Bhu 85)>
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
25/64
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
26/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk >4 gh >4Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
|xhgh kjwxk~ jioi ze dxh~k bk d e~ok okfxzj~ewk gh xfk |h~zifk" ohgekfwh hb jifjh|wi
whjfibmejkohfwh fhxw~kb gh bk de~ok hbhjw~fejk !ktkfpkgk i ~hjifijegk%&
:&>&: Bk de~ok hbhjw~fejk ~hjifijegkDefkbohfwh" bk BDH jifwehfh xfk wh~jh~k ghdefejef gh de~ok hbhjw~fejk" hf zx k~wjxbi :&:"
hf te~wxg ghb {xh zh jifzegh~k de~ok hbhjw~fejk ~hjifijegk k bk de~ok hbhjw~fejk
ktkfpkgk nkzkgk hf xf jh~wedejkgi ~hjifijegi u {xh ak zegi |~igxjegk ohgekfwh xf
gez|izeweti zhmx~i gh j~hkjef gh de~ok hbhjw~fejk" jkwhmi~k jxui ~hjifijeoehfwi zh
~hdeh~h k xfk |~hzxfjef gh egifhegkg {xh bk jxkbedejk hz|hjekbohfwh jioi h{xetkbhfwh k
bk de~ok okfxzj~ewk" u zef {xh hbbi eo|be{xh bk gezj~eoefkjef gh biz ~hzwkfwh we|iz gh de~ok
hbhjw~fejk&
Zh w~kwk" gh fxhti" gh xfk ghdefejef efj~hohfwkb hf jxkfwi k biz ~h{xezewiz" {xh hqemh{xh bk whjfibimk gh de~ok hbhjw~fejk ~hjifijegk zhk hz|hjekbohfwh egfhk u kghjxkgk
|k~k {xh xfk |h~zifk dzejk" gh ahjai w|ejkohfwh xf jexgkgkfi i |~idhzeifkb xzxk~ei gh
zh~tejeiz |~etkgiz u |nbejiz" zh eghfwede{xh u de~oh&
:&>&7 Iw~iz we|iz gh de~ok hbhjw~fejk
Fi inzwkfwh" kghoz gh bkz jifwho|bkgkz hf bk BDH" |ighoiz jewk~ iw~iz we|iz gh de~ok
hf dxfjef gh joi bkz jbkzede{xhoiz0
Zhmf zx di~okwi0
Dhjakgk !Weohzwko|%" uk {xh efji~|i~k xf zhbbi gh weho|i !KgHZ/W%&
Tkbegkgk !jio|bhwh u Hqwhfghg%0 kkgh ~hdh~hfjekz |k~k jio|~ink~ bkz de~okz
!KgHZ/J%3 i nehf {xh kghoz kkgh hb zhbbi gh weho|i k bkz ~hdh~hfjekz kkgegkz
hf bk kfwh~ei~ !KgHZ/Q%&
Bifmhtk !Hqwhfghg bifm/wh~o%" efjbxuh jh~wedejkgiz h efdi~okjef gh ~htijkjef
kjwxkb |k~k zx jio|~inkjef k bk~mi |bkpi !KgHZ/Q/B%&
Zhmf zx xnejkjef dzejk0
Hq|bjewk !Ghwkjahg%& Bk de~ok zh mhfh~k jioi xf dejah~i efgh|hfgehfwh ghb
dejah~i de~okgi& Jxkb{xeh~ dejah~i zh |xhgh de~ok~ gh hzwk di~ok& Aku tk~ekz
k|bejkjeifhz |k~k mhfh~k~ hzwh we|i gh de~ok&
Eo|bjewk i efj~xzwkgk !Kwwkjahg%& Bk de~ok tk efjbxegk hf hb gijxohfwi {xh tk
de~okgi& Hz |izenbh ze bk k|bejkjef {xh j~hk hb dejah~i gh gkwiz bi |h~oewh&
Zhmf zx `h~k~{xk0
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
27/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk >= gh >=Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Jxkfgi xf gijxohfwi ghnh zh~ de~okgi |i~ tk~eiz" |xhghf |~hzhfwk~zh giz we|iz gh
de~okz hf dxfjef ghb jkzi jifj~hwi0
@h~~{xejkz !Jixfwh~zefm%& Jxkfgi xf gijxohfwi ghnh de~ok~zh hf i~ghf& Xfkde~ok th~edejk i de~ok bkz kfwh~ei~hz&
\k~kbhbk i jide~ok !JiZemf%& Wigkz bkz de~okz de~okf biz gkwiz& Fi aku i~ghf"
zibi eo|i~wkf hb foh~i gh de~okz wiwkbhz&
Zhmf hb bhfmxk`h ho|bhkgi
Jxkfgi zh mhfh~k xfk de~ok gemewkb |ighoiz xwebepk~ giz bhfmxk`hz gezwefwiz" mhfh~kfgi
giz di~okwiz gezwefwiz0
JKgHZ0 JOZ !J~u|wim~kdej Ohzzkmh Zufwkq% Kgtkfjhg Hbhjw~ifej Zemfkwx~h&
QkGHZ0 QOB !Hqwhfzenbh Ok~cx| Bkfmxkmh% Kgtkfjhg Hbhjw~ifej Zemfkwx~h&
:&>&8 Biz hdhjwiz `x~gejiz gh bk de~ok hbhjw~fejk
\~efje|ei gh tkbeghp mhfh~kb gh bk de~ok hbhjw~fejk
Wigk de~ok hbhjw~fejk" jif efgh|hfghfjek gh zx jkbedejkjef jioi i~gefk~ek" ktkfpkgk
i ~hjifijegk" hz emxkbohfwh de~ok hf bk ohgegk hf {xh ze~th kb in`hweti gh eo|xwk~ hb
jifwhfegi ghb gijxohfwi k bk |h~zifk {xh bi kxwi~epk& Hf jifzhjxhfjek" hb k~wjxbi :&5 ghbk BDH efgejk {xh fi zh fhmk~f hdhjwiz `x~gejiz k xfk de~ok hbhjw~fejk {xh fi ~hfk
biz ~h{xezewiz gh de~ok hbhjw~fejk ~hjifijegk" hf ~hbkjef k biz gkwiz k biz {xh hzw
kzijekgk" |i~ hb oh~i ahjai gh |~hzhfwk~zh hf di~ok hbhjw~fejk&
Kz |xhz" bk gedh~hfjek ~hkb hfw~h xfk zeo|bh de~ok hbhjw~fejk" xfk de~ok hbhjw~fejk
ktkfpkgk i xfk de~ok hbhjw~fejk ~hjifijegk fi ~hzegh hf zx kgoezenebegkg `x~gejk" fe hf
zx |iwhfjekb hdejkjek" zefi hf hb jif`xfwi gh ~h{xezewiz fhjhzk~eiz |k~k bim~k~ gejaiz
hdhjwiz&
\i~ wkfwi" kxf{xh zin~h bk de~ok ~hjifijegk ~hjkh xfk |~hzxfjef bhmkb {xh bk h{xe|k~k k
bk de~ok okfxzj~ewk" xfk de~ok zeo|bh |xhgh jxo|be~ |h~dhjwkohfwh jif zx dxfjef kxf{xh
|xhgkf zh~ fhjhzk~eiz hbhohfwiz kgejeifkbhz" jioi zx inwhfjef |~htek hf hb oxfgi
dzeji kfwh xfk ~hz|ifzknbh gh bk ho|~hzk i kgoefezw~kjef&
Hdejkjek gh bk de~ok hbhjw~fejk
Bk BDH ~hmxbk biz hdhjwiz gh bk de~ok hbhjw~fejk ginbhohfwh0
\i~ xfk |k~wh" hb k~wjxbi :&7 gh bk BDH ghwh~oefk {xh bk de~ok hbhjw~fejk
~hjifijegk whfg~" ~hz|hjwi gh biz gkwiz jifzemfkgiz hf di~ok hbhjw~fejk" hb
oezoi tkbi~ {xh bk de~ok okfxzj~ewk hf ~hbkjef jif biz jifzemfkgiz hf |k|hb3
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
28/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk >1 gh >1Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
hzwi hz" {xh bk de~ok hbhjw~fejk {xh jxo|bh hzwiz ~h{xezewiz zh ~hjifijh
bhmkbohfwh jioi h{xetkbhfwh k bk de~ok okfxzj~ewk&
\i~ iw~k |k~wh" hb k~wjxbi :&5 gh bk BDH hzwknbhjh {xh fi zh fhmk~f hdhjwiz`x~gejiz k bk de~ok hbhjw~fejk {xh fi ~hfk biz ~h{xezewiz gh bk d e~ok hbhjw~fejk
~hjifijegk" hf ~hbkjef k biz gkwiz k biz {xh hzw kzijekgk |i~ hb oh~i ahjai gh
|~hzhfwk~zh hf di~ok hbhjw~fejk& Hz ghje~" wigk de~ok |xhgh |iwhfjekbohfwh
~hjene~ hdhjwiz `x~gejiz" fi |xgehfgi zh~ fefmxfk whjfibimk gezj~eoefkgk |i~ zh~
hbhjw~fejk&
Hzwk jifjh|jef ginbh zh w~kgxjh hf biz giz |~efje|eiz mhfh~kbhz ghzj~e|wetiz gh bk
hdejkjek gh bk de~ok hbhjw~fejk0 hb |~efje|ei gh fi gezj~eoefkjef" gh kjxh~gi jif hb jxkb bk
|k~wh k {xehf efwh~hzk bk hdejkjek gh xfk de~ok hbhjw~fejk wehfh gh~hjai k {xh zh|~kjwe{xh xfk |~xhnk zxdejehfwh" {xh ghwh~oefh ze bk de~ok h~k zxdejehfwhohfwh deknbh jioi
|k~k eo|xwk~ hb kjwi k bk |h~zifk {xh bk |~igx`i3 u hb |~efje|ei gh h{xetkbhfjek dxfjeifkb"
{xh fi hbeoefk bk fhjhzegkg gh hzwk |~xhnk" |h~i bk ~hgxjh jifzegh~knbhohfwh" ohgekfwh
bk |~hzxfjef gh bk hz|hjekb egifhegkg gh bk whjfibimk |k~k kjwxk~ jioi bk de~ok gh bk
|h~zifk&
Biz hdhjwiz" |i~ wkfwi" zh jifgejeifkf zeho|~h u hf wigi jkzi k bk |~xhnk gh bk
kxwhfwejegkg gh bk de~ok" ghoizw~kgk bk jxkb bk de~ok |~igxje~ zx hdhjwi w|eji" {xh hz hb
gh |h~oewe~ bk eo|xwkjef ghb gijxohfwi de~okgi k bk |h~zifk&
Bk |~xhnk `xgejekb gh bk de~ok hbhjw~fejk
Hz |~hjezkohfwh hzwk |~xhnk gh bk kxwhfwejegkg gh bk de~ok hbhjw~fejk bk {xh zh ghnh
|~kjwejk~ hf jkzi gh ~h|xgei i ~hjakpi ghb gijxohfwi |i~ |k~wh ghb ghokfgkgi& Zh w~kwk
gh bi oezoi {xh zxjhgh hf hb jkzi gh bk de~ok okfxzj~ewk" {xh hf jkzi gh jifdbejwi zh
zxzwkfjek ohgekfwh xfk |~xhnk |h~ejekb jkbem~dejk&
Kb hdhjwi" bk BDH ghwh~oefk xf w~kwkoehfwi hz|hjdeji gh bk |~xhnk gh bk kxwhfwejegkg gh bk
de~ok hbhjw~fejk" hf biz jkziz gh bk de~ok ktkfpkgk u gh bk de~ok ~hjifijegk !fi kz gh bk
de~ok i~gefk~ek%&
Hf te~wxg ghb k~wjxbi :&1 gh bk BDH" hf jkzi gh eo|xmfk~zh bk kxwhfwejegkg gh bk de~ok
hbhjw~fejk ~hjifijegk jif bk {xh zh akukf de~okgi biz gkwiz efji~|i~kgiz kb gijxohfwi
hbhjw~feji" zh |~ijhgh~ k jio|~ink~ {xh0 zh w~kwk gh xfk de~ok hbhjw~fejk ktkfpkgk
nkzkgk hf xf jh~wedejkgi ~hjifijegi" {xh jxo|bh wigiz biz ~h{xezewiz u jifgejeifhz
hzwknbhjegiz hf hzwk Bhu |k~k hzwh we|i gh jh~wedejkgiz u {xh bk de~ok zh ak mhfh~kgi
ohgekfwh xf gez|izeweti zhmx~i gh j~hkjef gh de~ok hbhjw~fejk&
Bk inbemkjef gh ~hkbepk~ bkz jewkgkz jio|~inkjeifhz ji~~hz|ifgh k {xehf |~hzhfwh hbgijxohfwi hbhjw~feji de~okgi jif de~ok hbhjw~fejk ~hjifijegk&
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
29/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk >5 gh >5Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Ze gejakz jio|~inkjeifhz inwehfhf xf ~hzxbwkgi |izeweti" zh kzxoh bk kxwhfwejegkg gh bk
de~ok hbhjw~fejk ~hjifijegk jif bk {xh zh ak de~okgi gejai gijxohfwi hbhjw~feji"
whfehfgi {xh akjh~zh jk~mi gh bkz jizwkz" mkzwiz u gh~hjaiz {xh i~emefh bk
jio|~inkjef {xehf axnehzh di~oxbkgi bk eo|xmfkjef& H efjbxzi" ze k `xejei ghb w~enxfkb
bk eo|xmfkjef axnehzh zegi whoh~k~ek" |ig~ eo|ifh~bh kghoz xfk oxbwk gh hfw~h ;> Jh~wedejkgi gh |h~zifk dzejk" gh |h~zifk `x~gejk i gh hfwegkg zef|h~zifkbegkg `x~gejk
Hb jh~wedejkgi gh |h~zifk dzejk hz hb {xh zh hq|egh k xf xzxk~ei efgetegxkb" {xh zh
ghfioefk zxzj~e|wi~ ghb jh~wedejkgi" {xh zh~ hb de~okfwh !hf jh~wedejkgiz gh jbkth |nbejk
gh de~ok% i hb {xh ghzjed~h biz gijxohfwiz |~iwhmegiz jif zx jbkth |nbejk !hf
jh~wedejkgiz gh jed~kgi%&
Hb jh~wedejkgi gh |h~zifk `x~gejk fi zh ~hjimh hf bk Ge~hjwetk 55)5:)JH" fe zh ghdefh
hf bk Bhu 85)>< Hb jxzwigei gh xf jh~wedejkgi gh |h~zifk `x~gejk hz bk |h~zifk dzejk zibejewkfwh gh xf jh~wedejkgi gh |h~zifk `x~gejk" {xhgez|ifh gh xf gez|izeweti gh de~ok hbhjw~fejk u {xh" |i~ wkfwi" bi xwebepk |k~k |~igxje~ de~okz hbhjw~fejkz&
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
32/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk :> gh :>Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Fi inzwkfwh" bkz k|bejkjeifhz ghb jh~wedejkgi gh |h~zifk `x~gejk wehfhf oz {xh th~ jif
bk |~igxjjef gh gijxohfwiz i~emefkbhz eo|xwknbhz k bk hfwegkg {xh jif bk de~ok hzj~ewk
ghb ~h|~hzhfwkfwh bhmkb i tibxfwk~ei gh bk |h~zifk `x~gejk& Hzwk |izenebegkg inbemk k
~h|bkfwhk~ bk fhjhzegkg gh bk ~h|~hzhfwkjef hf bk ~hbkjef hbhjw~fejk hfw~h bkz |h~zifkz
`x~gejkz u bkz Kgoefezw~kjeifhz \nbejkz" uk {xh bhmkbohfwh hz bk |h~zifk `x~gejk bk {xh
ge~hjwkohfwh kjwk&
Kghoz" hb jh~wedejkgi gh |h~zifk `x~gejk fi |ig~ kdhjwk~ kb ~meohf gh ~h|~hzhfwkjef
i~mfejk i tibxfwk~ek ~hmxbkgi |i~ bk bhmezbkjef jeteb i oh~jkfweb k|bejknbh k jkgk |h~zifk
`x~gejk" |~htezef {xh mhfh~k nkzwkfwhz |~inbhokz `x~gejiz |k~k ghbeoewk~ {x kjwiz
|ig~kf hthfwxkbohfwh {xhgk~ hqjbxegiz gh bk de~ok gh |h~zifk `x~gejk hf bk ~hbkjef
hbhjw~fejk jif bk Kgoefezw~kjef&
Kz |xhz" zh ghnh efwh~|~hwk~ {xh hzwk |~htezef bhmkb zhkbk {xh |~hjezkohfwh hf bk
kjwxkjef hbhjw~fejk gh bk |h~zifk `x~gejk ohgekfwh zx de~ok hbhjw~fejk fi hqezwh
~h|~hzhfwkjef" |i~ zh~ effhjhzk~ek u {xh" |i~ wkfwi" k gejak kjwxkjef fi zh bh ghnhf
k|bejk~ bkz fi~okz zin~h bk ~h|~hzhfwkjef& Gh hzwh oigi" jxkfgi xfk fi~ok
kgoefezw~kwetk zhkbh {xh" |i~ h`ho|bi" ghwh~oefkgi gijxohfwi ghnh zh~ de~okgi |i~ bk
ho|~hzk i zx ~h|~hzhfwkfwh" zh~ |izenbh {xh kjwh ge~hjwkohfwh bk ho|~hzk jif zx
de~ok gh |h~zifk `x~gejk i {xh kjwh xf ~h|~hzhfwkfwh ohgekfwh xf jh~wedejkgi gh
|h~zifk dzejk" hf hzwh zhmxfgi jkzi kj~hgewkfgi zx ~h|~hzhfwkjef gh di~ok zxdejehfwh&
Bk ~hmxbkjef ghb jh~wedejkgi gh |h~zifk `x~gejk fi zh k|bejk fe k biz jh~wedejkgiz gh bkz
hfwegkghz gh jh~wedejkjef gh de~ok hbhjw~fejk fe k biz jh~wedejkgiz hoewegiz k bkz
Kgoefezw~kjeifhz \nbejkz" {xh zh ~hme~f |i~ zx fi~okwetk hz|hjdejk !hf hb jkzi gh
zwkz bweokz" bk bhu ;;)>
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
33/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk :: gh ::Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
hf biz {xh |ig~f hq|hge~zh jh~wedejkgiz hbhjw~fejiz k bkz hfwegkghz zef |h~zifkbegkg
`x~gejk&
Gejak I~ghf k|bejk k bkz hfwegkghz zef |h~zifkbegkg `x~gejk fi~okz kfbimkz k bkzk|bejknbhz |k~k biz jh~wedejkgiz gh |h~zifkz `x~gejkz" kxf{xh jif hz|hjekbegkghz& Hf
|k~wejxbk~ ~hz|hjwi kb |~ijhgeoehfwi gh ~hmezw~i" jif bk defkbegkg gh kzhmx~k~ {xh zbi xf
~h|~hzhfwkfwh bhmkb i tibxfwk~ei gh bk hfwegkg zef |h~zifkbegkg" {xh kjwxk~ jioi
jxzwigei" ~hjenh hb jh~wedejkgi&
:&:&: Jh~wedejkgi |k~k kjwxk~ hf fion~h |~i|ei i |i~ ~h|~hzhfwkjef
Hb jh~wedejkgi gh de~ok |xhgh zh~te~ |k~k kjwxk~ hf fion~h |~i|ei i hf ~h|~hzhfwkjef gh
xfk |h~zifk" jioi ghwh~oefk hb k~wjxbi 4&> gh bk Bhu 85)>
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
34/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk :7 gh :7Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Kxf{xh fi k|k~hjh jewkgi hq|~hzkohfwh" hb jh~wedejkgi |h~zifkb wkonef |xhgh zh~
ji~|i~kweti" jxkfgi efgejk xfk ~hbkjef gh tefjxbkjef gh hzwk fkwx~kbhpk jif iw~k
|h~zifk" {xh zh |xhgh efjbxe~ ze bi `xzwedejk bk defkbegkg hz|hjdejk ghb jh~wedejkgi !k~wjxbi
;;&: gh bk Bhu 85)>;&
Hb GFE hbhjw~feji" kghoz gh jifzwewxe~ xf ohgei zhmx~i u deknbh gh kj~hgewkjef gh bkeghfwegkg |h~zifkb hf hb onewi dzeji" kkgh bk dxfjeifkbegkg gh zx xwebepkjef jioi
ohgei gh eghfwedejkjef dhakjehfwh hf hb onewi gemewkb0 ohgekfwh zx xzi hf gez|izewetiz
hbhjw~fejiz" k w~ktz gh Efwh~fhw u hf ~hghz gh jioxfejkjeifhz |~etkgkz&
Gh hzwk di~ok" biz giz jh~wedejkgiz hbhjw~fejiz {xh efji~|i~k hb GFE hbhjw~feji !gh
kxwhfwejkjef ghb jexgkgkfi u gh de~ok gemewkb% {xh ~hzxbwkf tibxfwk~eiz" ze~thf |k~k
kxwhfwejk~ bk eghfwegkg |h~zifkb gh zx wewxbk~ u |k~k |h~oewe~ bk de~ok hbhjw~fejk gh
gijxohfwiz |i~ |k~wh ghb de~okfwh&
Hb GFE hbhjw~feji efjbxuh xf jae| {xh |h~oewh eghfwedejk~zh k w~ktz gh jxkb{xeh~ zezwhokgh jioxfejkjeifhz hbhjw~fejkz" zeho|~h {xh zh ~h{xeh~k i zh fhjhzewh |k~k xfk
i|h~kjef whbhowejk" kz jioi ~hkbepk~ i|h~kjeifhz jif mk~kfwk gh kxwhfwejkjef
neiow~ejk nkzkgk hf axhbbk gkjwebk~&
Biz jh~wedejkgiz gh eghfwegkg u de~ok hbhjw~fejk zif hoewegiz" jif jk~jwh~ hqjbxzeti" |i~
hb Hzwkgi" |k~k bi jxkb zh ak jifzwewxegi xfk Kxwi~egkg gh Jh~wedejkjef hbhjw~fejk |~i|ek"
>; Bk BDH de`k hb ok~ji fi~okweti nzeji ghb GFEh ~hoewefgizh k bk fi~okwetk hz|hjdejk hf jxkfwi k bkz |k~wejxbk~egkghzgh zx ~meohf `x~geji& Gh kjxh~gi jif bk ghdefejef efjbxegk hf hb k~wjxbi ;8&; BDH" hb gijxohfwi fkjeifkb gh eghfwegkghbhjw~feji hz hb gijxohfwi fkjeifkb gh eghfwegkg {xh kj~hgewk hbhjw~fejkohfwh bk eghfwegkg |h~zifkb gh zx wewxbk~ u|h~oewh bk de~ok hbhjw~fejk gh gijxohfwiz&
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
35/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk :8 gh :8Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
|h~zifkbepkgk hf hb Oefezwh~ei ghb Efwh~ei~ k w~ktz gh bk Ge~hjjef Mhfh~kb gh bk \ibejk
Fkjeifkb& Kb ~hz|hjwi" hb k~wjxbi ;4&; BDH hzwknbhjh {xh biz ~mkfiz jio|hwhfwhz ghb
Oefezwh~ei ghb Efwh~ei~ |k~k bk hq|hgejef ghb gijxohfwi fkjeifkb gh eghfwegkg hbhjw~feji
jxo|be~f bkz inbemkjeifhz {xh bk |~hzhfwh Bhu eo|ifh k biz |~hzwkgi~hz gh zh~tejeiz gh
jh~wedejkjef {xh hq|egkf jh~wedejkgiz ~hjifijegiz jif hqjh|jef gh bk ~hbkwetk k bk
jifzwewxjef gh bk mk~kfwk k bk {xh zh ~hdeh~h hb k|k~wkgi > ghb k~wjxbi >&n%" ;8 u >; ghb |~i|ei whqwi&
Bk gezw~enxjef ghb GFE hbhjw~feji ak kuxgkgi k bk eo|bkfwkjef gh bk de~ok hbhjw~fejk u
ak |h~oewegi {xh zh jifipjk u zh diohfwh zx xwebepkjef& Kghoz" ak jifw~enxegi k {xh
zh |~igxpjk xfk okui~ efw~igxjjef hf hb oh~jkgi gh k|bejkjeifhz {xh ~h{xeh~kf gh hzwk
whjfibimk&
Hb ghzk~~ibbi ~hmbkohfwk~ei ghb GFE hbhjw~feji zh ak ~hkbepkgi |i~ hb ^hkb Ghj~hwi
;88:)>
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
36/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk :4 gh :4Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Fkjeifkb gh Eghfwegkg u zxz jh~wedejkgiz gh de~ok hbhjw~fejk& Aku {xh ghzwkjk~ {xh"
d~hfwh k bk temhfjek ghb Gijxohfwi Fkjeifkb gh Eghfwegkg" biz jh~wedejkgiz hbhjw~fejiz
~hjifijegiz efji~|i~kgiz kb oezoi whfg~f xf |h~igi gh temhfjek gh w~hefwk ohzhz
!k~wjxbi ;> ghb ^hkb Ghj~hwi%&
Xf GFE gx~k fi~okbohfwh gehp kiz" bi {xh zemfedejk {xh zh ghnhf |~igxje~ w~hz
~hfitkjeifhz i~gefk~ekz gh biz jh~wedejkgiz hf zx efwh~ei~" zeho|~h {xh fi akuk
efjeghfjekz {xh hqe`kf bk |~htek ~htijkjef gh biz oezoiz !u zx ~hhoezef |izwh~ei~" zin~h
bk oezok wk~`hwk%&
Hzwk je~jxfzwkfjek ~hzxbwk eo|i~wkfwh" uk {xh" kxf{xh efejekbohfwh xf GFE hbhjw~feji zhk
hoewegi jif biz giz jh~wedejkgiz hf zx efwh~ei~" hz fhjhzk~ei {xh hb jexgkgkfi ~hfxhth gh
di~ok ~hmxbk~ zxz jh~wedejkgiz i" hf jkzi jifw~k~ei" fi |ig~ akjh~ xzi gh gejakzdxfjeifkbegkghz& Bkz ~hfitkjeifhz {xh ghnhf ~hkbepk~zh hf bkz Jioezk~kz gh \ibejk"
ho|bhkfgi biz h{xe|koehfwiz gez|xhzwiz kb hdhjwi&
:&8 BK EGHFWEDEJKJEF GEMEWKB D^HFWH K BK KGOEFEZW^KJEF
Bk Bhu ;;)>
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
37/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk := gh :=Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Bk Bhu wkonef ~hmxbk biz zezwhokz |k~k bk eghfwedejkjef hbhjw~fejk gh bkz
Kgoefezw~kjeifhz \nbejkz u |k~k bk kxwhfwejkjef gh biz gijxohfwiz hbhjw~fejiz {xh
|~igxpjkf0
Zezwhokz gh de~ok hbhjw~fejk nkzkgiz hf bk xwebepkjef gh jh~wedejkgiz gh
gez|izeweti zhmx~i i ohgei h{xetkbhfwh {xh |h~oewk eghfwedejk~ bk zhgh hbhjw~fejk
u hb hzwknbhjeoehfwi jif hbbk gh jioxfejkjeifhz zhmx~kz&
Zezwhokz gh de~ok hbhjw~fejk |k~k bk kjwxkjef kgoefezw~kwetk kxwiokwepkgk&
De~ok hbhjw~fejk ghb |h~zifkb kb zh~tejei gh bkz Kgoefezw~kjeifhz \nbejkz&
Efwh~jkonei hbhjw~feji gh gkwiz hf hfwi~fiz jh~~kgiz gh jioxfejkjef"
jifdi~oh k bi hz|hjdejkohfwh kji~gkgi hfw~h bkz |k~whz&
Hf jxkfwi k biz dxfjeifk~eiz" |xhghf xwebepk~ de~okz hbhjw~fejkz |~itezwkz |i~ bk |~i|ek
Kgoefezw~kjef {xh |xhgkf eghfwedejk~ gh di~ok jif`xfwk kb wewxbk~ ghb |xhzwi gh w~knk`i i
jk~mi u k bk Kgoefezw~kjef x ~mkfi hf bk {xh |~hzwk zxz zh~tejeiz" i bk de~ok hbhjw~fejk
nkzkgk hf hb Gijxohfwi Fkjeifkb gh Eghfwegkg&
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
38/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk :1 gh :1Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
7 ^ EH ZM IZ \ K K BK ZH MX EG KG U BK \^ ET KJ EG KG
7&; \^EFJE\KBHZ H^^I^HZ
Hf hb |~ijhzi gh kxwhfwejkjef |xhghf jifjx~~e~ gedh~hfwhz ~ehzmiz i |~inbhokz hf~hbkjef k bk zhmx~egkg" zehfgi biz |~efje|kbhz bk kzemfkjef efji~~hjwk gh eghfwegkg" zhk
hzwk |~itijkgk !zx|bkfwkjef% i |i~ h~~i~" u hb fi ~hjifijeoehfwi gh bk eghfwegkg gh xfk
|h~zifk" hz ghje~" biz jifijegiz jioi dkbziz |izewetiz u biz dkbziz fhmkwetiz&
K |hzk~ gh zh~ biz giz jkziz oz aknewxkbhz" hz fhjhzk~ei zhkbk~ {xh biz |izenbhz
~ehzmiz |xhghf ghnh~zh k iw~kz je~jxfzwkfjekz" hz|hjekbohfwh hf ~hbkjef k bk mhzwef gh
biz gedh~hfwhz kz|hjwiz ~hbkjeifkgiz jif bk kxwhfwejkjef&
7&;&; Dkbziz fhmkwetiz
Xf dkbzi fhmkweti hf xf |~ijhzi gh kxwhfwejkjef zx|ifh {xh k xf xzxk~ei bhmweoi fi zhbh ~hjifijh jioi wkb" fhmfgizhbh hb kjjhzi kb zezwhok& Ze nehf hf |~efje|ei bkz
jifzhjxhfjekz gh hzwh h~~i~ zh beoewkf k hzk ghfhmkjef gh kjjhzi" hzwi |xhgh whfh~
iw~kz jifzhjxhfjekz hf jkzi gh {xh bk ghfhmkjef gh kjjhzi zhk |h~okfhfwh&
\i~ h`ho|bi" |xhgh |h~gh~zh efdi~okjef eo|i~wkfwh ze hb kjjhzi hz ghfhmkgi
|h~okfhfwhohfwh u zibkohfwh hzw kbi`kgk hf hzh zh~tejei& \i~ iw~i bkgi" ze bk jxhfwk i
hb zh~tejei kb {xh zh ghzhk kjjhgh~ zh xwebepk |k~k mhzweifk~ gefh~i" |ig~kf |~igxje~zh
|~gegkz hjifoejkz&
7&;&> Dkbziz |izewetiz
Hb iw~i we|i gh h~~i~ {xh |xhgh gk~zh hf hb |~ijhzi gh kxwhfwejkjef hz hb dkbzi |izeweti"
hz ghje~" bk kjh|wkjef jioi xzxk~ei bhmweoi k xfi {xh fi bi hz" |i~ bi {xh zh bh |h~oewh
hb kjjhzi k xf zezwhok u xfk efdi~okjef {xh fi ghnh~k whfh~& Hf hb jkzi gh bk de~ok
gemewkb" zh hzwk~k kde~okfgi xfk kxwi~k dkbzk&
Hzwk zewxkjef |xhgh mhfh~k~ gedh~hfwhz |~inbhokz" jioi hb ~ini gh efdi~okjef" bk
zx|bkfwkjef gh eghfwegkg i jkziz gh d~kxgh ifbefh&
7&> ^EHZMIZ HF BIZ \^IJHZIZ GH KXWHFWEJKJEF
Biz gedh~hfwhz ~ehzmiz |k~k bk zhmx~egkg u bk |~etkjegkg ~hbkjeifkgiz jif biz |~ijhziz gh
kxwhfwejkjef zif oxu geth~ziz" |xgehfgi zh~ jifzhjxhfjek gh biz dkbziz |izewetiz" biz
dkbziz fhmkwetiz i ghnh~zh k iw~iz kz|hjwiz ~hbkjeifkgiz jif hb gezhi u bk mhzwef gh biz
|~ijhziz gh kxwhfwejkjef&
7&>&; Kxzhfjek i gdejew gh ohgegkz gh zhmx~egkg
Hf hzwk jkwhmi~k zh hfmbinkf gedh~hfwhz kz|hjwiz {xh" hf zx okui~k" |xhghf zh~
zibthfwkgiz |i~ {xehf gezhk hb zezwhok gh th~edejkjef& Zh w~kwk hf wigi jkzi gh
ohgegkz |~hthfwetkz {xh kuxgkf k okfwhfh~ hbhtkgiz fethbhz gh zhmx~egkg& Hfw~h biz
|izenbhz |~inbhokz hf hzwh jif`xfwi ghzwkjkf0
7&7& ^ehzmiz |k~k bk zhmx~egkg u bk |~etkjegkg
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
39/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk :5 gh :5Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
J~hghfjekbhz |iji ~inxzwkz& Hz |izenbh {xh bkz j~hghfjekbhz ghdefegkz |k~k
|h~oewe~ i ghfhmk~ hb kjjhzi k xf zh~tejei ifbefh fi kbjkfjhf xfiz ofeoiz
hqemenbhz gh zhmx~egkg& Hf hb jkzi gh bkz jifw~kzhkz hzwiz fethbhz zh |xhghf
tkbi~k~ hf dxfjef gh zx jio|bh`egkg u zx hqwhfzef&
\izenebegkg gh kwk{xhz gh dxh~pk n~xwk& Kjwxkbohfwh hz |izenbh kxwiokwepk~ hb
efwhfwi gh kjjhzi k xf zh~tejei" |~inkfgi jehfwiz gh j~hghfjekbhz |i~ zhmxfgi
akzwk jifzhmxe~ bk i|jef kjh~wkgk u jif hbbk hb kjjhzi& Hf jkzi gh {xh hb
zezwhok fi jxhfwh jif xf ohjkfezoi gh nbi{xhi ghb kjjhzi kfwh bk ~hewh~kjef
gh h~~i~hz |ig~k dkjebewk~zh hzwh we|i gh kwk{xhz&
^ini gh j~hghfjekbhz& Bkz j~hghfjekbhz {xh |h~oewhf bk kxwhfwejkjef gh jkgk
xzxk~ei zxhbhf zh~ kbokjhfkgkz hf biz zezwhokz ghb kgoefezw~kgi~& \i~ hbbi" hz ghhz|hjekb eo|i~wkfjek {xh hb kjjhzi k gejaiz zezwhokz jxhfwh jif kbwkz ohgegkz
gh zhmx~egkg" gh oigi {xh fkgeh |xhgk kjjhgh~ k gejakz j~hghfjekbhz&
Kxzhfjek gh ohgegkz gh |~iwhjjef hf bk jioxfejkjef& Iw~i gh biz kz|hjwiz
k whfh~ hf jxhfwk hz {xh bk w~kfzoezef gh bkz j~hghfjekbhz ghzgh hb gez|izeweti
ghb xzxk~ei akzwk biz h{xe|iz ghb |~ithhgi~ zh ~hkbejh jif ohgegkz gh zhmx~egkg
{xh fi |h~oewkf k wh~jh~iz kjjhgh~ k hbbkz& Hb h`ho|bi oz jbk~i hz hb jed~kgi gh
hzwkz jioxfejkjeifhz&
7&>&> Ghwh~ei~i" oigedejkjef eftibxfwk~ek u ibtegi gh j~hghfjekbhz&
Hf hzwh m~x|i |xhghf efjbxe~zh gedh~hfwhz zewxkjeifhz hf bkz {xh bkz j~hghfjekbhz
hzwknbhjegkz gh`kf gh zh~ tbegkz i fi |xhghf xwebepk~zh&
Hb h`ho|bi oz nzeji hz hb ibtegi gh bkz jifw~kzhkz" |h~i wkonef |xhghf ijx~~e~ iw~iz
efjeghfwhz jioi biz gkiz hf biz wichfz i wk~`hwkz gh kjjhzi& Hf hb jkzi gh bk neiohw~k
|xhghf gk~zh oigedejkjeifhz dzejkz jioi" |i~ h`ho|bi" bhzeifhz {xh gedejxbwhf bk bhjwx~k
gh bkz axhbbkz gkjwebk~hz i hb xzi gh bhfwhz gh jifwkjwi {xh gedejxbwhf hz hzjkfhi ghb e~ez&
7&>&: Kxzhfjek i efhdhjwetegkg gh zezwhokz zhjxfgk~eiz&Uk zhk |i~ hb nbi{xhi ghb zezwhok |~efje|kb i |i~ fi |igh~zh xwebepk~ bkz j~hghfjekbhz"
zxhbh zh~ fhjhzk~ei hzwknbhjh~ xf zezwhok zhjxfgk~ei gh kxwhfwejkjef !h`0 |~hmxfwk gh
zhmx~egkg%& Hzwh zezwhok zhjxfgk~ei ghnh gh zh~ wkf ~inxzwi jioi hb zezwhok |~efje|kb"
uk {xh hf jkzi jifw~k~ei |izenebewk~k xf kjjhzi zhfjebbi k xzxk~eiz fi kxwi~epkgiz&
Bk efhqezwhfjek gh hzwiz zezwhokz zhjxfgk~eiz |xhgh eo|hge~ bk kxwhfwejkjef gh xzxk~eiz
bhmweoiz" oehfw~kz {xh bk dkbwk gh zhmx~egkg hf hbbiz |xhgh |h~oewe~ dkbziz |izewetiz&
7&>&7 H~~i~hz hf hb ~hmezw~i efejekb
Hb ~hmezw~i efejekb hz xf oiohfwi j~weji |k~k biz dxwx~iz |~ijhziz gh kxwhfwejkjef" |i~
hbbi jxkb{xeh~ h~~i~ hf b |xhgh kjk~~hk~ |~inbhokz |izwh~ei~ohfwh& Gh hz|hjekb
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
40/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 7< gh 7&8 H~~i~hz hf bk kxwhfwejkjef
Ghb oezoi oigi {xh zh |xhghf |~igxje~ h~~i~hz hf hb ~hmezw~i" zwiz |xhghf ijx~~e~ hf hb
oezoi oiohfwi gh bk kxwhfwejkjef& Mhfh~kbohfwh zxhbh w~kwk~zh gh bk|zxz kb efw~igxje~
biz eghfwedejkgi~hz gh xzxk~ei i bkz j~hghfjekbhz& Wkonef |xhgh w~kwk~zh gh kth~kz i
kxzhfjek gh biz hbhohfwiz fhjhzk~eiz |k~k efw~igxje~ bk efdi~okjef fhjhzk~ek !whjbkgiz"bhjwi~hz gh wk~`hwkz efwhbemhfwhz" zhfzi~hz u hzjfh~hz neiow~ejiz" hwj&%&
7&>&4 Kxzhfjek gh xf |~ijhzi gh jifde~okjef kfwh bk oigedejkjef gh
j~hghfjekbhz u iw~iz jkoneiz zxzwkfjekbhz
Xfk thp {xh zh |h~oewh {xh xf xzxk~ei zef kxwi~epkjef kjjhgk k xf zezwhok" hz |izenbh
{xh w~kwh gh ~hkbepk~ jkoneiz jioi bk oigedejkjef gh bkz j~hghfjekbhz gh kjjhzi& Gh
hzwh oigi" biz xzxk~eiz bhmweoiz fi |ig~kf kjjhgh~ u zx jxhfwk" |h~deb i ~hmezw~i gh
xzxk~ei {xhgk~k zhjxhzw~kgi& Oz kf" hfw~h hzwkz |izenbhz oigedejkjeifhz hzwk~ bk
|~i|ek hbeoefkjef gh bk jxhfwk i |h~deb gh xzxk~ei&
\i~ hbbi" zxhbh zh~ ~hjiohfgknbh {xh hzwh we|i gh oigedejkjeifhz jxhfwhf jif xfiz
~h{xezewiz {xh tkukf oz kbb {xh bk oh~k |~hzhfwkjef gh bkz j~hghfjekbhz gh kjjhzi"
|i~ h`ho|bi bk jifde~okjef k w~ktz gh iw~k jxhfwk i zh~tejei |~htekohfwh tefjxbkgi |h~i
efgh|hfgehfwh&
7&>&= Txbfh~kjeifhz gh bk fi~okwetk zin~h |~iwhjjef gh gkwiz |h~zifkbhz
Bk hbhjjef ghb oighbi gh kxwhfwejkjef u gh bk jkfwegkg gh efdi~okjef {xh zh zibejewk kb
xzxk~ei" |xhghf whfh~ jifzhjxhfjekz gh geth~zk fgibh h efjbxzi |bkfwhk~ xfk
txbfh~kjef gh bk fi~okwetk zin~h bk |~iwhjjef gh gkwiz |h~zifkbhz& Hzwi zh ghnh hf
m~kf ohgegk k bk fhjhzegkg gh efdi~ok~ ghnegkohfwh kb xzxk~ei zin~h bk efdi~okjef {xh
zh tk k xwebepk~ u biz xziz {xh zh bh tkf k gk~" kghoz gh xfk zh~eh gh inbemkjeifhz hf hb
kbokjhfkoehfwi u w~kwkoehfwi gh hzwkz efdi~okjeifhz&
Iw~i gh biz |izenbhz |~inbhokz ~hbkjeifkgiz jif bk |~iwhjjef gh gkwiz u bk |~etkjegkg hf
biz |~ijhziz gh kxwhfwejkjef hz {xh hb kgoefezw~kgi~ ghzthbh oz efdi~okjef gh bk {xh
~hkbohfwh hz hzw~ejwkohfwh fhjhzk~ek& Xf h`ho|bi gh hzwk zewxkjef hz bk efdi~okjef {xh
zh |xhgh |~i|i~jeifk~ kb zhkbk~ k xf xzxk~ei {xh efwhfwk kn~e~ xfk jxhfwk jif xfk
ge~hjjef gh ji~~hi hbhjw~feji {xh uk hqezwh xfk jxhfwk kzijekgk k gejak ge~hjjef i {xhfi hqezwh fefmxfk& Bk oh~k jioxfejkjef gh hzwk efdi~okjef tk ji~~hi hbhjw~feji
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
41/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 7; gh 7;Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
hbeoefk~k hf nxhfk ohgegk hzwh ~ehzmi" uk {xh zibkohfwh zh~k tezenbh |k~k {xehf |xhgk
kjjhgh~ k gejak jxhfwk&
7&>&1 ^ini i |~gegk gh gkwiz |h~zifkbhzJxkfgi xfk |h~zifk fi kxwi~epkgk kjjhgh kb zezwhok u k bk efdi~okjef jifwhfegk hf b"
zh jio|~iohwh bk jifdeghfjekbegkg gh bk efdi~okjef& Xfk gh zxz |izenbhz jifzhjxhfjekz
oz hteghfwhz hf hzwiz jkziz hz bk |~gegk gh |~etkjegkg&
Iw~i ~ehzmi gh~etkgi ghb h~~i~ hf bk kxwi~epkjef hz bk |~gegk gh bk |~i|ek efdi~okjef" uk
{xh biz gkwiz |ig~kf zh~ hbeoefkgiz" eo|egefgizh kz {xh biz xzxk~eiz bhmweoiz
kjjhgeh~kf k hbbk !|~inbhok gh gez|ifenebegkg gh bk efdi~okjef%&
Hzwh ~ehzmi hz gh hz|hjekb ~hbhtkfjek wkfwi hf onewiz ho|~hzk~ekbhz" gifgh bk |~gegkgh jifdeghfjekbegkg gh bk efdi~okjef |xhgh |ifh~ hf ~ehzmi bk teknebegkg u hb dxwx~i gh
xfk ho|~hzk" jioi hf bkz |bkwkdi~okz gh ~hghz zijekbhz" uk {xh hf hbbkz zxhbh kbi`k~zh
oxjak efdi~okjef |h~zifkb&
7&>&5 Zx|bkfwkjef gh eghfwegkg
Hb oh~i kjjhzi k xf zezwhok |i~ |k~wh gh xfk |h~zifk fi kxwi~epkgk akjefgizh |kzk~
|i~ xf xzxk~ei bhmweoi |ig~k jifzegh~k~zh hf z xfk zx|bkfwkjef gh eghfwegkg" |h~i
hzwk zx|bkfwkjef |xhgh e~ oz kbb ze hb efw~xzi kjwk gh oigi {xh zxz kjjeifhz
|k~hpjkf zh~ ~hkbepkgkz |i~ hb xzxk~ei bhmweoi&
Ze nehf hzwh kjjhzi k biz zh~tejeiz u jxhfwkz gh iw~k |h~zifk hz xfk gh bkz |~efje|kbhz
di~okz gh zx|bkfwkjef gh eghfwegkg" zwk |xhgh gk~zh gh iw~iz oigiz" hzhfjekbohfwh
~hmezw~kfgi xfk jxhfwk" |h~deb i xzxk~ei hf fion~h gh iw~k |h~zifk& Gh hzwh oigi" bk
|h~zifk zx|bkfwkgk |ig~k efjbxzi ghzjifijh~ wkb zx|bkfwkjef&
Ghnh whfh~zh hf jxhfwk {xh bkz tjweokz gh xfk zx|bkfwkjef fi wehfhf |i~{x zh~
fejkohfwh |k~wejxbk~hz i |h~zifkz dzejkz" zefi {xh wkonef zh |xhgh zx|bkfwk~ bk
eghfwegkg gh xfk hfwegkg x i~mkfepkjef" |i~ h`ho|bi ohgekfwh kwk{xhz gh ghdkjefmk
xfk |mefk }hn" i gh zx|bkfwkjef gh bk eghfwegkg ghb zh~tegi~ }hn" jioi hfhfthfhfkoehfwi GFZ i hb |ak~oefm&
Tk~ekz zif bkz jifzhjxhfjekz oz hteghfwhz gh xfk zewxkjef gh zx|bkfwkjef gh
eghfwegkg0
D~kxgh0 Bk zx|bkfwkjef gh eghfwegkg |xhgh whfh~ jioi in`hweti hb d~kxgh
hjifoeji" |i~ h`ho|bi hf jkzi gh {xh zh zx|bkfwh k xfk ho|~hzk x
i~mkfepkjef {xh |~hzwh xfiz zh~tejeiz k jkonei gh jifw~k|~hzwkjeifhz
hjifoejkz& Hf hzwh jkzi hb xzx~|kgi~ |xhgh bbhmk~ k ~hjene~ biz efm~hziz {xh
hdhjwkf xzxk~eiz zef id~hjh~ k jkonei biz zh~tejeiz kfxfjekgiz&
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
42/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 7> gh 7>Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Jioezef gh ghbewiz0 Hb hqw~hoi oz m~kth gh bk zx|bkfwkjef gh eghfwegkg hz bk
jioezef gh ghbewiz" gh oigi {xh hb zx|bkfwkgi~ |ig~k {xhn~kfwk~ bk bhu gh wkb
di~ok {xh |k~hpjk {xh {xehf bi akjh hz bk |h~zifk zx|bkfwkgk& Hzwh hqw~hoi hz
oz m~kth ze jknh jxkfgi bk zx|bkfwkjef zh bbhtk k jkni xwebepkfgi efdi~okjef
neiow~ejk" uk {xh zh w~kwk gh xfk efdi~okjef oxu gedjeb gh zeoxbk~ u |i~ wkfwi gh
~h|~ink~ hf xf |~ijhzi `xgejekb&
Gkiz hf bk eokmhf |nbejk0 Biz hdhjwiz gh {xh xfk |h~zifk zx|bkfwh bk
eghfwegkg gh iw~k |xhghf zh~ tk~eiz" |h~i jbk~kohfwh |xhghf |~igxje~zh gkiz k
zx eokmhf |nbejk& Hf oxjakz ijkzeifhz bk k|~i|ekjef gh xfk eghfwegkg zh
tefjxbk jif kjiziz jxui in`hweti hz |~itijk~ xf gki k bk |h~zifk zx|bkfwkgk&
Hf hzwiz jkziz bk zx|bkfwkjef hz xf |~eoh~ |kzi efzw~xohfwkb k xfk jifgxjwk
oz jio|bh`k {xh |xhgh kgi|wk~ obwe|bhz okfedhzwkjeifhz& \i~ h`ho|bi" hbzx|bkfwkgi~ |xhgh kgi|wk~ jifgxjwkz hzjkfgkbizkz" okfedhzwk~ i|efeifhz
zijekbohfwh efkjh|wknbhz" efwh~kjwxk~ jif biz jifwkjwiz gh bk tjweok gh oigi
km~hzeti" hwj& Wigkz hzwkz jifgxjwkz zxhbhf |h~zhmxe~ hb in`hweti gh id~hjh~ xfk
dkbzk eokmhf |nbejk ghb zx|bkfwkgi jif hb in`hweti gh kwkjk~ zx ~h|xwkjef&
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
43/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 7: gh 7:Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
8 N XHF KZ \ J WEJ KZ \ K K KG OEF EZ W KGI H Z
Bkz hfwegkghz {xh mhzweifkf zezwhokz gh kxwhfwejkjef wehfhf bk ~hz|ifzknebegkg gh
hzwknbhjh~ xf oighbi wjfeji" i~mkfepkweti u `x~geji ~hz|hwxizi jif biz gh~hjaiz gh bkz
|h~zifkz eo|bejkgkz |k~k hzwknbhjh~ xfk ~hbkjef gh jifdekfpk" kz jioi gh eo|bhohfwk~bkz ohgegkz gh zhmx~egkg zxdejehfwhz |k~k |~iwhmh~ kghjxkgkohfwh bk efdi~okjef
|h~zifkbhz gh zxz xzxk~eiz&
\k~k hbbi" k jifwefxkjef zh zhkbk xfk zh~eh gh nxhfkz |~jwejkz u ~hjiohfgkjeifhz
~hdh~egkz k bk kxwhfwejkjef gh bk eghfwegkg {xh ghnh~kf zh~ whfegkz hf jxhfwk |i~ |k~wh
gh biz mhzwi~hz u ghzk~~ibbkgi~hz gh zezwhokz gh kxwhfwejkjef&
8&; HBHJJEF KGHJXKGK GHB WE\I GH J^HGHFJEKB
Ghzgh xfk |h~z|hjwetk gh zhmx~egkg" bk ghwh~oefkjef ghb we|i gh efdi~okjef {xh tk kzh~ xwebepkgk |k~k bk kxwhfwejkjef hz xf |~eoh~ |kzi hzhfjekb" uk {xh hf nxhfk ohgegk
beoewk~ biz ~ehzmiz& Kz" hb xzi gh zezwhokz gh ginbh dkjwi~ zeho|~h {xh zhk |izenbh
kxohfwk jifzegh~knbhohfwh biz fethbhz gh zhmx~egkg d~hfwh k |izenbhz kjjhziz fi
kxwi~epkgiz i dkbziz |izewetiz&
Ze nehf hz jeh~wi {xh biz zezwhokz gh kxwhfwejkjef nkzkgiz hf bk neiohw~k zif kbwkohfwh
deknbhz" hz fhjhzk~ei ~hji~gk~ {xh" kghoz gh eo|bejk~ okui~hz fhjhzegkghz hf jxkfwi k
~hjx~ziz jio|xwkjeifkbhz" biz gkwiz neiow~ejiz |xhghf jifzegh~k~zh gkwiz gh jk~jwh~
|h~zifkb gh hz|hjekb |~iwhjjef" |i~ bi {xh zx xzi jifbbhtk xfk zh~eh gh inbemkjeifhzbhmkbhz zx|h~ei~hz k bkz gh~etkgkz gh bk xwebepkjef gh gez|izewetiz dzejiz i jifw~kzhkz&
Hf hzwk hbhjjef zh ghnh jifzegh~k~ k zx thp biz gedh~hfwhz we|iz gh gez|izewetiz ghzgh
biz {xh zh tk k w~kwk~ gh kjjhgh~ kb zezwhok" uk {xh hz |izenbh {xh fi hf wigiz biz jkziz
zhk dkjwenbh bk xwebepkjef gh gedh~hfwhz hbhohfwiz dzejiz |k~k bk kxwhfwejkjef& K hzwh
~hz|hjwi zh ghnh zhkbk~ hb jifzwkfwh ghzk~~ibbi gh fxhtkz zibxjeifhz |k~k dkjebewk~ bk
xwebepkjef gh biz gedh~hfwhz hbhohfwiz k w~ktz gh gedh~hfwhz ohgeiz& Jioi h`ho|bi gh
hbbi |xhgh fion~k~zh hb |~iuhjwi GFEh G~ieg" ghzk~~ibbkgi |i~ EFWHJI |k~k |h~oewe~ bk
xwebepkjef ghb GFE hbhjw~feji hf zok~w|aifhz {xh jxhfwhf jif hb zezwhok i|h~kweti
Kfg~ieg>>&
8&> \^HTHFJEF D^HFWH K KWK[XHZ GH DXH^PK N^XWK
Kfwh bk |izenebegkg gh {xh xf kwkjkfwh w~kwh gh kjjhgh~ k xf zezwhok |~inkfgi gedh~hfwhz
j~hghfjekbhz" hz ~hjiohfgknbh hzwknbhjh~ xf zezwhok gh nbi{xhi {xh eo|egk jxkb{xeh~
kjjhzi w~kz ~hmezw~k~zh ghwh~oefkgi foh~i gh efwhfwiz dkbbegiz& Hzwh boewh ghnh |h~oewe~
{xh hb xzxk~ei kjjhgk |hzh k aknh~ jiohwegi kbmf h~~i~ kb w~kwk~ gh kjjhgh~" |i~ hbbi hb
nbi{xhi mhfh~kbohfwh fi zh |~igxjh akzwk xf {xefwi efwhfwi dkbbegi&
>>aww|0))}}}&efwhji&hz)|~hzz^iio)\~hfzk)KjwxkbegkgYEFWHJI)GFEhYG~ieg
8& Nxhfkz |~jwejkz |k~k kgoefezw~kgi~hz
http://www.inteco.es/pressRoom/Prensa/Actualidad_INTECO/DNIe_Droidhttp://www.inteco.es/pressRoom/Prensa/Actualidad_INTECO/DNIe_Droidhttp://www.inteco.es/pressRoom/Prensa/Actualidad_INTECO/DNIe_Droidhttp://www.inteco.es/pressRoom/Prensa/Actualidad_INTECO/DNIe_Droid7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
44/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 77 gh 77Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
W~kz bbhtk~zh k jkni hzwh nbi{xhi zh ghnhf aknebewk~ zezwhokz zhjxfgk~eiz gh
kxwhfwejkjef" uk zhk |k~k hb kjjhzi i |k~k bk ~hghdefejef gh fxhtkz j~hghfjekbhz&
Jioi kbwh~fkwetk kb nbi{xhi" uk {xh zwh jifteh~wh kb bhmweoi xzxk~ei hf bk tjweok kb fi|igh~ kjjhgh~ k zxz zh~tejeiz i |h~debhz" i gh di~ok jio|bhohfwk~ek zh |xhgh jifzegh~k~
bk efji~|i~kjef gh zezwhokz jioi biz jifijegiz jioi jk|wjakz" {xh hqemhf xfk
jio|~inkjef gh {xh {xehf w~kwk gh kxwhfwejk~zh hz xf axokfi" fi xf zezwhok
efdi~oweji {xh |xhgk kxwiokwepk~ biz kwk{xhz gh dxh~pk n~xwk& Hzwiz zezwhokz |xhghf
jifzezwe~ hf ghzjed~k~ xfk |kbkn~k i jifw~kzhk {xh zh |~hzhfwk gezwi~zeifkfgi zxz
jk~kjwh~hz i hqeme~ bk ~hz|xhzwk gh xfk |~hmxfwk jioi |i~ h`ho|bi xfk zxok&
8&: ZEZWHOKZ ZHJXFGK^EIZ ZHMX^IZ
Hz fhjhzk~ei {xh zh eo|bkfwhf zezwhokz zhjxfgk~eiz {xh |izenebewhf hb kjjhzi hf jkzi gh{xh hb zezwhok |~efje|kb fi |xhgk xwebepk~zh |i~ jxkb{xeh~ oiweti& Hzwiz zezwhokz
zhjxfgk~eiz |xhghf bbhmk~ efjbxzi k xf wh~jh~ fethb hf jkzi gh {xh hb zezwhok zhjxfgk~ei
hzwknbhjegi fi |xhgk zh~ web& H`ho|bi gh hbbi hz bk |izenebegkg gh {xh hb zezwhok
zhjxfgk~ei hzwknbhjegi jifzezwk hf hb hfti gh xfkz fxhtkz j~hghfjekbhz" i gh xf kjjhzi
|k~k ~hghdefe~bkz" k xfk jxhfwk gh ji~~hi" |xgehfgi hb xzxk~ei aknh~ jkfjhbkgi gejak
ge~hjjef i |h~gegi zx jifw~ib&
Biz zezwhokz zhjxfgk~eiz gh kxwhfwejkjef ghnhf jifwk~ jif hb oezoi fethb gh zhmx~egkg
{xh zh hqemh hf hb ohjkfezoi |~efje|kb" uk {xh hf jkzi gh ~h{xh~e~ ohfi~hz hqemhfjekz|ig~kf jifth~we~zh hf xfk |xh~wk kneh~wk gh jk~k k |izenbhz zx|bkfwkjeifhz&
Xfi gh biz zezwhokz zhjxfgk~eiz oz xwebepkgiz hz di~oxbk~ xfk |~hmxfwk {xh hb xzxk~ei
ak ghwh~oefkgi jif kfwh~ei~egkg `xfwi k zx ~hz|xhzwk& Hf oxjaiz jkziz zh zxmeh~hf
kbmxfkz |~hmxfwkz {xh ~hkbohfwh fi |xhghf jifzegh~k~zh zhmx~kz kb |igh~ zh~
~hz|ifgegkz |i~ jxkb{xeh~ |h~zifk {xh jifipjk ofeokohfwh kb xzxk~ei" gh oigi {xh
|ig~k bbhmk~ k zx|bkfwk~ zx eghfwegkg u kjjhgh~ k zx |h~deb i jxhfwk zef zx
jifzhfweoehfwi& H`ho|bi gh hzwkz |~hmxfwkz gh zhmx~egkg zif hb fion~h gh kbmf
dkoebek~" gh xfk okzjiwk" gh zx |~eoh~ jibhmei i gh zx |hbjxbk dkti~ewk&
Wko|iji |xhgh jifzegh~k~zh zhmx~i xf zezwhok gh kxwhfwejkjef zhjxfgk~ei hf hb {xh
zh xwebejh k iw~iz xzxk~eiz jioi mk~kfwhz gh xfk eghfwegkg" uk {xh zh dkjebewk~k xf kwk{xh
ohgekfwh efmhfeh~k zijekb |k~k kjjhgh~ k xf ghwh~oefkgi zh~tejei& Xf h`ho|bi gh hbbi
zh~k xf zh~tejei ifbefh {xh |k~k ~hzwknbhjh~ xfk jifw~kzhk hf jkzi gh ibtegi |egk {xh
zh zhkbhf ghwh~oefkgiz xzxk~eiz {xh zh jifzegh~hf jifwkjwiz gh jifdekfpk |k~k {xh
th~ede{xhf bk eghfwegkg gh {xehf {xeh~h ~hzwknbhjh~ bk jifw~kzhk& Hzwh zezwhok dkjebewk~k
kjjhziz efghnegiz uk {xh ghbhmk hf iw~iz xzxk~eiz bk kxwhfwejkjef" zhkf hzwiz jifwkjwiz
~hkbhz i j~hkgiz |k~k hzwknbhjh~ xf kwk{xh ohgekfwh efmhfeh~k zijekb&
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
45/64
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
46/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 74 gh 74Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Gh hzwh oigi" bk hbhjjef gh jifw~kzhkz ghnh efjbxe~ xfkz jifgejeifhz gh jio|bh`egkg
jioi |xhghf zh~ xfk bifmewxg ofeok u bk efjbxzef gh okuzjxbkz" oefzjxbkz"
foh~iz u zonibiz&
Ghb oezoi oigi" hz ~hjiohfgknbh eo|hge~ hb xzi gh jionefkjeifhz ghokzekgi
zhfjebbkz" jioxfhz i djebhz gh kgetefk~ !|i~ h`ho|bi0 |kzz}i~g" jifw~kzhk" {}h~wu"
;>:784" knj;>:%&
\i~ iw~i bkgi" ghnh ~hjiohfgk~zh k biz xzxk~eiz defkbhz {xh htewhf {xh bkz jifw~kzhkz
zhkf i efjbxukf gkwiz |h~zifkbhz& Hzwk ~hjiohfgkjef |xhgh bbhmk~ k jifth~we~zh hf xfk
|~iaenejef hf kbmxfiz jkziz" jioi |i~ h`ho|bi hf bi {xh ~hz|hjwk kb xzi gh biz oezoiz
gkwiz {xh zh akf k|i~wkgi hf hb ~hmezw~i !fion~h" dhjak gh fkjeoehfwi" foh~i gh
whbdifi" hwj&%&
\i~ iw~i bkgi" biz mhzwi~hz gh biz zezwhokz ghnhf |~ioith~" h efjbxzi hqeme~" bk
~hfitkjef gh bkz jifw~kzhkz jkgk jeh~wi weho|i&
8&= JIO\^INKJEF GH J^HGHFJEKBHZ HF HB ^HMEZW^I
Hf hb ~hmezw~i ghnhf hzwknbhjh~zh jbk~kohfwh bkz efdi~okjeifhz {xh zh xwebepk~f |k~k
|izwh~ei~hz kjjhziz u kxwhfwejkjeifhz& \i~ hbbi zh ghnh |~hzwk~ hz|hjekb kwhfjef kb
jio|~ink~ {xh hb xzxk~ei fi jiohwh h~~i~hz {xh bh |xhgkf eo|hge~ hb kjjhzi hf hb
dxwx~i&
Xf h`ho|bi gh hzwk zewxkjef hz whjbhk~ h~~fhkohfwh xfk jifw~kzhk hf hb |~ijhzi gh
~hmezw~i& Hzwk zewxkjef |xhgh htewk~zh hqemehfgi {xh bk oezok zhk whjbhkgk giz thjhz u
jio|~inkfgi {xh jifjxh~gk" kghoz gh ktezk~ kb xzxk~ei hf jkzi gh {xh hb whjbkgi
okfwhfmk kjwetk kbmxfk dxfjef jioi bk hzj~ewx~k hf okuzjxbkz&
8&1 HZWKNBHJH^ OHGEGKZ GH ZHMX^EGKG KFWH JKONEIZ GH
J^HGHFJEKBHZ U IW^KZ OIGEDEJKJEIFHZ GH JKBKGI
Hz fhjhzk~ei {xh ghwh~oefkgiz jkoneiz hf bk jifdemx~kjef gh xzxk~ei" jioi |i~
h`ho|bi bk oigedejkjef gh j~hghfjekbhz i bk hbeoefkjef gh bk jxhfwk i |h~deb" zh|~igxpjkf w~kz jio|~ink~zh fxhtkohfwh bk eghfwegkg ghb xzxk~ei&
Gejak jio|~inkjef ghnh~k ~hkbepk~zh ohgekfwh xf zezwhok gedh~hfwh kb ho|bhkgi |k~k
hb kjjhzi" gh oigi {xh hf jkzi gh {xh xf kwkjkfwh |xgeh~k zx|h~k~ hb zezwhok gh
kxwhfwejkjef efejekb fi |xhgk eo|hge~ kb bhmweoi xzxk~ei hb kjjhzi&
8&5 EO\BEJKJEF GH WH^JH^IZ
Bk eo|bejkjef gh iw~iz kmhfwhz hf hb |~ijhzi gh kxwhfwejkjef ghnh bbhtk~zh k jkni jif
hz|hjekb jkxwhbk" uk {xh |xhgh bbhmk~ k |h~oewe~zh {xh hzwiz wh~jh~iz jifipjkfghwh~oefkgiz gkwiz gh eghfwedejkjef&
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
47/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 7= gh 7=Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
Bk kxwhfwejkjef dhgh~kgk hz xf jbk~i h`ho|bi hf hb {xh bk kxwhfwejkjef zh bbhtk k jkni
jifwkfgi jif oz kmhfwhz eo|bejkgiz {xh hb |~i|ei xzxk~ei u hb |~ithhgi~ gh zh~tejeiz&
Hzwh we|i gh kxwhfwejkjef hz ~hjiohfgknbh zeho|~h {xh hb kmhfwh th~edejkgi~ i
kxwhfwejkgi~ |~hzhfwh mk~kfwkz hf ~hdh~hfjek kb ~hz|hwi gh bk |~etkjegkg gh biz xzxk~eiz&
Hf jxkb{xeh~ jkzi" hb kjjhzi k bk efdi~okjef gh eghfwedejkjef zh ghnh beoewk~ k wh~jh~iz
{xh whfmkf xfk |izejef `xzwedejkgk u deknbh hf jkgk jkzi&
8&;< KBOKJHFKOEHFWI ZHMX^I
Bk efdi~okjef gh kxwhfwejkjef hz kbokjhfkgk hf biz zezwhokz ghb kmhfwh hfjk~mkgi ghb
|~ijhzi gh kxwhfwejkjef |k~k kz |igh~ xwebepk~bk kb jio|~ink~ bk jifji~gkfjek gh zwk
jif bk k|i~wkgk |i~ biz xzxk~eiz ghb zh~tejei& Hzwi inbemk k {xh gejai kbokjhfkoehfwi
jxhfwh jif kbwkz ohgegkz gh zhmx~egkg |k~k {xh fkgeh |xhgk kjjhgh~ k hbbk zefkxwi~epkjef&
Hzwkz ohgegkz ghnhf eo|hge~ {xh fkgeh |xhgk kjjhgh~ k bkz j~hghfjekbhz ghb ~hzwi gh
xzxk~eiz" |h~i ghnhf hzwknbhjh~ wkonef {x |h~zifkz i |h~debhz gh xzxk~ei ghfw~i bk
i~mkfepkjef |~hzwkgi~k gh zh~tejeiz |xhghf kjjhgh~ k hbbkz& Hz ghje~" hf bk ghdefejef gh
~ibhz u ~hz|ifzknebegkghz gh bk i~mkfepkjef zh ghnh ghbeoewk~ hb kjjhzi k bkz
j~hghfjekbhz gh biz xzxk~eiz jbehfwhz&
Hf jxkb{xeh~ jkzi" zeho|~h hz kjifzh`knbh {xh bk efdi~okjef kbokjhfkgk hzw jed~kgk"
gh oigi {xh efjbxzi hf jkzi gh {xh kbmxehf |xgeh~k zx|h~k~ bkz gedh~hfwhz ohgegkz gh
zhmx~egkg" zwh fi |xgeh~k kjjhgh~ k bkz j~hghfjekbhz&
Hz fhjhzk~ei whfh~ hf jxhfwk k zx thp hb bxmk~ gifgh zh bijkbepkf biz zh~tegi~hz hf biz
{xh zh kbokjhfk~ bk efdi~okjef gh kxwhfwejkjef" ghnegi hz|hjekbohfwh k bkz gedh~hfwhz
bhmezbkjeifhz k|bejknbhz hf jkgk |kz ~hz|hjwi k biz zezwhokz gh zhmx~egkg u bk
|~iwhjjef gh gkwiz |h~zifkbhz&
8&;; W^KFZOEZEF JED^KGK
Hb efwh~jkonei gh efdi~okjef hfw~h biz gez|izewetiz gh biz xzxk~eiz u biz h{xe|iz hf biz{xh zh kbi`k hb zezwhok" u hz|hjekbohfwh hb efwh~jkonei gh j~hghfjekbhz" ghnh ~hkbepk~zh
gh oigi {xh fkgeh k`hfi k hzwh efwh~jkonei |xhgk jifijh~ hzwk efdi~okjef& \k~k hbbi"
zh kjifzh`k {xh hzwk efdi~okjef zh jed~h" gh oigi {xh hf jkzi gh {xh kbmxehf |xhgk
kjjhgh~ k bkz j~hghfjekbhz hftekgkz fi zhk jk|kp gh efwh~|~hwk~bkz&
Hzwk nxhfk |~jwejk hz gh hz|hjekb ~hbhtkfjek hf hb ghzk~~ibbi gh k|bejkjeifhz u zh~tejeiz
|k~k gez|izewetiz otebhz" uk {xh xwebepkf whjfibimkz efkbon~ejkz u |i~ wkfwi zxz
w~kfzoezeifhz zif oz djebhz gh efwh~jh|wk~& Zh akf ghwhjwkgi fxoh~iziz jkziz hf biz
{xh bk efdi~okjef zh w~kfzoewh hf whqwi |bkfi" |bhfkohfwh bhmenbh |k~k jxkb{xeh~k"|ifehfgi kz hf ~ehzmi bk |~etkjegkg gh hzwkz j~hghfjekbhz&
7/30/2019 Gua sobre riesgos y buenas prcticas en autenticacin online
48/64
Mxk zin~h ~ehzmiz u nxhfkz |~jwejkz hf kxwhfwejkjef ifbefh \mefk 71 gh 71Efzwewxwi Fkjeifkb gh Whjfibimkz gh bk Jioxfejkjef
8&;> FI K\I^WK^ OZ EFDI^OKJEF GH BK GHNEGK ZIN^H BIZ XZXK^EIZ
Bk kjwxkjef gh biz |~hzwkgi~hz gh zh~tejeiz u gh biz kmhfwhz hfjk~mkgiz gh bk
kxwhfwejkjef ghnh whfh~ hfw~h zxz |~hoezkz bk jifzh~tkjef gh bk |~etkjegkg gh bizxzxk~eiz" |i~ bi {xh fi ghnhf k|i~wk~ efdi~okjef kjh~jk gh hbbiz zkbti hf jkziz
wiwkbohfwh eo|~hzjefgenbhz&
\i~ h`ho|bi" hz aknewxkb {xh kb w~kwk~ gh ~hkbepk~ xf fxhti ~hmezw~i hf hb {xh zh xwebejh
efdi~okjef uk ~hmezw~kgk zh ktezh gh hzwk zewxkjef" |i~ h`ho|bi efdi~okfgi gh {xh bk
ge~hjjef gh ji~~hi hbhjw~feji {xh zh efwhfwk xwebepk~ |k~k ~hmezw~k~zh hf xf zh~tejei uk ak
zegi xwebepkgk |k~k ~hmezw~k~zh kfwh~ei~ohfwh& Hzw |~jwejk k|i~wk oz efdi~okjef gh bk
{xh ghnh~k zin~h biz xzxk~eiz ghb zezwhok" uk {xh hf hb jkzi gh jeh~wiz gkwiz {xh
|ig~kf eghfwedejk~ k xfk |h~zifk" |i~ h`ho|bi zx ge~hjjef gh ji~~hi hbhjw~feji"
|ifg~kf hf hteghfjek {xh gejak |h~zifk zh ak ~hmezw~kgi hf hb zh~tejei&
Hzwk zewxkjef zh |xhgh htewk~" |i~ h`ho|bi" ~hkbepkfgi gejak fiwedejkjef ohgekfwh xf
ji~~hi hbhjw~feji" gh oigi {xh zibkohfwh |xgeh~k jifijh~ hzwh ktezi hb xzxk~ei jif
kjjhzi k hzk jxhfwk gh ji~~hi&
Ghb oezoi oigi {xh fi zh ghnh~k efdi~ok~ zin~h ze xfk efdi~okjef uk ak zegi
~hmezw~kgk" wko|iji zh ghnh~k efdi~ok~ hf jkzi gh {xh fi bi hzwxteh~k& Hf hzwh jkzi bk
zewxkjef efkghjxkgk |ig~k ijx~~e~ wkfwi hf hb |~ijhzi gh ~hmezw~i jioi hf hb |~ijhzi gh
kxwhfwejkjef&
8&;: ^H[XEZEWIZ BHMKBHZ
Kb mhzweifk~ biz zezwhokz gh kxwhfwejkjef zh ghnh whfh~ hf jxhfwk {xh wkfwi bk
efdi~okjef xwebepkgk hf hb |~ijhzi gh kxwhfwejkjef jioi bk efdi~okjef {xh zh |~iwhmh
ohgekfwh hzwh ohjkfezoi" h efjbxzi biz zh~tejeiz k biz {xh zh gk kjjhzi" |xhghf jifwk~
jif ghwh~oefkgiz ~h{xezewiz bhmkbhz&
Gh hzwh oigi" hz fhjhzk~ei tkbi~k~ hf jkgk jkzi jxbhz zif bkz eo|bejkjeifhz bhmkbhz k
bkz {xh zh ghnh akjh~ d~hfwh" |xgehfgi hf oxjaiz jkziz zh~ fhjhzk~ei ~h|bkfwhk~ghwh~oefkgiz kz|hjwiz ghb |~ijhzi gh kxwhfwejkjef gezhkgi&
Xf jbk~i h`ho|bi gh hzwkz zewxkjeifhz hz hb xzi gh ghwh~oefkgkz efdi~okjeifhz
neiow~ejkz {xh" kb |igh~ bbhmk~ k zhkbk~ kz|hjwiz zin~h bk zkbxg i hb i~emhf wfeji"
|ig~kf fhjhzewk~ xf w~kwkoehfwi hz|hjekb |k~k |igh~ jxo|be~ biz ~h{xezewiz hzwknbhjegiz
|i~ bk Bhu I~mfejk gh \~iwhjjef gh Gkwiz gh Jk~jwh~ \h~zifkb !BI\G%&
Bkz oezokz jifzegh~kjeifhz zh ghnhf whfh~ hf jxhfwk hf hb |~ijhzi gh ~hmezw~i" uk {xh