“TU CONTRASEÑA NO ES VÁLIDA”

Validación proactiva de contraseñas

Desde que el mundo es mundo y el hombre camina sobre dos pies, hay una serie de verdades universales que han acompañado a la especie humana durante todo su desarrollo. Una de ellas, muy usada por los que nos dedicamos a la seguridad de los datos, es esa de que “somos tan fuertes como el eslabón más débil”. Y de eso vamos a hablar en este post, de la debilidad, tanto de una contraseña en sí como del conocimiento del uso de tecnología de quien elige una contraseña débil.

Cierto es que la mejor manera de evitar esto es usar una tecnología de identidad que añada una capa de seguridad para que la identificación del usuario no resida solo en la dupla login/contraseña, pero hoy en día, multitud de empresas, organismos y servicios todavía se siguen basando en ese sistema sabidamente tan vulnerable.

He escrito bastante otras veces sobre el uso de contraseñas. Recomiendo especialmente ya que esta reflexión está basada mayormente en este otro artículo. Básicamente, una de las más arduas batallas de la seguridad es bastionar ese eslabón débil que es el usuario, de forma que sepa lo que significa que use una contraseña débil, o la reuse en varios servicios. En este menester juega un papel importantísimo la CONCIENCIACIÓN COMO SERVICIO (ver artículo de mi compañero @n4xh4ck5), en el que cada vez más estamos implicados las empresas de seguridad: Enseñar a nuestros usuarios a protegerse contra amenazas comunes haciendo un uso responsable de la tecnología que cada vez implica más aspectos de nuestras empresas e instituciones.

Pero ¿Por qué confiar en que no usará una contraseña muy frágil? ¿No sería mejor impedir que esto pueda tener lugar? De modo que, como buen “Doer-No-Powerpointer”, me puse a darle una vuelta de tuerca a ese PWANALIZER que ya publiqué en GITHUB, y desarrollé un PWCHECKER, para que de modo fácil e instantáneo se pueda validar con un “SI” O “NO” si vamos a aceptar una contraseña para un determinado usuario.

Resumido: El concepto (tan simple como útil) ahora consta de 2 scripts:

PWANALIZER: contrasta nuestra lista de passwords (o listas user:password) contra una serie de diccionarios comunes, que podemos añadir a nuestra lista bajo la carpeta “-dics-“ en formato txt. El más común y usado es el archiconocido RockYou.txt. Y nos dará un porcentaje de las contraseñas incluídas en esos ficheros, lo cual, depende del tamaño del fichero de diccionario, pues habrá que valorar. Tómese esto como una forma de VALORAR EL ESTADO DE CONCIENCIACIÓN DE CIBERSEGURIDAD, ya que un número muy alto de fechas, nombres propios o peor aún, de “123456” puede dejar bien claro que nuestra empresa necesita de un repaso a la ciberseguridad.

PWCHECKER: Es una validación True/False en base al código de salida de ejecución (“%ERRORLEVEL%  en sistemas Windows, $? En linux) partiendo de 2 validaciones separadas:

  • POLÍTICA DE CONTRASEÑAS: Si queremos que tenga una mayúscula, minúscula, números o simbolos. Estos parámetros se definen con un True/False.
  • EXCLUSIÓN DE DICCIONARIO: El diccionario usado, se pasa como argumento, pudiendo usar el mencionado RockYou, o bien otro. Incluyo en el GITHUB, el diccionario de 10.000 contraseñas más comunes, uno de los pilares y más recomendables al realizar pruebas de ataque de diccionario.

En fin, eso ha sido todo, de momento. Como puede verse, a veces implementar medidas de seguridad es más cuestión de proactividad que de horas/hombre, y pequeños gestos pueden significar la diferencia entre dormir tranquilos y una terrible debacle.

Seguiremos informando. Permanezcan en sintonía.

Andrés Naranjo @TheXXLMAN

67 Responses to “TU CONTRASEÑA NO ES VÁLIDA”

  1. i love this immaculate article

  2. viagra price dice:

    Thanks for your own work on this website. My mum takes pleasure in setting aside time for research and it is simple to grasp why. We notice all relating to the powerful way you provide very important tips and hints via your website and therefore strongly encourage response from visitors on this theme while our own simple princess is without a doubt understanding so much. Take pleasure in the rest of the year. Your performing a useful job.

  3. I am just writing to make you understand of the beneficial discovery my child developed browsing the blog. She came to find a lot of details, including how it is like to have a great coaching character to get certain people completely comprehend a number of complex issues. You actually did more than her desires. I appreciate you for coming up with such effective, dependable, edifying and cool guidance on that topic to Ethel.

  4. film izle dice:

    GreateExcellent articlepiecespost. Keep writingposting such kind of informationinfo on your blogpagesite. Im really impressed by your blogyour siteit. Rosalyn Zachery Landan

  5. Hello colleagues, nice post and pleasant urging commented at this place, I am in fact enjoying by these. Mandie Phip Comyns

  6. izle dice:

    I truly appreciate this post. Really looking forward to read more. Really Great. Auria Barnebas Greabe

  7. dizi dice:

    Thank you ever so for you blog post. Really thank you! Really Cool. Drucill Marshall Stralka

  8. 720p dice:

    When I initially commented I seem to have clicked on the -Notify me when new comments are added- checkbox and from now on each time a comment is added I get 4 emails with the exact same comment. Is there an easy method you are able to remove me from that service? Many thanks! Justinn Knox Culosio

  9. movies dice:

    Antalya escort bayan ve antalya bayan escort sitesi Emmie Bernarr Enyedy

  10. direk dice:

    I have to express my affection for your generosity for those who should have assistance with the topic. Your personal dedication to passing the message across became pretty practical and have constantly helped guys just like me to attain their ambitions. The interesting guide signifies a great deal a person like me and even more to my office workers. Warm regards; from all of us. Edi Boris Lapointe

  11. turkce dice:

    Thanks for sharing your info. I really appreciate your efforts and I am waiting for your next post thanks once again. Ursulina Raphael Temple

  12. dizi dice:

    Our fully insured and carefully trained employees install your display. Idalia Roddy Kayne

  13. bluray dice:

    After I originally left a comment I seem to have clicked on the -Notify me when new comments are added- checkbox and from now on every time a comment is added I get four emails with the exact same comment. Is there an easy method you can remove me from that service? Thanks a lot! Margarete Philbert Libb

  14. turkce dice:

    I think this is one of the most important info for me. And i am glad reading your article. But want to remark on some general things, The site style is wonderful, the articles is really great : D. Good job, cheers Karita Leigh Perdita

  15. turkce dice:

    The divisiveness only comes from the media. Real question.. who controls most influencing media?? Laverne Lanny Bergstrom

  16. turkce dice:

    Lovely just what I was looking for. Thanks to the author for taking his time on this one. Revkah Stearne Donaugh

  17. turkce dice:

    If some one needs expert view regarding running a blog then i propose him/her to go to see this blog, Keep up the fastidious work. Joella Parry Sewell

  18. turkce dice:

    I like it when people come together and share thoughts. Great website, stick with it. Lida Sarge Kilar

  19. turkce dice:

    Tempora quidem aliquid praesentium veritatis alias consequuntur. Neque et enim eum ut perspiciatis. Enim officia ea qui. At consequuntur natus consequuntur ipsum. Ophelia Zolly Flinn

  20. turkce dice:

    There is much more to a hoop than seems firsthand. Valaria Ruprecht Selma

  21. turkce dice:

    To link your Facebook and Twitter accounts, open the Instagram app on your phone or tablet, and select the Profile tab in the bottom-right corner of the screen. Gizela Sky Bevash

  22. turkce dice:

    Hello! I just wish to give you a huge thumbs up for the great information you have got right here on this post. I am returning to your website for more soon. Annora Carver Frum

  23. turkce dice:

    Agreed. I have been working with WordPress since 2008 and never found a more suitable theme like this one. Lexine Stanton Ricki

  24. turkce dice:

    zvyO7R Some truly choice posts on this site, saved to my bookmarks. Lari Chariot Gillian

  25. turkce dice:

    You can certainly see your enthusiasm within the work you write. The sector hopes for even more passionate writers like you who aren at afraid to say how they believe. All the time follow your heart. Shanna Nat Weitzman

  26. turkce dice:

    I truly wanted to write a brief note so as to say thanks to you for the stunning secrets you are sharing here. My extensive internet investigation has at the end of the day been paid with pleasant suggestions to share with my friends and family. I would repeat that we readers actually are unequivocally blessed to live in a very good network with many brilliant individuals with very helpful techniques. I feel somewhat grateful to have encountered your entire webpages and look forward to some more pleasurable minutes reading here. Thank you once more for everything. Emilia Keenan Caputo

  27. turkce dice:

    Heya i am for the primary time here. I found this board and I to find It really helpful & it helped me out much. I am hoping to give one thing back and help others such as you helped me. Merle Ellsworth Buchheim

  28. turkce dice:

    You ought to take part in a contest for one of the greatest websites on the net. I am going to highly recommend this website! Valry Harrison Dopp

  29. turkce dice:

    This is a good point. A creedless faith, an open-ended faith seems almost like the inevitable quality of honesty. So the lie or dishonesty enters in trying to limit the whole conclusively, very nice. Also, much obliged for the references in this and the last one. Daniella Uri Howarth

  30. turkce dice:

    I like looking through an article that will make men and women think. Also, thanks for permitting me to comment! Fulvia Hardy Scevor

  31. WOW just what I was looking for. Came here by searching for website Josephina Marten Coreen

  32. Et doloribus omnis praesentium qui sit ut. Deserunt tempora sint rerum mollitia. Incidunt quasi iusto earum saepe. Numquam sit a et omnis beatae qui. Explicabo suscipit magnam sunt beatae reprehenderit molestiae harum. Yoko Stillman Juan

  33. erotik dice:

    I know this web page presents quality based articles and other information, is there any other web site which offers these kinds of stuff in quality? Roxie Rob Orten

  34. By coming and going a bird weaves its nest. Ashanti Ghana

  35. Today, with all the fast life style that everyone is having, credit cards have a big demand throughout the economy. Persons coming from every discipline are using credit card and people who aren’t using the credit cards have made arrangements to apply for one in particular. Thanks for expressing your ideas about credit cards. https://varicoseveinsmedi.com best medicine for varicose veins

  36. zortilo nrel dice:

    Very efficiently written story. It will be helpful to everyone who usess it, including me. Keep doing what you are doing – i will definitely read more posts.

  37. The rich are always complaining. Zululand

  38. I know this website gives quality dependent posts
    and extra stuff, is there any other website which presents these things in quality?
    asmr 0mniartist

  39. The road seemed to stretch on endlessly before us, but Alexis assured me that our journey was near an end. We’d turn before long into thick woods and travel through narrow, winding roads until we reached her family’s cabin. I had no choice but to trust her as GPS had given out nearly 20 minutes ago.

    “There’s good wifi and okay reception at the cabin,” she’d told me, “but you can’t get there unless you know the way.”
    https://cynthycalvelo352.jimdofree.com/
    So here I was, driving alone in the middle of god knows where with a girl who was my student just a couple of weeks ago. Her and her four best friends had been together from first grade all the way through high school and now they had graduated with very different futures ahead of them. They had decided to kick off “the best summer ever” with a week long stay at Alexis’s family cabin. Alexis and I were heading up before everyone else, the four other girls and four guys.

  40. 0mniartist dice:

    I read this article completely regarding the comparison of newest and earlier technologies, it’s
    remarkable article. asmr 0mniartist

  41. Undeniably imagine that which you said. Your
    favorite reason seemed to be at the web the easiest thing to be mindful of.
    I say to you, I definitely get irked whilst other folks think
    about issues that they plainly don’t realize about. You controlled to hit the nail upon the highest
    and defined out the whole thing with no need side-effects ,
    folks can take a signal. Will likely be again to get more.
    Thank you 0mniartist asmr

  42. bitly.com dice:

    I’m really enjoying the theme/design of your web site.
    Do you ever run into any browser compatibility issues? A small number of my blog audience have complained about
    my site not working correctly in Explorer but looks
    great in Chrome. Do you have any advice to help fix this problem?
    asmr 0mniartist

  43. bitly.com dice:

    Hi there! This is my first visit to your blog!
    We are a team of volunteers and starting a
    new project in a community in the same niche. Your blog provided us useful information to work
    on. You have done a wonderful job! asmr 0mniartist

  44. The road seemed to stretch on endlessly before us, but Alexis assured me that our journey was near an end. We’d turn before long into thick woods and travel through narrow, winding roads until we reached her family’s cabin. I had no choice but to trust her as GPS had given out nearly 20 minutes ago.

    “There’s good wifi and okay reception at the cabin,” she’d told me, “but you can’t get there unless you know the way.”
    https://medium.com/@gaylordzzsz80/ex-marks-the-spot-8d7ca39dd585
    So here I was, driving alone in the middle of god knows where with a girl who was my student just a couple of weeks ago. Her and her four best friends had been together from first grade all the way through high school and now they had graduated with very different futures ahead of them. They had decided to kick off “the best summer ever” with a week long stay at Alexis’s family cabin. Alexis and I were heading up before everyone else, the four other girls and four guys.

  45. It’s difficult to find experienced people in this
    particular subject, however, you seem like you know what you’re talking about!
    Thanks

  46. Have you ever considered about including a little bit more than just your articles?
    I mean, what you say is fundamental and everything.
    But think of if you added some great images or video clips to give your posts more, «pop»!
    Your content is excellent but with images and videos, this blog could definitely be one
    of the most beneficial in its niche. Very good blog!

  47. Hey There. I found your weblog the usage of msn. This is an extremely smartly written article.
    I’ll be sure to bookmark it and come back to learn more
    of your useful info. Thank you for the post. I’ll certainly return.

  48. I am not sure where you’re getting your information,
    but great topic. I needs to spend some time learning more or understanding more.
    Thanks for magnificent information I was looking for this info
    for my mission.

  49. Instagram da en kaliteli ve Ucuz Takipçi Satın Al seçeneğinin en hızlı adresinden ucuz takipçi satın al!

  50. Instagram’da bir hesabın takipçi sayısı, o hesabın prestiji
    açısından çok önemlidir. Bundan dolayı, hesabını büyütmek isteyenler, öncelikle
    takipçi satın almaktadır. Fazla takipçi sayısı olan hesaplar, daha fazla
    dikkat çeker ve daha fazla kişiye ulaşırlar. Firma, müşterilerin farklı taleplerine cevap verebilmek adına farklı takipçi paketleriyle hizmet vermektedir.
    kaliteli takipçi satın al kelimesinde
    en iyi web sitesi!

    .

  51. Leke Kremi dice:

    Türkiyenin en iyi leke kremi ile cilt lekelerinize son verin.

  52. bess dice:

    A hungry stomach has no ears.

  53. Instagram’da bir hesabın takipçi sayısı, o
    hesabın prestiji açısından çok önemlidir.

    İnstagram kullanıcılarının sayısı her geçen gün artıyor.
    İnstagram da fenomen olmak isteyen kişiler ise bir birleri ile yarışıyor
    https://rebrand.ly/instagram-takipci-satin-al- Takipcisatinalin.org ile
    hemen instagram takipçi satın al.

  54. En yeni web sitelerinden olan clubhouse takipçi satın alma
    işlemleri için hemen web sitemize giderek satın alımınızı gerçekleştirebilirsiniz.

    https://rebrand.ly/clubhousetakipcisatinal

  55. The road seemed to stretch on endlessly before us, but Alexis assured me that our journey was near an end. We’d turn before long into thick woods and travel through narrow, winding roads until we reached her family’s cabin. I had no choice but to trust her as GPS had given out nearly 20 minutes ago.

    “There’s good wifi and okay reception at the cabin,” she’d told me, “but you can’t get there unless you know the way.”
    https://notepin.co/shared/aurphxb
    So here I was, driving alone in the middle of god knows where with a girl who was my student just a couple of weeks ago. Her and her four best friends had been together from first grade all the way through high school and now they had graduated with very different futures ahead of them. They had decided to kick off “the best summer ever” with a week long stay at Alexis’s family cabin. Alexis and I were heading up before everyone else, the four other girls and four guys.

  56. Hi there, all the time i used to check webpage posts
    here early in the daylight, for the reason that i enjoy to gain knowledge of more
    and more.

  57. Its like you read my mind! You seem to know so much about this,
    like you wrote the book in it or something. I think that
    you could do with a few pics to drive the message home a bit, but instead
    of that, this is excellent blog. A fantastic read.
    I’ll certainly be back.

  58. The road seemed to stretch on endlessly before us, but Alexis assured me that our journey was near an end. We’d turn before long into thick woods and travel through narrow, winding roads until we reached her family’s cabin. I had no choice but to trust her as GPS had given out nearly 20 minutes ago.

    “There’s good wifi and okay reception at the cabin,” she’d told me, “but you can’t get there unless you know the way.”
    https://telegra.ph/ll-Stonemere-Park-Ch-02-01-18
    So here I was, driving alone in the middle of god knows where with a girl who was my student just a couple of weeks ago. Her and her four best friends had been together from first grade all the way through high school and now they had graduated with very different futures ahead of them. They had decided to kick off “the best summer ever” with a week long stay at Alexis’s family cabin. Alexis and I were heading up before everyone else, the four other girls and four guys.

  59. your gamefly dice:

    What a material of un-ambiguity and preserveness of
    precious know-how regarding unpredicted feelings.

  60. asmr that dice:

    Asking questions are truly pleasant thing if you are not understanding something fully, however this article provides
    pleasant understanding yet.

  61. of asmr dice:

    It’s appropriate time to make some plans for the long run and
    it’s time to be happy. I have learn this submit and if I may I want to counsel you some attention-grabbing issues or
    advice. Perhaps you could write subsequent articles regarding
    this article. I want to read even more things about it!

  62. gamefly this dice:

    It’s amazing to visit this website and reading the views of all friends about this
    paragraph, while I am also zealous of getting knowledge.

  63. These are in fact great ideas in concerning blogging. You have touched some good points here.
    Any way keep up wrinting.

  64. in asmr dice:

    This post offers clear idea in favor of the new users of blogging, that in fact how to do running a blog.

Deja una respuesta

Tu dirección de correo electrónico no será publicada. Los campos obligatorios están marcados con *