{"id":97639,"date":"2020-10-20T02:42:56","date_gmt":"2020-10-20T00:42:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/vsyo-chto-vy-hoteli-znat-o-bezopasnom-sbrose-parolej-chast-2"},"modified":"2020-10-20T02:42:56","modified_gmt":"2020-10-20T00:42:56","slug":"vsyo-chto-vy-hoteli-znat-o-bezopasnom-sbrose-parolej-chast-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vsyo-chto-vy-hoteli-znat-o-bezopasnom-sbrose-parolej-chast-2","title":{"rendered":"V\u0161e, co jste cht\u011bli v\u011bd\u011bt o bezpe\u010dn\u00e9m resetov\u00e1n\u00ed hesel. \u010c\u00e1st 2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dvouf\u00e1zov\u00e9 ov\u011b\u0159ov\u00e1n\u00ed<\/h2>\n

\nV\u0161e, co jste si p\u0159e\u010detli o prvn\u00ed \u010d\u00e1sti<\/a><\/noindex> se t\u00fdkalo identifikace na z\u00e1klad\u011b toho, co zn\u00e1 po\u017eaduj\u00edc\u00ed<\/em><\/strong>. Zn\u00e1 svou e-mailovou adresu, v\u00ed, jak z\u00edskat k n\u00ed p\u0159\u00edstup (tj. zn\u00e1 sv\u00e9 heslo k e-mailu) a zn\u00e1 odpov\u011bdi na bezpe\u010dnostn\u00ed ot\u00e1zky. <\/p>\n

\"Znalost\" se pova\u017euje za jeden faktor ov\u011b\u0159ov\u00e1n\u00ed; dva dal\u0161\u00ed b\u011b\u017en\u00e9 faktory jsou to, co m\u00e1te<\/em><\/strong>, nap\u0159\u00edklad fyzick\u00e9 za\u0159\u00edzen\u00ed, a to, k\u00fdm jste<\/em><\/strong>, nap\u0159\u00edklad otisky prst\u016f nebo duhovky.<\/p>\n

\"V\u0161e,
\n<\/a><\/noindex>
\nVe v\u011bt\u0161in\u011b p\u0159\u00edpad\u016f proveden\u00ed biometrick\u00e9 identifikace nen\u00ed prakticky realizovateln\u00e9, zejm\u00e9na kdy\u017e mluv\u00edme o zabezpe\u010den\u00ed webov\u00fdch aplikac\u00ed, proto se p\u0159i dvouf\u00e1zov\u00e9m ov\u011b\u0159ov\u00e1n\u00ed (two factor authentication, 2FA) obvykle pou\u017e\u00edv\u00e1 druh\u00fd atribut \u2014 \"to, co m\u00e1te\". Jednou z popul\u00e1rn\u00edch variant tohoto druh\u00e9ho faktoru je fyzick\u00fd token, nap\u0159\u00edklad RSA SecurID<\/a><\/noindex>:<\/p>\n

\"V\u0161e,
\nFyzick\u00fd token se \u010dasto pou\u017e\u00edv\u00e1 k autentizaci v podnikov\u00fdch VPN a finan\u010dn\u00edch slu\u017eb\u00e1ch. Pro autentizaci v slu\u017eb\u011b je t\u0159eba pou\u017e\u00edt jak heslo, tak k\u00f3d na tokenu (kter\u00fd se \u010dasto m\u011bn\u00ed) v kombinaci s PIN. Teoreticky, pro identifikaci \u00fato\u010dn\u00edka mus\u00ed zn\u00e1t heslo, m\u00edt token a tak\u00e9 zn\u00e1t PIN tokenu. V sc\u00e9n\u00e1\u0159i resetov\u00e1n\u00ed hesla je samoz\u0159ejm\u011b heslo nezn\u00e1m\u00e9, nicm\u00e9n\u011b m\u00edt token lze pou\u017e\u00edt k potvrzen\u00ed vlastnictv\u00ed \u00fa\u010dtu. Jak je samoz\u0159ejm\u00e9, jako u v\u0161ech realizac\u00ed zabezpe\u010den\u00ed, to nenab\u00edz\u00ed \"ochranu p\u0159ed hlup\u00e1ky\"<\/a><\/noindex>, ale ur\u010dit\u011b zvy\u0161uje bari\u00e9ru vstupu.<\/p>\n

Jedn\u00edm z hlavn\u00edch probl\u00e9m\u016f tohoto p\u0159\u00edstupu jsou n\u00e1klady a logistika implementace; hovo\u0159\u00edme o distribuci fyzick\u00fdch za\u0159\u00edzen\u00ed ka\u017ed\u00e9mu klientovi a o \u0161kolen\u00ed v nov\u00e9m procesu. Krom\u011b toho mus\u00ed m\u00edt u\u017eivatel\u00e9 za\u0159\u00edzen\u00ed u sebe, co\u017e v p\u0159\u00edpad\u011b fyzick\u00e9ho tokenu nen\u00ed v\u017edy mo\u017en\u00e9. Dal\u0161\u00ed mo\u017enost\u00ed je zav\u00e9st druh\u00fd faktor ov\u011b\u0159ov\u00e1n\u00ed prost\u0159ednictv\u00edm SMS, kter\u00e9 v p\u0159\u00edpad\u011b 2FA m\u016f\u017ee slou\u017eit jako potvrzen\u00ed, \u017ee osoba prov\u00e1d\u011bj\u00edc\u00ed proces resetov\u00e1n\u00ed m\u00e1 mobiln\u00ed telefon vlastn\u00edka \u00fa\u010dtu. Takto to d\u011bl\u00e1 Google:<\/p>\n

\"V\u0161e,
\nTak\u00e9 je nutn\u00e9 zahrnout dvoustup\u0148ovou verifikaci<\/a><\/noindex>, ale to znamen\u00e1, \u017ee p\u0159i dal\u0161\u00edm resetov\u00e1n\u00ed hesla m\u016f\u017ee v\u00e1\u0161 mobiln\u00ed telefon slou\u017eit jako druh\u00fd faktor ov\u011b\u0159ov\u00e1n\u00ed. Dovolte mi to d\u00e9monstrovat na p\u0159\u00edkladu sv\u00e9ho iPhonu z d\u016fvod\u016f, kter\u00e9 se brzy stanou jasn\u00fdmi:<\/p>\n

\"V\u0161e,
\nPo identifikaci e-mailov\u00e9 adresy \u00fa\u010dtu Google zjist\u00ed, \u017ee byla zapnuta 2FA, a my m\u016f\u017eeme resetovat \u00fa\u010det pomoc\u00ed ov\u011b\u0159en\u00ed, kter\u00e9 je zasl\u00e1no prost\u0159ednictv\u00edm SMS na mobiln\u00ed telefon majitele \u00fa\u010dtu:<\/p>\n

\"V\u0161e,
\nNyn\u00ed pot\u0159ebujeme vybrat za\u010d\u00e1tek procesu resetov\u00e1n\u00ed:<\/p>\n

\"V\u0161e,
\nTato akce vede k odesl\u00e1n\u00ed e-mailu na registrovanou adresu:<\/p>\n

\"V\u0161e,
\nTento e-mail obsahuje URL pro resetov\u00e1n\u00ed:<\/p>\n

\"V\u0161e,
\nP\u0159i p\u0159\u00edstupu k URL pro resetov\u00e1n\u00ed se ode\u0161le SMS a webov\u00e1 str\u00e1nka \u017e\u00e1d\u00e1 o jej\u00ed zad\u00e1n\u00ed:<\/p>\n

\"V\u0161e,
\nToto je SMS:<\/p>\n

\"V\u0161e,
\nPo jej\u00edm zad\u00e1n\u00ed do prohl\u00ed\u017ee\u010de se vr\u00e1t\u00edme na \u00fazem\u00ed klasick\u00e9ho resetov\u00e1n\u00ed hesla:<\/p>\n

\"V\u0161e,
\nPravd\u011bpodobn\u011b to vypad\u00e1 trochu ob\u0161\u00edrn\u011b, a tak\u00e9 to je, ale formul\u00e1\u0159 potvrzuje, \u017ee osoba prov\u00e1d\u011bj\u00edc\u00ed reset m\u00e1 p\u0159\u00edstup k e-mailov\u00e9 adrese a mobiln\u00edmu telefonu majitele \u00fa\u010dtu. To v\u0161ak m\u016f\u017ee b\u00fdt a\u017e dev\u011btkr\u00e1t bezpe\u010dn\u011bj\u0161\u00ed ne\u017e reset hesla pouze prost\u0159ednictv\u00edm e-mailu. Existuj\u00ed v\u0161ak probl\u00e9my\u2026<\/p>\n

Probl\u00e9m je ve smartphonech. N\u00ed\u017ee uveden\u00e9 za\u0159\u00edzen\u00ed m\u016f\u017ee ov\u011b\u0159it pouze jeden faktor ov\u011b\u0159ov\u00e1n\u00ed \u2014 dok\u00e1\u017ee p\u0159ij\u00edmat SMS, ale ne e-maily:<\/p>\n

\"V\u0161e,
\nToto za\u0159\u00edzen\u00ed v\u0161ak m\u016f\u017ee p\u0159ij\u00edmat SMS a<\/em> p\u0159ij\u00edmat e-maily o resetov\u00e1n\u00ed hesla:<\/p>\n

\"V\u0161e,
\nProbl\u00e9m spo\u010d\u00edv\u00e1 v tom, \u017ee pova\u017eujeme e-mail za prvn\u00ed faktor ov\u011b\u0159ov\u00e1n\u00ed a SMS (nebo dokonce aplikaci generuj\u00edc\u00ed tokeny) za druh\u00fd, ale dnes jsou tyto prvky slou\u010deny v jednom za\u0159\u00edzen\u00ed. To samoz\u0159ejm\u011b znamen\u00e1, \u017ee pokud se n\u011bkdo dostane k va\u0161emu smartphonu, ve\u0161ker\u00e9 toto pohodl\u00ed se vr\u00e1t\u00ed zp\u011bt k jednomu kan\u00e1lu; tento druh\u00fd faktor \u201eto, co m\u00e1te\u201c znamen\u00e1, \u017ee m\u00e1te tak\u00e9 prvn\u00ed faktor. A to v\u0161e je chr\u00e1n\u011bno jedn\u00edm \u010dty\u0159m\u00edstn\u00fdm PINem\u2026 pokud m\u00e1 telefon v\u016fbec n\u011bjak\u00fd PIN. a<\/em> byl zablokov\u00e1n.<\/p>\n

Ano, implementovan\u00e1 funkce 2FA od Google rozhodn\u011b poskytuje dal\u0161\u00ed ochranu, ale nen\u00ed chr\u00e1n\u011bna \u201ep\u0159ed hlup\u00e1ky\u201c a rozhodn\u011b nez\u00e1vis\u00ed na dvou zcela autonomn\u00edch kan\u00e1lech.<\/p>\n

Resetov\u00e1n\u00ed podle u\u017eivatelsk\u00e9ho jm\u00e9na vs. resetov\u00e1n\u00ed podle e-mailov\u00e9 adresy<\/h2>\n

\nJe nutn\u00e9 povolit reset pouze podle e-mailov\u00e9 adresy? Nebo by m\u011bl m\u00edt u\u017eivatel mo\u017enost resetovat tak\u00e9 podle jm\u00e9na? Probl\u00e9m s resetem pomoc\u00ed u\u017eivatelsk\u00e9ho jm\u00e9na spo\u010d\u00edv\u00e1 v tom, \u017ee nen\u00ed \u017e\u00e1dn\u00fd zp\u016fsob, jak upozornit u\u017eivatele na chybn\u00fd u\u017eivatelsk\u00fd n\u00e1zev, ani\u017e bychom odhalili<\/em> to, \u017ee n\u011bkdo jin\u00fd m\u016f\u017ee m\u00edt \u00fa\u010det s t\u00edmto jm\u00e9nem. V p\u0159edchoz\u00ed \u010d\u00e1sti poskytoval reset podle e-mailu z\u00e1ruku, \u017ee skute\u010dn\u00fd majitel t\u00e9to e-mailov\u00e9 adresy v\u017edy obdr\u017e\u00ed zp\u011btnou vazbu bez ve\u0159ejn\u00e9ho odhalen\u00ed sv\u00e9 existence v syst\u00e9mu. To je s\u00e1m o sob\u011b u\u017eivatelsk\u00fdm jm\u00e9nem nemo\u017en\u00e9.<\/p>\n

Proto je odpov\u011b\u010f stru\u010dn\u00e1: pouze e-mailem. Pokud se pokus\u00edte prov\u00e9st reset pouze s pomoc\u00ed u\u017eivatelsk\u00e9ho jm\u00e9na, dojde k situac\u00edm, kdy si u\u017eivatel nebude jist\u00fd, co se d\u011bje, nebo<\/em> a odhal\u00edte existenci \u00fa\u010dt\u016f. Ano, je to pouze u\u017eivatelsk\u00e9 jm\u00e9no, nikoli e-mailov\u00e1 adresa, a ano, kdokoli si m\u016f\u017ee zvolit jak\u00e9koli (dostupn\u00e9) u\u017eivatelsk\u00e9 jm\u00e9no, ale p\u0159esto existuje vysok\u00e1 pravd\u011bpodobnost, \u017ee nep\u0159\u00edmo odhal\u00edte vlastn\u00edky \u00fa\u010dt\u016f kv\u016fli tendenci u\u017eivatel\u016f opakovan\u011b pou\u017e\u00edvat stejn\u00e1 jm\u00e9na.<\/p>\n

Co se tedy stane, kdy\u017e n\u011bkdo zapomene sv\u00e9 u\u017eivatelsk\u00e9 jm\u00e9no? Pokud vezmeme v \u00favahu, \u017ee u\u017eivatelsk\u00e9 jm\u00e9no nen\u00ed hned e-mailovou adresou (co\u017e se \u010dasto st\u00e1v\u00e1), pak je proces podobn\u00fd tomu, jak za\u010d\u00edn\u00e1 reset hesla \u2014 zad\u00e1me e-mailovou adresu a pak odes\u00edl\u00e1me zpr\u00e1vu na tuto adresu, ani\u017e bychom odhalovali jej\u00ed existenci. Jedin\u00fd rozd\u00edl je v tom, \u017ee tentokr\u00e1t zpr\u00e1va obsahuje pouze u\u017eivatelsk\u00e9 jm\u00e9no, nikoli URL pro reset hesla. Bu\u010f to, nebo bude v e-mailu uvedeno, \u017ee pro tuto adresu neexistuje \u00fa\u010det.<\/p>\n

Ov\u011b\u0159en\u00ed identity a p\u0159esnost e-mailov\u00fdch adres<\/h2>\n

\nKl\u00ed\u010dov\u00fdm aspektem resetov\u00e1n\u00ed hesel, a mo\u017en\u00e1 i nejd\u016fle\u017eit\u011bj\u0161\u00edm<\/em> aspektem je ov\u011b\u0159en\u00ed identity osoby, kter\u00e1 se sna\u017e\u00ed prov\u00e9st reset. Opr\u00e1vn\u011bn\u00fd majitel \u00fa\u010dtu, nebo n\u011bkdo, kdo se ho sna\u017e\u00ed hacknout nebo zp\u016fsobit mu nep\u0159\u00edjemnosti?<\/p>\n

Je z\u0159ejm\u00e9, \u017ee e-mail je nejpohodln\u011bj\u0161\u00edm a nejroz\u0161\u00ed\u0159en\u011bj\u0161\u00edm kan\u00e1lem pro ov\u011b\u0159ov\u00e1n\u00ed identity. Nen\u00ed chr\u00e1n\u011bn p\u0159ed nezku\u0161en\u00fdm pou\u017e\u00edv\u00e1n\u00edm (\"od blbce\"), a existuje mnoho p\u0159\u00edpad\u016f, kdy prost\u011b mo\u017enost p\u0159ij\u00edmat e-maily na adresu majitele \u00fa\u010dtu nesta\u010d\u00ed, pokud je zapot\u0159eb\u00ed vysok\u00e9 m\u00edry jistoty v identifikaci (proto se tak\u00e9 pou\u017e\u00edv\u00e1 2FA), ale t\u00e9m\u011b\u0159 v\u017edy je to v\u00fdchoz\u00ed bod procesu resetov\u00e1n\u00ed.<\/p>\n

Pokud bude e-mail hr\u00e1t roli v zaji\u0161t\u011bn\u00ed d\u016fv\u011bry, je t\u0159eba se nejprve ujistit, \u017ee e-mailov\u00e1 adresa je skute\u010dn\u011b spr\u00e1vn\u00e1. Pokud ud\u011blal n\u011bkdo chybu v symbolu, evidentn\u011b resetov\u00e1n\u00ed neza\u010dne. Proces ov\u011b\u0159en\u00ed e-mailu p\u0159i registraci je spolehliv\u00fd zp\u016fsob, jak potvrdit spr\u00e1vnost adresy. V\u0161ichni jsme to za\u017eili: registrujete se, dost\u00e1v\u00e1te e-mail s jedine\u010dnou URL, na kterou mus\u00edte kliknout, \u010d\u00edm\u017e potvrzujete, \u017ee jste skute\u010dn\u011b vlastn\u00edkem t\u00e9to e-mailov\u00e9 adresy. Neschopnost p\u0159ihl\u00e1sit se do syst\u00e9mu p\u0159ed dokon\u010den\u00edm tohoto procesu zaji\u0161\u0165uje motivaci k potvrzen\u00ed adresy.<\/p>\n

Stejn\u011b jako u mnoha jin\u00fdch aspekt\u016f bezpe\u010dnosti, tento model sni\u017euje pou\u017eitelnost v\u00fdm\u011bnou za zaji\u0161t\u011bn\u00ed vy\u0161\u0161\u00ed m\u00edry bezpe\u010dnosti ohledn\u011b d\u016fv\u011bry v identitu u\u017eivatele. To m\u016f\u017ee b\u00fdt p\u0159ijateln\u00e9 pro web, jeho\u017e registraci si u\u017eivatel vysoce cen\u00ed a r\u00e1d p\u0159id\u00e1 je\u0161t\u011b jeden krok do procesu (placen\u00e9 slu\u017eby, bankovnictv\u00ed atd.), ale takov\u00e9 v\u011bci mohou u\u017eivatele odradit, pokud vn\u00edm\u00e1 \u00fa\u010det jako \"jednor\u00e1zov\u00fd\" a pou\u017e\u00edv\u00e1 ho nap\u0159\u00edklad pouze jako prost\u0159edek ke komentov\u00e1n\u00ed p\u0159\u00edsp\u011bvk\u016f.<\/p>\n

Identifikace osoby, kter\u00e1 iniciovala proces resetov\u00e1n\u00ed<\/h2>\n

\nJe z\u0159ejm\u00e9, \u017ee existuj\u00ed d\u016fvody pro zneu\u017eit\u00ed funkce resetov\u00e1n\u00ed, a \u00fato\u010dn\u00edci ji mohou vyu\u017e\u00edt mnoha r\u016fzn\u00fdmi zp\u016fsoby. Jeden jednoduch\u00fd trik, kter\u00fd m\u016f\u017eeme pou\u017e\u00edt na podporu potvrzen\u00ed zdroje \u017e\u00e1dosti (tento trik obvykle<\/em> funguje) \u2014 je p\u0159id\u00e1n\u00ed IP adresy \u017e\u00e1daj\u00edc\u00edho do e-mailu s nab\u00eddkou resetov\u00e1n\u00ed. To poskytne p\u0159\u00edjemci n\u011bkter\u00e9<\/em> informace k identifikaci zdroje \u017e\u00e1dosti.<\/p>\n

Zde je p\u0159\u00edklad z funkce resetov\u00e1n\u00ed, kterou pr\u00e1v\u011b vkl\u00e1d\u00e1m do ASafaWeb:<\/p>\n

\"V\u0161e,
\nOdkaz \u201efind out more\u201c (\u201eZjistit v\u00edce\u201c) p\u0159en\u00e1\u0161\u00ed u\u017eivatele na webovou str\u00e1nku ip-adress.com<\/a><\/noindex>, kter\u00fd poskytuje informace, jako je um\u00edst\u011bn\u00ed a organizace \u017eadatele o reset:<\/p>\n

\"V\u0161e,
\nSamoz\u0159ejm\u011b, \u017ee ka\u017ed\u00fd, kdo chce skr\u00fdt svoji identitu, m\u00e1 spoustu zp\u016fsob\u016f, jak zakr\u00fdt svou skute\u010dnou IP adresu, nicm\u00e9n\u011b je to pohodln\u00fd zp\u016fsob, jak p\u0159idat \u010d\u00e1ste\u010dnou identifikaci \u017eadatele, a ve v\u011bt\u0161in\u011b<\/em> p\u0159\u00edpad\u016f to poskytne dostate\u010dn\u00fd p\u0159ehled o tom, kdo provedl \u017e\u00e1dost o resetov\u00e1n\u00ed hesla.<\/p>\n

Ozn\u00e1men\u00ed o zm\u011bn\u00e1ch na e-mail<\/h2>\n

\nTento p\u0159\u00edsp\u011bvek je prostoupen jedn\u00edm t\u00e9matem \u2014 komunikac\u00ed; informujte vlastn\u00edka \u00fa\u010dtu co nejv\u00edce o tom, co se d\u011bje v ka\u017ed\u00e9m kroku procesu, ani\u017e byste odhalili cokoli, co by mohlo b\u00fdt zneu\u017eito. To sam\u00e9 plat\u00ed i pro situaci, kdy do\u0161lo ke zm\u011bn\u011b hesla \u2014 informujte o tom vlastn\u00edka!<\/em><\/strong><\/p>\n

D\u016fvody pro zm\u011bnu hesla mohou b\u00fdt dva zdroje:<\/p>\n

    \n
  1. Zm\u011bna hesla po p\u0159ihl\u00e1\u0161en\u00ed, proto\u017ee u\u017eivatel chce nov\u00e9 heslo<\/li>\n
  2. Resetov\u00e1n\u00ed hesla bez p\u0159ihl\u00e1\u0161en\u00ed, proto\u017ee u\u017eivatel zapomn\u011bl<\/li>\n<\/ol>\n

    \nA\u010dkoliv se tento p\u0159\u00edsp\u011bvek p\u0159ev\u00e1\u017en\u011b zam\u011b\u0159uje na resetov\u00e1n\u00ed, ozn\u00e1men\u00ed v prvn\u00edm p\u0159\u00edpad\u011b sni\u017euje riziko, \u017ee n\u011bkdo zm\u011bn\u00ed heslo bez v\u011bdom\u00ed opr\u00e1vn\u011bn\u00e9ho vlastn\u00edka. Jak se to m\u016f\u017ee st\u00e1t? Velmi b\u011b\u017en\u00fdm sc\u00e9n\u00e1\u0159em je z\u00edsk\u00e1n\u00ed hesla opr\u00e1vn\u011bn\u00e9ho vlastn\u00edka (op\u011btovn\u011b pou\u017eit\u00e9 heslo, unikl\u00e9 z jin\u00e9ho zdroje; heslo z\u00edskan\u00e9 keyloggingem; snadno uhodnut\u00e9 heslo atd.), po \u010dem\u017e \u00fato\u010dn\u00edk rozhodne ho zm\u011bnit, a t\u00edm zablokuje majitele. Bez e-mailov\u00e9ho ozn\u00e1men\u00ed by skute\u010dn\u00fd vlastn\u00edk o zm\u011bn\u011b hesla nev\u011bd\u011bl.<\/p>\n

    Samoz\u0159ejm\u011b, v p\u0159\u00edpad\u011b resetov\u00e1n\u00ed hesla by si vlastn\u00edk m\u011bl proces ji\u017e iniciovat s\u00e1m (nebo obch\u00e1zet v\u00fd\u0161e uveden\u00e9 metody ov\u011b\u0159en\u00ed identity), tak\u017ee zm\u011bna by nem\u011bla<\/em> b\u00fdt pro n\u011bj p\u0159ekvapen\u00edm, nicm\u00e9n\u011b potvrzen\u00ed e-mailem bude pozitivn\u00ed zp\u011btn\u00e1 vazba a dodate\u010dn\u00e9 ov\u011b\u0159en\u00ed. Krom\u011b toho to zaji\u0161\u0165uje jednotnost s v\u00fd\u0161e uveden\u00fdm sc\u00e9n\u00e1\u0159em.<\/p>\n

    A, pro p\u0159\u00edpad, \u017ee by to je\u0161t\u011b nebylo jasn\u00e9 \u2014 neodes\u00edlejte nov\u00e9 heslo e-mailem!<\/em><\/strong> N\u011bkoho to m\u016f\u017ee rozesm\u00e1t, ale k tomu doch\u00e1z\u00ed<\/a><\/noindex>:<\/p>\n

    \"V\u0161e,<\/p>\n

    Logy, logy, logy a je\u0161t\u011b v\u00edce log\u016f<\/h2>\n

    \nFunkce resetov\u00e1n\u00ed hesla je l\u00e1kav\u00e1 pro \u00fato\u010dn\u00edky: \u00fato\u010dn\u00edk se sna\u017e\u00ed z\u00edskat p\u0159\u00edstup k \u00fa\u010dtu jin\u00e9 osoby nebo pouze zp\u016fsobit pot\u00ed\u017ee majiteli \u00fa\u010dtu\/syst\u00e9mu. Mnoh\u00e9 z v\u00fd\u0161e popsan\u00fdch praktik pom\u00e1haj\u00ed sn\u00ed\u017eit pravd\u011bpodobnost zneu\u017eit\u00ed, ale nezabr\u00e1n\u00ed jim, a rozhodn\u011b neochr\u00e1n\u00ed p\u0159ed lidmi, kte\u0159\u00ed se pokus\u00ed vyu\u017e\u00edt funkci nezam\u00fd\u0161len\u00fdm zp\u016fsobem.<\/p>\n

    Pro rozpozn\u00e1n\u00ed zlomyse\u013en\u00e9ho chov\u00e1n\u00ed je naprosto neocenitelnou prax\u00ed logov\u00e1n\u00ed, a m\u00e1m na mysli velmi podrobn\u00e9 logov\u00e1n\u00ed<\/em><\/strong>. Zaznamen\u00e1vejte ne\u00fasp\u011b\u0161n\u00e9 pokusy o p\u0159ihl\u00e1\u0161en\u00ed, resetov\u00e1n\u00ed hesel, zm\u011bny hesel (tj. kdy\u017e je u\u017eivatel ji\u017e p\u0159ihl\u00e1\u0161en) a prakticky v\u0161e, co v\u00e1m m\u016f\u017ee pomoci pochopit, co se d\u011bje; to se v\u00e1m v budoucnosti velmi hod\u00ed. Zaznamen\u00e1vejte v log\u00e1ch i jednotliv\u00e9 \u010d\u00e1sti<\/em> procesu, nap\u0159\u00edklad dobr\u00e1 funkce resetov\u00e1n\u00ed by m\u011bla zahrnovat iniciaci resetov\u00e1n\u00ed p\u0159es webovou str\u00e1nku (zaznamen\u00e1vejte \u017e\u00e1dosti a pokusy o p\u0159ihl\u00e1\u0161en\u00ed pro resetov\u00e1n\u00ed s nespr\u00e1vn\u00fdm u\u017eivatelsk\u00fdm jm\u00e9nem nebo e-mailem), zaznamen\u00e1vejte n\u00e1v\u0161t\u011bvu webov\u00e9 str\u00e1nky pomoc\u00ed URL resetov\u00e1n\u00ed (v\u010detn\u011b pokus\u016f o pou\u017eit\u00ed neplatn\u00e9ho tokenu), a pot\u00e9 zaznamen\u00e1vejte \u00fasp\u011b\u0161nost nebo selh\u00e1n\u00ed odpov\u011bdi na tajnou ot\u00e1zku.<\/p>\n

    Kdy\u017e mluv\u00edm o logov\u00e1n\u00ed, nemysl\u00edm t\u00edm jen zaznamen\u00e1v\u00e1n\u00ed faktu na\u010dten\u00ed str\u00e1nky, ale i sb\u011br co nejv\u00edce informac\u00ed, pokud nejsou d\u016fv\u011brn\u00e9<\/em><\/strong>. Kluci, pros\u00edm, nezaznamen\u00e1vejte hesla do log\u016f!<\/em><\/strong> V log\u00e1ch je t\u0159eba registrovat toto\u017enost opr\u00e1vn\u011bn\u00e9ho u\u017eivatele (bude opr\u00e1vn\u011bn, pokud m\u011bn\u00ed<\/em> existuj\u00edc\u00ed heslo nebo se pokou\u0161\u00ed resetovat ciz\u00ed heslo<\/em> po p\u0159ihl\u00e1\u0161en\u00ed do syst\u00e9mu), jak\u00e1koliv zkou\u0161en\u00e1 u\u017eivatelsk\u00e1 jm\u00e9na \u010di e-mailov\u00e9 adresy, plus jak\u00e9koliv tokeny resetov\u00e1n\u00ed, kter\u00e9 se pokou\u0161\u00ed pou\u017e\u00edt. Ale tak\u00e9 byste m\u011bli zaznamen\u00e1vat aspekty jako IP adresy a pokud to je mo\u017en\u00e9, dokonce i hlavi\u010dky po\u017eadavk\u016f. To v\u00e1m umo\u017en\u00ed rekonstrukci nejen co<\/em> u\u017eivatel (nebo \u00fato\u010dn\u00edk) se sna\u017e\u00ed ud\u011blat, ale tak\u00e9 kdo<\/em> kdo je.<\/p>\n

    Delegov\u00e1n\u00ed odpov\u011bdnosti na jin\u00e9 dodavatele.<\/h2>\n

    \nPokud m\u00e1te pocit, \u017ee to v\u0161echno p\u0159edstavuje obrovsk\u00e9 mno\u017estv\u00ed pr\u00e1ce, nejste sami. Ve skute\u010dnosti je vybudov\u00e1n\u00ed spolehliv\u00e9ho syst\u00e9mu pro spr\u00e1vu \u00fa\u010dt\u016f slo\u017eit\u00fd \u00fakol. Nen\u00ed to jen technicky obt\u00ed\u017en\u00e9, ale obsahuje tak\u00e9 mnoho specifik. Nejde jen o resetov\u00e1n\u00ed, existuje cel\u00fd proces registrace, bezpe\u010dn\u00e9 uchov\u00e1v\u00e1n\u00ed hesel, zpracov\u00e1n\u00ed v\u00edce ne\u00fasp\u011b\u0161n\u00fdch pokus\u016f o p\u0159ihl\u00e1\u0161en\u00ed atd. podporuji my\u0161lenku vyu\u017e\u00edv\u00e1n\u00ed hotov\u00e9 funk\u010dnosti jako je ASP.NET membership provider,<\/a><\/noindex>ale krom\u011b toho je pot\u0159eba ud\u011blat je\u0161t\u011b mnoho.<\/p>\n

    Dnes existuje mnoho extern\u00edch poskytovatel\u016f, kte\u0159\u00ed se ochotn\u011b uj\u00edmaj\u00ed v\u0161ech t\u011bchto starost\u00ed a abstrahuj\u00ed v\u0161e do jedn\u00e9 spravovan\u00e9 slu\u017eby. Mezi takov\u00e9 slu\u017eby pat\u0159\u00ed OpenID, OAuth a dokonce i Facebook. N\u011bkte\u0159\u00ed lid\u00e9 bezmezn\u011b v\u011b\u0159\u00ed tomuto modelu,<\/a><\/noindex> (OpenID se skute\u010dn\u011b osv\u011bd\u010dilo na Stack Overflow), zat\u00edmco jin\u00ed doslova pova\u017euj\u00ed jeho existenci za no\u010dn\u00ed m\u016fru.<\/a><\/noindex>.<\/p>\n

    Nen\u00ed pochyb o tom, \u017ee slu\u017eba jako OpenID \u0159e\u0161\u00ed mnoho probl\u00e9m\u016f v\u00fdvoj\u00e1\u0159\u016f, z\u00e1rove\u0148 v\u0161ak nepochybn\u011b p\u0159id\u00e1v\u00e1 nov\u00e9. Maj\u00ed n\u011bjakou roli? Ano, ale je z\u0159ejm\u00e9, \u017ee neza\u017e\u00edv\u00e1me masov\u00e9 vyu\u017e\u00edv\u00e1n\u00ed slu\u017eeb poskytovatel\u016f autentifikace. Banky, leteck\u00e9 spole\u010dnosti a dokonce i obchody \u2013 v\u0161ichni implementuj\u00ed sv\u00e9 vlastn\u00ed mechanismy autentifikace a je jasn\u00e9, \u017ee pro to existuj\u00ed velmi z\u00e1va\u017en\u00e9 d\u016fvody.<\/p>\n

    Malicious reset<\/h2>\n

    \nD\u016fle\u017eit\u00fdm aspektem ka\u017ed\u00e9ho z v\u00fd\u0161e uveden\u00fdch p\u0159\u00edklad\u016f je, \u017ee star\u00e9 heslo je pova\u017eov\u00e1no za neplatn\u00e9 a\u017e po ov\u011b\u0159en\u00ed identity dr\u017eitele \u00fa\u010dtu.<\/em><\/strong>Je to d\u016fle\u017eit\u00e9, proto\u017ee kdyby bylo mo\u017en\u00e9 resetovat \u00fa\u010det do<\/em> bez ov\u011b\u0159en\u00ed identity, umo\u017enilo by to \u0161irokou \u0161k\u00e1lu zlovoln\u00fdch \u010din\u016f.<\/p>\n

    P\u0159\u00edklad: n\u011bkdo se \u00fa\u010dastn\u00ed aukce na webu a bl\u00ed\u017ee ke konci procesu ve vyvol\u00e1vac\u00ed nab\u00eddce zablokuje konkurenty t\u00edm, \u017ee zah\u00e1j\u00ed proces resetov\u00e1n\u00ed, a t\u00edm je vylou\u010d\u00ed z aukce. Je z\u0159ejm\u00e9, \u017ee pokud by byla funkce resetov\u00e1n\u00ed \u0161patn\u011b navr\u017eena a mohla b\u00fdt zneu\u017eita, mohlo by to v\u00e9st k v\u00e1\u017en\u00fdm negativn\u00edm n\u00e1sledk\u016fm. Je tak\u00e9 t\u0159eba poznamenat, \u017ee blokace \u00fa\u010dt\u016f pomoc\u00ed ne\u00fasp\u011b\u0161n\u00fdch p\u0159ihl\u00e1\u0161en\u00ed p\u0159edstavuje podobnou situaci, ale to je u\u017e t\u00e9ma pro jin\u00fd p\u0159\u00edsp\u011bvek.<\/p>\n

    Jak jsem ji\u017e \u0159ekl, pokud d\u00e1te anonymn\u00edm u\u017eivatel\u016fm mo\u017enost resetovat heslo jak\u00e9hokoli \u00fa\u010dtu pouze na z\u00e1klad\u011b jeho e-mailov\u00e9 adresy, je to situace p\u0159ipraven\u00e1 pro \u00fatok typu \"\u00fatok na odm\u00edtnut\u00ed slu\u017eby\". Mo\u017en\u00e1 to nen\u00ed ten, o kter\u00e9m jsme zvykl\u00ed mluvit, ale neexistuje rychlej\u0161\u00ed zp\u016fsob, jak zablokovat p\u0159\u00edstup k \u00fa\u010dtu, ne\u017e pomoc\u00ed \u0161patn\u011b navr\u017een\u00e9 funkce pro resetov\u00e1n\u00ed hesla. DoS<\/a><\/noindex>, o kter\u00e9m jsme zvykl\u00ed mluvit, ale neexistuje rychlej\u0161\u00ed zp\u016fsob, jak zablokovat p\u0159\u00edstup k \u00fa\u010dtu, ne\u017e pomoc\u00ed \u0161patn\u011b navr\u017een\u00e9 funkce resetov\u00e1n\u00ed hesla.<\/p>\n

    Nejslab\u0161\u00ed \u010dl\u00e1nek<\/h2>\n

    \nZ pohledu ochrany jednoho \u00fa\u010dtu je v\u0161e v\u00fd\u0161e uveden\u00e9 skv\u011bl\u00e9, ale v\u017edy si mus\u00edte pamatovat ekosyst\u00e9m, kter\u00fd obklopuje v\u00e1\u0161 chr\u00e1n\u011bn\u00fd \u00fa\u010det. Dovolte mi uv\u00e9st p\u0159\u00edklad:<\/p>\n

    ASafaWeb je hostov\u00e1n na \u00fa\u017easn\u00e9 slu\u017eb\u011b poskytovan\u00e9 AppHarbor. Proces resetov\u00e1n\u00ed \u00fa\u010dtu hostingu prob\u00edh\u00e1 takto:<\/p>\n

    Krok 1:<\/strong><\/p>\n

    \"V\u0161e,
    \nKrok 2:<\/strong><\/p>\n

    \"V\u0161e,
    \nKrok 3:<\/strong><\/p>\n

    \"V\u0161e,
    \nKrok 4:<\/strong><\/p>\n

    \"V\u0161e,
    \nPo p\u0159e\u010dten\u00ed v\u0161ech p\u0159edchoz\u00edch informac\u00ed je ji\u017e snadn\u00e9 pochopit, jak\u00e9 aspekty bychom v ide\u00e1ln\u00edm sv\u011bt\u011b realizovali trochu jinak. Nicm\u00e9n\u011b zde chci \u0159\u00edct, \u017ee pokud zve\u0159ejn\u00edm web jako ASafaWeb na slu\u017eb\u011b AppHarbor a pot\u00e9 vymysl\u00edm skv\u011bl\u00e9 tajn\u00e9 ot\u00e1zky a odpov\u011bdi, p\u0159id\u00e1m druh\u00fd faktor autentizace a ud\u011bl\u00e1m v\u0161echno ostatn\u00ed podle pravidel, neznamen\u00e1 to, \u017ee nejslab\u0161\u00ed \u010dl\u00e1nek cel\u00e9ho procesu nebude schopen to v\u0161echno zni\u010dit. Pokud se n\u011bkdo \u00fasp\u011b\u0161n\u011b autentizuje na AppHarbor a pou\u017eije m\u00e9 informace, bude moci zm\u011bnit heslo jak\u00e9hokoli \u00fa\u010dtu ASafaWeb na po\u017eadovan\u00e9!<\/p>\n

    Smyslem je, \u017ee odolnost implementace ochrany by se m\u011bla posuzovat celkov\u011b: je t\u0159eba modelovat hrozby ka\u017ed\u00e9ho vstupn\u00edho bodu syst\u00e9mu, i kdy\u017e jde o povrchn\u00ed proces, nap\u0159\u00edklad p\u0159ihl\u00e1\u0161en\u00ed do AppHarbor. To by mi m\u011blo poskytnout dobr\u00fd p\u0159ehled o tom, kolik \u00fasil\u00ed mus\u00edm vlo\u017eit do procesu resetov\u00e1n\u00ed hesla ASafaWeb.<\/p>\n

    Spojujeme v\u0161e dohromady<\/h2>\n

    \nTento p\u0159\u00edsp\u011bvek obsahuje velk\u00e9 mno\u017estv\u00ed informac\u00ed, tak\u017ee ho chci shrnout do jednoduch\u00e9 vizu\u00e1ln\u00ed sch\u00e9my:<\/p>\n

    \"V\u0161e,
    \nPamatujte, \u017ee byste m\u011bli prov\u00e1d\u011bt co nejpodrobn\u011bj\u0161\u00ed logov\u00e1n\u00ed ka\u017ed\u00e9ho z t\u011bchto bod\u016f. A to je v\u0161e, je to jednoduch\u00e9!<\/p>\n

    Z\u00e1v\u011bry<\/h2>\n

    \nM\u016fj p\u0159\u00edsp\u011bvek se zd\u00e1 b\u00fdt komplexn\u00ed, nicm\u00e9n\u011b existuje spousta dal\u0161\u00edch materi\u00e1l\u016f, kter\u00e9 bych mohl<\/em> zahrnout, ale rozhodl jsem se to vynechat kv\u016fli stru\u010dnosti: role adresy z\u00e1chrann\u00e9ho e-mailu, situace, kdy ztr\u00e1c\u00edte p\u0159\u00edstup k e-mailu p\u0159idru\u017een\u00e9mu k \u00fa\u010dtu (nap\u0159\u00edklad kdy\u017e v\u00e1s vyhod\u00ed z pr\u00e1ce) atd. Jak jsem ji\u017e \u0159ekl, funkce resetov\u00e1n\u00ed nen\u00ed p\u0159\u00edli\u0161 slo\u017eit\u00e1, ale existuje mnoho n\u00e1zor\u016f na ni.<\/p>\n

    I kdy\u017e resetov\u00e1n\u00ed nen\u00ed tak slo\u017eit\u00e9, \u010dasto je implementov\u00e1no nespr\u00e1vn\u011b. Vid\u011bli jsme p\u00e1r p\u0159\u00edklad\u016f, kdy implementace m\u016f\u017ee<\/em> vedla k probl\u00e9m\u016fm, a existuje mnohem v\u00edce precedens\u016f, kdy nespr\u00e1vn\u00fd reset opravdu<\/em> zp\u016fsobil probl\u00e9my. Ned\u00e1vno se uk\u00e1zalo, \u017ee resetov\u00e1n\u00ed hesla bylo vyu\u017eito k kr\u00e1de\u017ei bitcoin\u016f v hodnot\u011b 87 tis\u00edc dolar\u016f.<\/a><\/noindex>To je v\u00e1\u017en\u00fd negativn\u00ed v\u00fdsledek!<\/p>\n

    Bu\u010fte proto opatrn\u00ed se sv\u00fdmi funkcemi resetov\u00e1n\u00ed, modelujte hrozby<\/a><\/noindex> na r\u016fzn\u00fdch \u00farovn\u00edch a p\u0159i navrhov\u00e1n\u00ed funkce si nech\u00e1vejte \u010dern\u00fd klobouk, proto\u017ee je velmi pravd\u011bpodobn\u00e9, \u017ee si ho n\u011bkdo jin\u00fd tak\u00e9 nasad\u00ed!<\/p>\n

    <\/p>\n

    Na z\u00e1klad\u011b reklamy<\/h4>\n

    \nVDSina<\/b> nab\u00edz\u00ed cenov\u011b dostupn\u00e9 servery k pron\u00e1jmu<\/a><\/noindex> s denn\u00ed platbou, ka\u017ed\u00fd server je p\u0159ipojen k internetov\u00e9mu kan\u00e1lu o rychlosti 500 megabit\u016f a zdarma chr\u00e1n\u011bn proti DDoS \u00fatok\u016fm!<\/p>\n

    \"V\u0161e,<\/a><\/noindex>
    \n
    Zdroj:     habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0414\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0412\u0441\u0451 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u043d\u043d\u043e\u0435 \u0432\u0430\u043c\u0438 \u0432 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u043a\u0430\u0441\u0430\u043b\u043e\u0441\u044c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0438 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0437\u043d\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u044e\u0449\u0438\u0439. \u041e\u043d \u0437\u043d\u0430\u0435\u0442 \u0441\u0432\u043e\u0439 \u0430\u0434\u0440\u0435\u0441 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b, \u0437\u043d\u0430\u0435\u0442, \u043a\u0430\u043a \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a \u043d\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f (\u0442.\u0435. \u0437\u043d\u0430\u0435\u0442 \u0441\u0432\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c \u043e\u0442 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b) \u0438 \u0437\u043d\u0430\u0435\u0442 \u043e\u0442\u0432\u0435\u0442\u044b \u043d\u0430 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u044b\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b. \u00ab\u0417\u043d\u0430\u043d\u0438\u0435\u00bb \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u043c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438; \u0434\u0432\u0443\u043c\u044f \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u044b\u043c\u0438 \u0444\u0430\u043a\u0442\u043e\u0440\u0430\u043c\u0438 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0442\u043e, \u0447\u0442\u043e \u0443 \u0432\u0430\u0441 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":97640,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-97639","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47V\u0161e, co jste cht\u011bli v\u011bd\u011bt o bezpe\u010dn\u00e9m resetov\u00e1n\u00ed hesel. \u010c\u00e1st 2 | ProHoster","description":"Dvoufaktorov\u00e1 autentizace. V\u0161echno, co jste si p\u0159e\u010detli v prvn\u00ed \u010d\u00e1sti, se t\u00fdkalo identifikace na z\u00e1klad\u011b toho, co.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vsyo-chto-vy-hoteli-znat-o-bezopasnom-sbrose-parolej-chast-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0441\u0451, \u0447\u0442\u043e \u0432\u044b \u0445\u043e\u0442\u0435\u043b\u0438 \u0437\u043d\u0430\u0442\u044c \u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u043c \u0441\u0431\u0440\u043e\u0441\u0435 \u043f\u0430\u0440\u043e\u043b\u0435\u0439. \u0427\u0430\u0441\u0442\u044c 2 | ProHoster","og:description":"\u0414\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0412\u0441\u0451 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u043d\u043d\u043e\u0435 \u0432\u0430\u043c\u0438 \u0432 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u043a\u0430\u0441\u0430\u043b\u043e\u0441\u044c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0438 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vsyo-chto-vy-hoteli-znat-o-bezopasnom-sbrose-parolej-chast-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-20T00:42:56+00:00","article:modified_time":"2020-10-20T00:42:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"97639","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:16:25","updated":"2022-10-03 07:14:42","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/97639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=97639"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/97639\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/97640"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=97639"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=97639"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=97639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}