Outreach via wikipedia articles on authentication and authorization

If it's on topic, I'd like to start a discussion about how to make
sure websites that are cited for basic security definitions don't
prejudice developers against ZBAC.

Wikipedia is widely read and often cited for basic definitions on fora
like stackoverflow, so making sure it's accurate might help elevate
security discussions.


The page on Authentication (
http://en.wikipedia.org/wiki/Authentication#Authorization ) says:

> The process of authorization is distinct from that of authentication.
> Whereas authentication is the process of verifying that "you are who
> you say you are", authorization is the process of verifying that "you
> are permitted to do what you are trying to do". Authorization thus
> presupposes authentication.

That last sentence is widely believed and contributes to poor software
design, and the use of personal pronouns in the second sentence slips
in all kinds of identity-related baggage.

I'd like to edit this section, but having my changes survive later
editors requires respecting the scope of the containing article on
Authentication.

Does anyone have any thoughts on what to include and what not?  I
looked through "From ABAC to ZBAC" for some punchy pull quotes but
didn't find anything short that stands alone.


http://en.wikipedia.org/wiki/Authorization does mention capabilities
and POLA but a naive reader could still read that and reasonably come
to the conclusion that "authorization presupposes authentication."

It might be good to link from "Authentication" to a  fragment of the
"Authorization" page that contrasts the two and includes examples of
systems that the web-dev set might aspire to build that do ZBAC, but
there is no such section exists today.


http://en.wikipedia.org/wiki/Access_control has
> Subjects and objects should both be considered as software entities,
> rather than as human users: any human user can only have an effect
> on the system via the software entities that they control.[citation
> needed]
buried half-way down the page, but it really does need a cite, and the
article starts off with a bunch of anthropomorphic analogies.