Re: Outreach via wikipedia articles on authentication and authorization

It is definitely an appropriate topic for cap-talk, if that's what you're
asking. And yes, this seems like a great thing to try to do.


On Tue, Aug 6, 2013 at 11:22 AM, Mike Samuel <[email protected]> wrote:

> If it's on topic, I'd like to start a discussion about how to make
> sure websites that are cited for basic security definitions don't
> prejudice developers against ZBAC.
>
> Wikipedia is widely read and often cited for basic definitions on fora
> like stackoverflow, so making sure it's accurate might help elevate
> security discussions.
>
>
> The page on Authentication (
> http://en.wikipedia.org/wiki/Authentication#Authorization ) says:
>
> > The process of authorization is distinct from that of authentication.
> > Whereas authentication is the process of verifying that "you are who
> > you say you are", authorization is the process of verifying that "you
> > are permitted to do what you are trying to do". Authorization thus
> > presupposes authentication.
>
> That last sentence is widely believed and contributes to poor software
> design, and the use of personal pronouns in the second sentence slips
> in all kinds of identity-related baggage.
>
> I'd like to edit this section, but having my changes survive later
> editors requires respecting the scope of the containing article on
> Authentication.
>
> Does anyone have any thoughts on what to include and what not?  I
> looked through "From ABAC to ZBAC" for some punchy pull quotes but
> didn't find anything short that stands alone.
>
>
> http://en.wikipedia.org/wiki/Authorization does mention capabilities
> and POLA but a naive reader could still read that and reasonably come
> to the conclusion that "authorization presupposes authentication."
>
> It might be good to link from "Authentication" to a  fragment of the
> "Authorization" page that contrasts the two and includes examples of
> systems that the web-dev set might aspire to build that do ZBAC, but
> there is no such section exists today.
>
>
> http://en.wikipedia.org/wiki/Access_control has
> > Subjects and objects should both be considered as software entities,
> > rather than as human users: any human user can only have an effect
> > on the system via the software entities that they control.[citation
> > needed]
> buried half-way down the page, but it really does need a cite, and the
> article starts off with a bunch of anthropomorphic analogies.
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk
>



-- 
    Cheers,
    --MarkM

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk