Re: Outreach via wikipedia articles on authentication and authorization

2013/8/6 Karp, Alan H <[email protected]>:
> I have some stuff on slides I used for an RSA talk that talks about access control having four steps.
>
> 1. Identification - knowing who to throw in jail.  Well, OK, just knowing who to hold responsible.  It's what we do when setting up an account for a new user.
>
> 2. Authentication - what a process must do to be able to use the privileges assigned to an identified individual

So authentication is necessarily protocol related?  "Attach these
identity-related secrets to this request in this way."

> 3. Authorization - granting a right to be associated with a particular authentication, e.g., adding an entry in an ACL

Would encrypting something using the intended recipient's public key
be an authorizing action then?
If authentication is a process action, then could decoding using a
private key achieve that, and could identification involve storing the
public key in the right place?

> 4. Access decision - deciding whether or not to honor a request

So the outputs of access control code are access decisions?

> By the way, the statement about authentication is imprecise in a significant way.  Authentication only proves that you possess specific credentials.  It only specifies who you are (identification) if those credentials were not shared either intentionally or unintentionally.

Does this section from Wikipedia use terms properly?

> However note that if a stranger tries to access someone else's account with
> his own identification credentials, the stranger's identification credentials will
> still be successfully authenticated because they are genuine and not
> counterfeit, however the stranger will not be successfully authorized to
> access the account, as the stranger's identification credentials had not been
> previously set to be eligible to access the account, even if valid (i.e.
> authentic).

It seems to use "authorized" the way you use "access decision" whereas
the part where it says "previously set to be eligible" would
correspond to the way you use "authorized."