Re: Outreach via wikipedia articles on authentication and authorization

On 2013-08-07 05:45, Marc Stiegler wrote:
> Authorization does in fact presuppose authentication. But the
> authentication may have taken place much earlier. One way we describe
> ZBAC is, one authenticates at time of grant, and then at time of
> access the resource only needs to check the authorization. This is how
> car keys work: I authenticate you by looking at you when I hand you
> the keys. Then the car does not need to know who you are, it only
> knows, and only cares, that you are authorized.
> 

When I go to the gym, their locker system provides me with a locker 
number,
I can than create my own authorization token (pin) and can than store my 
stuff
in that locker, ones I'm done I can use the authority implied by the
locker-number + pin to again gain access to the locker. No identity,
no authentication presupposed or otherwise.

IMO one authenticates at time of grant not for the purpose of 
authorization but
for the purpose of accountability. So maybe accountability presuppose 
authentication
and authorization often presupposes accountability.

Rob