Re: Outreach via wikipedia articles on authentication and authorization

On Mon, August 12, 2013 17:01, Karp, Alan H wrote:
> Rob contends that responsibility tracking is less important at finer
> granularities.

Only as far as the 'who' is concerned. Responsibility tracking of the 'what'
may still be relevant, but given that identity is a single granularity
concept coupled only to the 'who', identity bound responsibility tracking
seems just an extension of the single granularity lock-in that identity
based access control brought us.

At finer granularity levels, there is fine grained delegation of authority
for what the concept of 'identity' is either irrelevant or worse, where
the access to non-decomposed and non-attenuated identity information might
constitute substantially more authority than that for what we want to
track accountability.

> I don't agree.  Responsibility tracking is less important
> when the consequences are less, as in his bicycle/cookie example.
> However, if you can do responsibility at low or no cost, why not do it all
> the time?

A few reasons:

1) The 'who' may be much less relevant than the 'what'.
2) Identity is not decomposable or attenuable, so the authority
   to access the information, either for access control or accountability
   is not really suitable to do POLA with.
3) Even if identity could be slightly attenuated, for example by using
   revocable anonimity, the attenuated identity could still constitute
   a substantial authority compared to the authority we want to track
   responsibility for.


We might extend the possibility to do responsibility tracking by
decoupling it from the single granularity concept of identity, and
introducing a multi granular decomposable/attenuable concept that is only
coupled to identity at a single level.

Consider the following:

We are at granularity level N. At this granularity level we have entities,
depending on the value of N these could be companies, people, (virtual)
machines, programs, processes, objects, methods, etc. Each of these
entities can have identifying properties from the perspective of the
courser granularity N-1. I would like to claim that these identifying
properties of an entity are in fact only relevant for a granularity level
up to N. That is, in most cases an N+1 entity should not have knowledge
about N level entity identifying properties. In fact, most such access
should probably
be contrary to the POLA concept.

If we combine this idea with the concept of revocable anonymity, we could
possibly come up with a solid way to replace the single granularity
concept of identity with a multi-granular revocably-anonymous
accountability-token.
So if something like that is what you mean by 'low or no cost', than yes I
could agree. If however you suggest turning identity information almost
globally available for accountability purposes at the finer granularity
levels, than I don't think that would be anywhere close to 'low or no
cost'.


Rob