Re: A new type of phishing attack

"Capabilities are useful because they can be passed around.  Let us suppose, however, that they get passed around with their history.  Ann has a capability that can be exercised on the host Dave.  She issues this capability to Bob, who issues it to Carol, who uses it on Dave. 
Dave says, OK, because this capability comes from Dave."

It is perhaps worth noting that another approach, rather straightforward in its implementation given a suitable infrastructure, is to have Ann manufacture a new, separately revocable, separately accountable, capability for Bob, who makes a new one for Carol. You can make this remarkably user friendly. In Pubshare, it takes fewer clicks and keystrokes for Ann to make and deliver a new capability for Bob than it would take to copy/paste/address/email her own capability. It is easier to do least privilege delegation than to do credential sharing. See it at https://www.youtube.com/watch?v=LJ8FPM1_uTA


--marcs