The Tangled Web on confused deputies and ambient authority

So first, let me state, I like to come at things from the "capability
side", and have been trying to evangelize a capability-based AuthZ system
within our organization. I have been met with a lot of pushback because
capabilities are unfamiliar and RBAC systems get more people access quicker
(but not necessarily the right people, nor can people easily reason about
them).

I've been reading the Tangled Web, and I saw this "interesting" definition
of the Confused Deputy Problem, in which the author calls it "nearly
meaningless":

[image: Inline image 1]

Transcribed: *Confused deputy problem* is a generic concept in information
security used to refer to a broad class of design or implementation flaws.
The term describes any vector that allows the attacker to trick a program
into misusing some "authority" (access privileges) to manipulate a resource
in an unintended manner--presumably one that is beneficial to the attacker,
however that benefit is defined. The phrase "confused deputy" is regularly
invoked by security researchers in academia, but since virtually all
real-world security problems could be placed in this bucket when considered
at some level of abstraction, this term is nearly meaningless.

The book goes on to offer this definition of ambient authority:

[image: Inline image 2]

Transcribed: *Ambient authority* is a form of access control based on a
global and persistent property of the requesting entity, rather than any
explicit form of authorization that would be valid only for a specific
action. A user-identifying cookie included indiscriminately on every
outgoing request to a remote site, without any consideration for why this
request is being made, falls into that category.

I would love to hear thoughts, criticism, etc. on this book's take on these
particular ideas.

-- 
Tony Arcieri

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk