Re: The Tangled Web on confused deputies and ambient authority

On Tue, Oct 28, 2014 at 9:50 PM, Tony Arcieri <[email protected]> wrote:

> Transcribed: *Confused deputy problem* is a generic concept in
> information security used to refer to a broad class of design or
> implementation flaws. The term describes any vector that allows the
> attacker to trick a program into misusing some "authority" (access
> privileges) to manipulate a resource in an unintended manner
>

I feel this description of confused deputy problem is too broad. There are
many attacks based, for example, on unexpected inputs where one might cause
an agent to misuse authority. Yet, in those cases, there might only be one
authority to misuse. Confused deputy refers to a more specific class of
problems where there is some clear partitioning of authority (e.g.
compiling vs. billing, in the common example) but the deputy fails to shift
into different roles with different authorities.

Or as I've once described it in casual discussion: confused deputy is what
you get when your approach to having many hats to wear is to just wear them
in a tower.


When you should be juggling them properly...




Capabilities help with this problem by forcing you to specifically name
which hat you're using whenever you use it.


> Transcribed: *Ambient authority* is a form of access control based on a
> global and persistent property of the requesting entity, rather than any
> explicit form of authorization that would be valid only for a specific
> action. A user-identifying cookie included indiscriminately on every
> outgoing request to a remote site, without any consideration for why this
> request is being made, falls into that category.
>

I like the first sentence. I'm unclear on the second. I suppose the author
is implying that the user-identifying cookie also happens to be the source
of authority. But there are certainly applications of user-identifying
tokens (e.g. to support views, preferences, logging) that could be
independent of whichever authority is invoked.

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk