Re: "Ambient capabilities"

On 11/24/14 at 10:18 AM, [email protected] (David Nicol) wrote:

>On Mon, Nov 3, 2014 at 8:26 PM, David Barbour <[email protected]> wrote:
>
>>You certainly aren't getting the benefits of precisely indicating which
>>authorities you're using for each action. A user is subject to the confused
>>deputy problem.
>>
>
>Is that important?

There are a number of popular attacks which are examples of 
confused deputy. For example, the cross site request forgery 
attack is one and it is used somewhat frequently in the web 
world. From the Wikipedia article:

The deputy Alice's Web browser which is confused into misusing 
Alice's authority at Mallory's direction.

The following characteristics are common to CSRF:

     Involve sites that rely on a user's identity
     Exploit the site's trust in that identity
     Trick the user's browser into sending HTTP requests to a 
target site
     Involve HTTP requests that have side effects

At risk are web applications that perform actions based on input 
from trusted and authenticated users without requiring the user 
to authorize the specific action. A user who is authenticated by 
a cookie saved in the user's web browser could unknowingly send 
an HTTP request to a site that trusts the user and thereby 
causes an unwanted action.

CSRF attacks using image tags are often made from Internet 
forums, where users are allowed to post images but not JavaScript.


>Must all method calls include a "by what authority" parameter?

Only if you want to avoid the confused deputy class of attacks.

Do note that object references in languages such as Java and 
Python, to pick two widely used languages, are fine examples of 
capabilities, and quite easy to use.

Cheers - Bill

---------------------------------------------------------------------------
Bill Frantz        | Re: Computer reliability, performance, and security:
408-356-8506       | The guy who *is* wearing a parachute is 
*not* the
www.pwpconsult.com | first to reach the ground.  - Terence Kelly