Re: Macaroons: capabilities vs credentials

On Thu, Dec 11, 2014 at 12:17 AM, David Barbour <[email protected]> wrote:

> The idea of choosing which authorities we use for an action is
> fundamentally built into the object capability model: designation of
> resource is tightly coupled with the selection of authority. This tight
> coupling is important. It's how we resist the confused deputy problem. It's
> how we keep the model simple and efficient.
>

The way I see it though, you can either use something like a Macaroon or a
proof of authority, or you have a crypto-capability:

1) in the Macaroon model, the service you're authorizing yourself to uses
logic to determine if you're authorized
2) in the crypto-capability model, your authority derives itself merely by
possession of the appropriate cryptographic keys to have a particular power
in the protocol

This is ultimately what it comes down to, right? Either an action is
authorized via some sort of logic, or for lack of a better term "math"

I suspect what you're getting at is Macaroons allow use cases which aren't
tightly coupled to the resource, to the form that your "handle" to that
resource involves a Macaroon and nothing more (i.e. the server can know
based on your macaroon alone *exactly* what you're trying to do), and
without that sort of explicit binding from resource to authority, confused
deputies can arise, and that's a problem.

So Macaroons aren't capabilities. But could they be used as a framework to
build capabilities?

-- 
Tony Arcieri

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk