Authentication/Authorization Revisted

I made this suggestion some time ago. Mark Hahn never responded.

password attacks that gain access through a minor user and then use 
system utilities to gain effective root access without ever having to 
authenticate with a root password would also be thwarted with an 
authorization based on authentication
on an access by access basis.

It also allows for temporary elevation of permissions without having 
every act be at the higher permissions level. This approach is used in 
Mac OSX so that one rarely ever needs to be logged in as root. In 
Prothon one could write stuff so that it by default had a low level of 
permissions but for select cases could gain higher level access but 
would require authentication on an access policy basis.
Access policy would be one of  (first access in a session, first access 
in a time period, every access)



On Apr 12, 2004, at 23:26, Samuel M. Smith wrote:

> How about a third bit that if set requires 
> authorization/authentication  before an access or before the first 
> access. This is a useful defense against trojan horses. The 
> authentication can also have a time limit at which reauthentication is 
> required.