Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Authorize, don't authenticate

blog.marcua.net

Post reply on HN
Print view View original

31–40 of 49 posts

Re: Authorize, don't authenticate

#31

Post by williamcotton »

ButlerianJihad wrote: post #29
jdub wrote: post #21

(c.f. other comments about confusing misuse of security terminology) An easy way to remember the difference between the As in AAA: Who is your daddy, and what does he do? ^ authentication ^ authorisation And the all too often forgotten final A is accounting, for which you can imagine Arnold writing down the interaction in his police notepad. :-)

It seems like your unnecessarily kinky mnemonic also forgot the third "A". Don't mnemonics usually cover the entire list of the thing you want to remember?

It’s a memorable quote from the movie Kindergarten Cop.

Re: Authorize, don't authenticate

#32

Post by jdub »

noisy_boy wrote: post #25
jdub wrote: post #21

(c.f. other comments about confusing misuse of security terminology) An easy way to remember the difference between the As in AAA: Who is your daddy, and what does he do? ^ authentication ^ authorisation And the all too often forgotten final A is accounting, for which you can imagine Arnold writing down the interaction in his police notepad. :-)

Simplified: Who are you and what do you want?

Doesn't sound nearly as good in the original Austrian (accent).

Re: Authorize, don't authenticate

#33

Post by simonjgreen »

ButlerianJihad wrote: post #29
jdub wrote: post #21

(c.f. other comments about confusing misuse of security terminology) An easy way to remember the difference between the As in AAA: Who is your daddy, and what does he do? ^ authentication ^ authorisation And the all too often forgotten final A is accounting, for which you can imagine Arnold writing down the interaction in his police notepad. :-)

It seems like your unnecessarily kinky mnemonic also forgot the third "A". Don't mnemonics usually cover the entire list of the thing you want to remember?

They didn’t call it a mnemonic. They are suggesting recalling a movie scene to remember AAA. And imo, it’s a great one that I’ll be reusing to help others remember! I have to remind folks of the difference frequently at work.

Re: Authorize, don't authenticate

#35

Post by brabel »

The idea of apps accessing a database directly instead of going through an API keeps popping up every few years. It never works. And the reason is exactly about authorization. Google CouchApps and read the post they wrote about why doing that is a very bad idea, despite sounding awesome without spending too much thought on it.

Re: Authorize, don't authenticate

#36

Post by pestatije »

jdub wrote: post #21

(c.f. other comments about confusing misuse of security terminology) An easy way to remember the difference between the As in AAA: Who is your daddy, and what does he do? ^ authentication ^ authorisation And the all too often forgotten final A is accounting, for which you can imagine Arnold writing down the interaction in his police notepad. :-)

I have shitty memory and never confused those... something else is amiss here

Re: Authorize, don't authenticate

#37

Post by explodingwaffle »

I really like this concept (though the post is terribly named as others have said). "Databases that are easy to make as documents" is so obvious that you wonder why it isn't more of a thing. Add in "untitled" databases that live in a session/browser so you can "try before you buy", maybe the option for single file databases with no intermediary/service (so you have a Databases folder that is as messy as your Downloads folder... but is that really so bad? better than a password manager full of garbage services IMO), and you basically get EASY seperation between application and data, which is Good for a lot of reasons (lock-in, ownership etc)

Re: Authorize, don't authenticate

#39

Post by ButlerianJihad »

simonjgreen wrote: post #33
ButlerianJihad wrote: post #29

Earlier quoted context omitted.

It seems like your unnecessarily kinky mnemonic also forgot the third "A". Don't mnemonics usually cover the entire list of the thing you want to remember?

They didn’t call it a mnemonic. They are suggesting recalling a movie scene to remember AAA. And imo, it’s a great one that I’ll be reusing to help others remember! I have to remind folks of the difference frequently at work.

https://en.wiktionary.org/wiki/mnemonic

  Especially of a series of ideas, letters, words, etc.: intended to help in remembering.
https://montypython.fandom.com/wiki/Bridge_of_Death

Re: Authorize, don't authenticate

#40

Post by jambalaya8 »

jdub wrote: post #21

(c.f. other comments about confusing misuse of security terminology) An easy way to remember the difference between the As in AAA: Who is your daddy, and what does he do? ^ authentication ^ authorisation And the all too often forgotten final A is accounting, for which you can imagine Arnold writing down the interaction in his police notepad. :-)

ah, but the confusion in the security model of a more-than-one-daddy family.
Post reply on HN