Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Authorization terminology is a mess: Let's fix it

idpro.org

Post reply on HN
Print view View original

31–40 of 91 posts

Re: Authorization terminology is a mess: Let's fix it

#32

Post by lozf »

Quarrelsome wrote: post #5

Nice! I'd like to fix the prior abstract. Auth and auth upsets me greatly cos we have: Authentication & Authorization and we call both/either auth. Hence please help me make this a thing: AuthENTIcation & AuthORIzation : ENTI & ORI ENTI- can you enter, ORI (or ORIZ) what can you do?

> ENTI- can you enter, ORI (or ORIZ) what can you do?

I don't mean to quarrel about it, but I understood Authentication to be closer to identification. To provide "adequate proof that you are actually who you claim to be".

Even the "can you enter" question falls under authorization; "does the user have appropriate permissions?" Entering is just one of perhaps many subsequent levels of permissions.

Re: Authorization terminology is a mess: Let's fix it

#33

Post by happytoexplain »

perching_aix wrote: post #27
theasisa wrote: post #18

Earlier quoted context omitted.

> Probably someone who never confuses “empathy” and “sympathy” while also carefully distinguishing between “should” and “ought”. What do you mean by this?

Not sure what's giving you a pause there?

It's going over my head, too. I don't understand what the implication of the sentence is in context.

Re: Authorization terminology is a mess: Let's fix it

#35

Post by sbuttgereit »

lozf wrote: post #32
Quarrelsome wrote: post #5

Nice! I'd like to fix the prior abstract. Auth and auth upsets me greatly cos we have: Authentication & Authorization and we call both/either auth. Hence please help me make this a thing: AuthENTIcation & AuthORIzation : ENTI & ORI ENTI- can you enter, ORI (or ORIZ) what can you do?

> ENTI- can you enter, ORI (or ORIZ) what can you do? I don't mean to quarrel about it, but I understood Authentication to be closer to identification. To provide "adequate proof that you are actually who you claim to be". Even the "can you enter" question falls under authorization; "does the user have appropriate permissions?" Entering is just one of perhaps many subsequent levels of permissions.

I think you've got the right idea, though in practice the initial "authentication" question (you are who you say you are) is very closely linked to the initial "authorization" evaluation (can you enter).... because in most systems the only "can you enter" authorization required for access is in fact that you are who you say you are.

But not all systems work this way. There are some systems where you can log in successfully, but then are immediately escorted out because the "can you enter" question has secondary considerations or is decided once identity has been established based on a larger criteria. Expired accounts in some systems work exactly like this.

Re: Authorization terminology is a mess: Let's fix it

#36

Post by rapnie »

formerly_proven wrote: post #28
williamdclt wrote: post #14

Earlier quoted context omitted.

I have more experience with authorization than most engineers, even engineers who have some experience with authn/authz, and I have no idea what that "subject can utter the action" or "transfer of nouns and verbs to perform the utterances" could mean

They clearly mean capabilities. https://en.wikipedia.org/wiki/Capability-based_security > Capabilities achieve their objective of improving system security by being used in place of forgeable references. A forgeable reference (for example, a path name) identifies an object, but does not specify which access rights are appropriate for that object and the user program which holds that reference. Consequently, any attem…

Some nice Object Capability technologies not mentioned in the Wikipedia article:

https://capnproto.org (used by Cloudflare)

https://spritely.institute/goblins (with wasm support via Hoot)

https://ocapn.org (where things come together in a future open standard)

Re: Authorization terminology is a mess: Let's fix it

#39

Post by simonw »

andai wrote: post #10
tuberreact wrote: post #2

turns out naming is important

I'm maintaining a document called Tricksy words with multiple meanings that cause endless confusion and strife Just in the past year I have wasted several months pulling my hair out due to incorrectly named projects. It really does turn out naming is important!

I've worked at places where it turned out different parts of the organization had a different idea of what a "user" of the core product was.

The team using Salesforce, the data warehouse team, the application development teams, all with different mental models of what "we added 5,000 users today" actually meant in concrete terms.

Post reply on HN