Authorization terminology is a mess: Let's fix it

 (idpro.org)

35 points | by andychiare 2 days ago

5 comments

  • tuberreact 49 minutes ago
    turns out naming is important
    [-]
    • andai 5 minutes ago
      I'm maintaining a document called Tricksy words with multiple meanings that cause endless confusion and strife

      Just in the past year I have wasted several months pulling my hair out due to incorrectly named projects.

      It really does turn out naming is important!

  • black_knight 24 minutes ago
    > can this subject perform this action on this object?

    IMHO, the most elegant method to answer this question is capability based access control. If the subject can utter the action, then it can perform it. And then delegation is the transfer of nouns and verbs to perform the utterances.

    [-]
  • usernametaken29 7 minutes ago
    https://xkcd.com/927

    Nice work and all regardless

  • bijowo1676 40 minutes ago
    excellent article, very thorough and nuanced explanation.
  • Quarrelsome 9 minutes ago
    Nice!

    I'd like to fix the prior abstract. Auth and auth upsets me greatly cos we have:

    Authentication & Authorization

    and we call both/either auth. Hence please help me make this a thing:

    AuthENTIcation & AuthORIzation : ENTI & ORI

    ENTI- can you enter, ORI (or ORIZ) what can you do?

    [-]
    • hobofan 6 minutes ago
      This has already been solved well-enough with AuthN and AuthZ as distinct names.
    • andai 7 minutes ago
      ident and perms