the confusion about authentication and authorization

There’s a lot of confusion about authentication and authorization.

At the basic level:

Authentication is about proving your identity, or how  you prove to someone that you are who you say you are.

Authorization is about your entitlements, what you have access, what you are “authorized” to do or act upon.

Authorization should be completely based on authentication first. If I can’t authenticate who you are, then my authorization parameters will be useless.

At a basic level, at a “chic” bar/dance club, if you’re on my guest list, with your name on it, I have to first check your id to verify who you say you are – authentication.. then check my guest list, to see if you’re on the list – authorization.

If you think about how we authenticate people, there’s a whole range of things you authenticate them on.. but it’s mostly about some level of trust.

if you give me your id, and I check your id, there’s some level of trust that the id (credentials) you’re providing is trustworthy.. it’s got a government seal on it and everything. If my bar has been hit a few times for underage drinking, then I’m a little less trustworthy of the id.. so I have an eye for fake ids, or I check it against a “swipe” machine nowadays.. That means, i’m extending my trust holdings, or trustees, or trust circle, whatever you call it, a little further.. my trust circle now includes, my experience, or my government sanctioned “swipe” fandangle.

If you think about it a little further, the extension of my trust circle, again includes identity first, authentication, and authorization.. In the first case, my employer “trusts” my identity and therefore “trusts” me to do the job of authenticating customers to the club. In the second case, my employer, “trusts” the identity of the government “swipe” verifier system.

And on and on it goes..essentially, it comes down to a web of trust, for identities.. and today, in the real world, the whole thing is held up by unverifiable trusts all along the way. any one of them could break down, and your whole setup is fair game. One of the reasons our society has held up to the gaming of this is the fear of mass breakdown of this social infrastructure. That’s why we create laws about identity, ids, passports all of which are tied to physical verfication and characteristics – fingerprints, voiceprints, facial algorithms etc.. and it has held up, upto now.

If you extend that to the the internet space and the digital space, we’ve come up with things like pki (public key infrastructure) came about, and pgp/gpg, mime, ssl, you name it, one building upon the other..A whole bunch of them are just virtual identity infrastructures that fall down when you actually scrutinize them.

So, you see, I mislead you as a reader.. When it comes down to it,

it’s actually about identity and identity.

Once you have a foolproof way to create identity, you have a way to verify or not verify or nullify it (authenticate). Authorization is easy after that.. after all it’s just a guest list.. or a guest list of guest lists or this guest list and that guest list but not that guest list, but also all of that other guest list. Or a specialize type of guest list that might say on tuesdays you’re allowed in if you have moustache, but not if you are wearing sandals, and on wednesdays, which are slow night, everyone is allowed in for free if they’re of a certain age or sex ..

I don’t think we’re completely there yet. We have the right thinking in terms of components, but not quite the right system, yet.

The components are an immutable digest or signature of your identity .. along the lines of fingerprint signatures etc.. and these have to evolve with time to be more accurate and more immutable towards infinity (somewhat like pi .. everyone gets their own pi)

The system is completely wrong, and is prone to break down any time. There’s a multitude of ways one could go about creating his/her identity (component) from a breaking down system (a country in chaos, a person/family with intent to game the system including birth certificates etc) like creating fake but verifiable birth certificates or passports, you name it..

What you need now, with the aid of digital space, is a mutually verifiable, multi-way replicated public digest archive that’s immutable and available across the globe..of the public portion of the identity.

This has privacy connotations, in the face of it, not really .. but that’s something for another post..

Advertisements

poetry

Poetry is fluid
It can distort your mind
and play with your soul with one simple statement like
you’re never a woman and neither a man, nor your pet dog.

Poetry is a soccer field
where the thrusts, blocks and passes are the same as
an attempt at getting the goal
of one getting their word past a thick fog of judgement.

Poetry is a killer
It can wring you dry and fling you
to the edges of the ocean and have you drinking
your own faculty juices before you know it.

Poetry is ambiguous
to those who hide meaning
or their means to an end
or those who are unfortunate to have been born
into the house of buddha

Poetry is flight
the base-jumping and the soul thread
the kind that leads surfers to the revered pipe
and the ones who slaughter thousands
to get the millions their want

Poetry is ecstacy
and your salvation
the feeling, the drug, the fragrance that leads you
out of your misgivings
and your miseries and your flights of ego
your beliefs in empathy and the one true god

Poetry is compact
it can throw you a curved ball
with a thousand fold more meaning packed in the curve
than the impact of it hitting your jaw

Poetry is succinct
Every century,yet another generation of literati
will squeeze yet another set of realities
from this very sentence.

Forever more, poetry is the essence
of life, liberty, happiness,
hah!
of expansion, contentness, society
hah!
continuity, survival, ignorance
hah!

I would read and write and rejoice.

the question of why

Why am i here? Why are you here? Why do I have the capability to think this thought?

Aah.. Sorry, don’t have the answer. Look somewhere else.

That’s the age old question we’ve been trying to answer. We’ve formed various vehicles to help us solve these problems. Religions, science, traditions, laws, societies and boundaries. I’m not sure we’re anywhere near solving that question. Good old Doug asked the right questions. Take it lightly. Don’t panic. (Didn’t mean to confuse you, I still think those are questions, not statements)

God, and by proxy, religion, although with negative connotations, is a nebulous concept. It’s something we can’t reach, yet we want to and still try, but is fabricated by the masses of us, solely for the reason of satisfying our curiosity and to a greater extent, our wishes to be fulfilled.
Science is trying it’s best to make sure everything is replicable and calculable or it’s not science. There’s no chance for errors. Ooh, the horror if we have dichotomy. Blasphemy.

Ah, the comedy!

Not to be nihilistic, what about the way we just are, it just is, the universe exists because we think it does and so on. Or, the sense of reality reflects what you want or do not want.

Thank you Zen. Get it right Wachowski’s.

Parody of errors

(or parody of comedies and comedy of errors)
A person is a conglomeration of his or her past experiences from the day s/he starts remembering things, nothing else.

A person’s mind is a shells that starts building it’s personality, adding a layer of memory each time it thinks it’s worth remembering. It could hide it amongst it’s folds never to come out consciously or it could lay it on top ever ready to be called upon. It’s a ballfull of memories and experiences flexing their muscles, each competitively trying to exert influence on the action the person is about to commit.

I’m sure it was borne out of evolutionary necessity. Frail humans are no match for the brawn of the wild without something to hold it’s experiences to call upon when needed.
Add to that, the growing threat of each other.
The mind breeds superiority. Superiority breeds survival. Survival breeds abundance. Abundance breeds scarcity. Scarcity breeds competition. Competition breeds hunger for knowledge. Knowledge breeds superiority.
It’s a circle. The mind just happened to be the trigger.

So much for theory. Now, out here in the real world, you can see each of those steps at work. I have yet to come across another human being that is above and beyond that cycle. Forget Buddha. Abundance wasn’t abundant back then. Show me a guru and I bet you I could spot a thread of that cycle in the glint of his/her eye.

Tall men have fought and won wars. Short men have changed the course of history. It’s not what we have outside. It’s what we have in the creases of our gooey matter, the crud that’s settled in since we were three. That’s what makes us tick or go jump off a building.

If you could sit at an auditoreum to watch the universe performing, you would bowl over laughing at the repeated mistakes we make and the perseverance of it all. It’s funny. Take my word for it. Or better yet, take it as if you were watching a parade of parodies through the ages, you and me among it. Oh, the comedy of it all.

Look for those memories that your mind is not letting you look at. Review it and give it an up yours. 🙂
(I’m still trying by the way).