5 ms·

Wouldn’t capability based security just bring you the current situation on mobile phones where most users simply approve access as they have no clue what is bei

by ako 4y ago

Wouldn’t capability based security just bring you the current situation on mobile phones where most users simply approve access as they have no clue what is being asked, nor do they have real alternatives?

Kinrany 4y ago
There is no alternative. Mobile devices and browsers are equivalent to a locked down mode where the user is only allowed to approve a restricted set of capabilities.
loup-vaillant 4y ago
Cluelessness have been catered to to insane degrees in the name of sales, and users are now used to just clicking through whatever pops up until they see the thing they want to see. But if (1) they'd been properly taught, (2) apps asked only for the permissions they need instead of acting like all your data are belong to them, and (3) people actually read those damn pop ups (which they might have if there weren't so many)… capability based security is actually fairly easy to understand.
tonyg 4y ago
No: one possible alternative interaction would be the user handing the program a representation of an instance of the class of object requested. For instance, if the program wants a camera, it says "drag and drop a camera here". The user picks up a camera object - maybe the real camera, maybe a proxy for the real camera that will only work once to take a single photo, maybe a dummy camera, the app can't tell - and drops it on the region.
- coldtea 4y ago
  So? Nothing really changes with this scheme, compared to "Allow camera access" banner.
  - ModernMech 4y ago
    It’s different in that with capabilities the choice is no longer allow/deny, but allow/deny/circumvent. The allow/deny choice makes it so that the user is incentivized to allow things they don’t want just to get access to the app. If I can’t use the app without giving it access to my location, then I’m incentivized to just give it access in order to get what I want. Capabilities let you programmatically customize how to manage resources, so you’re not forced to click through just to get to the app. Furthermore, capabilities are more fine-grained. Today an app will ask for your location and you get to choose yes/no. If you say yes, it has full access to the GPS forever until revoked, sometimes in the background. Give it network access and it has that forever as well, and it can send anything to anyone (including the GPS data you just gave it access to.) Capability based security would allow you to give it access to the GPS for a limited time, or to give it access to a sensor spoofing service if it really needs that data. If you give it network access it would be for certain times, or it could only send data to a whitelist of servers. Moreover you can restrict the app from sharing granted capabilities to other apps. Or vice versa, you can delegate apps to work on your behalf and share capabilities with other apps, which you can later centrally revoke or restrict. It’s really a better security regime than what the major operating systems have ossified around.
    - TeMPOraL 4y ago
      Unfortunately we know now it wouldn't have helped much in practice. Take your GPS example: you can spoof GPS on Android, globally or per-app. Of the apps that are actually useful, many (most?) of the ones that want/need location data will attempt to detect GPS spoofing and deny you service until you turn it off. And lest you think you can work around this by rooting your phone, an increasing number of actually useful apps refuse to run on rooted devices, "because security", and Google is actively helping this by making available an API that streamlines those checks. Capability-based security is a good idea, but like all security technology, it only helps the owner of a device, and who is the owner of a device in any given context is a contested topic, with platforms, vendors, manufacturers and users all having a different opinion about it.
      - 4y ago
steponlego 4y ago
It's on them if they're dumb or lazy enough to do that.
mikewarot 4y ago
A $5 bill in your wallet is a capability. Capability based security is like handing someone $5, not eternal access to all the funds in your wallet. Phones don't do capability based security. There's no way to say, here... you can have access to THIS photo, or this location, once, in an easy way. On PCs, you have to trust the application to do what it says when it uses the system supplied dialog boxes to "open" files, etc. In a capability based system, that's not the case. The OS never trusts the application, ever.
- guessbest 4y ago
  MacOS is doing this.
  - mikewarot 4y ago
    This does not appear to the case. There is no reference to single file run-time assignment of capabilities in their security page[1] "Give X permission to access Y forever" is not capability based security. [1] https://www.apple.com/macos/security/ https://www.apple.com/macos/security/
- ako 4y ago
  iOS is doing this: always grant permission for this capability, only when I use the app, or only once.
- Tagbert 4y ago
  in iOS you can grant apps access to a limited set of photos though the process is multi-step and most users probably just default to "allow all".
mikewarot 4y ago
This grumpy old man made a video, just made for this reply https://www.youtube.com/watch?v=kFRy4IwUNog https://www.youtube.com/watch?v=kFRy4IwUNog Phones do not do capability based security, they could, but they OS doesn't offer that as a possibility, we get the low rent knock-off imitation instead.
- blippage 4y ago
  I share his sentiments. We keep layering more and more gloop on the web. It will always be a game of wack-a-mole. It's like Windows requires TPM, but then gives itself permission to snoop at your files. Or we have oauth, but then github is cracked to reveal the private keys. And so on and so forth, etc. ad nauseam. The clowns at Microsoft, Facebook and Google simply can't be trusted. They've proven that time and time again. Security is better obtained "via negativa" (to quote from Taleb). Be parsimonious in what you allow. Keep things simple. If you don't really need security, then don't have it.

by ako 4y ago

Kinrany 4y ago

There is no alternative. Mobile devices and browsers are equivalent to a locked down mode where the user is only allowed to approve a restricted set of capabilities.

loup-vaillant 4y ago

Cluelessness have been catered to to insane degrees in the name of sales, and users are now used to just clicking through whatever pops up until they see the thing they want to see. But if (1) they'd been properly taught, (2) apps asked only for the permissions they need instead of acting like all your data are belong to them, and (3) people actually read those damn pop ups (which they might have if there weren't so many)… capability based security is actually fairly easy to understand.

tonyg 4y ago

No: one possible alternative interaction would be the user handing the program a representation of an instance of the class of object requested. For instance, if the program wants a camera, it says "drag and drop a camera here". The user picks up a camera object - maybe the real camera, maybe a proxy for the real camera that will only work once to take a single photo, maybe a dummy camera, the app can't tell - and drops it on the region.

coldtea 4y ago
So? Nothing really changes with this scheme, compared to "Allow camera access" banner.
- ModernMech 4y ago
  It’s different in that with capabilities the choice is no longer allow/deny, but allow/deny/circumvent. The allow/deny choice makes it so that the user is incentivized to allow things they don’t want just to get access to the app. If I can’t use the app without giving it access to my location, then I’m incentivized to just give it access in order to get what I want. Capabilities let you programmatically customize how to manage resources, so you’re not forced to click through just to get to the app. Furthermore, capabilities are more fine-grained. Today an app will ask for your location and you get to choose yes/no. If you say yes, it has full access to the GPS forever until revoked, sometimes in the background. Give it network access and it has that forever as well, and it can send anything to anyone (including the GPS data you just gave it access to.) Capability based security would allow you to give it access to the GPS for a limited time, or to give it access to a sensor spoofing service if it really needs that data. If you give it network access it would be for certain times, or it could only send data to a whitelist of servers. Moreover you can restrict the app from sharing granted capabilities to other apps. Or vice versa, you can delegate apps to work on your behalf and share capabilities with other apps, which you can later centrally revoke or restrict. It’s really a better security regime than what the major operating systems have ossified around.
  - TeMPOraL 4y ago
    Unfortunately we know now it wouldn't have helped much in practice. Take your GPS example: you can spoof GPS on Android, globally or per-app. Of the apps that are actually useful, many (most?) of the ones that want/need location data will attempt to detect GPS spoofing and deny you service until you turn it off. And lest you think you can work around this by rooting your phone, an increasing number of actually useful apps refuse to run on rooted devices, "because security", and Google is actively helping this by making available an API that streamlines those checks. Capability-based security is a good idea, but like all security technology, it only helps the owner of a device, and who is the owner of a device in any given context is a contested topic, with platforms, vendors, manufacturers and users all having a different opinion about it.
    - 4y ago

steponlego 4y ago

It's on them if they're dumb or lazy enough to do that.

mikewarot 4y ago

A $5 bill in your wallet is a capability. Capability based security is like handing someone $5, not eternal access to all the funds in your wallet. Phones don't do capability based security. There's no way to say, here... you can have access to THIS photo, or this location, once, in an easy way. On PCs, you have to trust the application to do what it says when it uses the system supplied dialog boxes to "open" files, etc. In a capability based system, that's not the case. The OS never trusts the application, ever.

guessbest 4y ago
MacOS is doing this.
- mikewarot 4y ago
  This does not appear to the case. There is no reference to single file run-time assignment of capabilities in their security page[1] "Give X permission to access Y forever" is not capability based security. [1] https://www.apple.com/macos/security/ https://www.apple.com/macos/security/
ako 4y ago
iOS is doing this: always grant permission for this capability, only when I use the app, or only once.
Tagbert 4y ago
in iOS you can grant apps access to a limited set of photos though the process is multi-step and most users probably just default to "allow all".

mikewarot 4y ago

This grumpy old man made a video, just made for this reply https://www.youtube.com/watch?v=kFRy4IwUNog https://www.youtube.com/watch?v=kFRy4IwUNog Phones do not do capability based security, they could, but they OS doesn't offer that as a possibility, we get the low rent knock-off imitation instead.

blippage 4y ago
I share his sentiments. We keep layering more and more gloop on the web. It will always be a game of wack-a-mole. It's like Windows requires TPM, but then gives itself permission to snoop at your files. Or we have oauth, but then github is cracked to reveal the private keys. And so on and so forth, etc. ad nauseam. The clowns at Microsoft, Facebook and Google simply can't be trusted. They've proven that time and time again. Security is better obtained "via negativa" (to quote from Taleb). Be parsimonious in what you allow. Keep things simple. If you don't really need security, then don't have it.