3 ms·

No: one possible alternative interaction would be the user handing the program a representation of an instance of the class of object requested. For instance, i

by tonyg 4y ago

No: one possible alternative interaction would be the user handing the program a representation of an instance of the class of object requested. For instance, if the program wants a camera, it says "drag and drop a camera here". The user picks up a camera object - maybe the real camera, maybe a proxy for the real camera that will only work once to take a single photo, maybe a dummy camera, the app can't tell - and drops it on the region.

coldtea 4y ago
So? Nothing really changes with this scheme, compared to "Allow camera access" banner.
- ModernMech 4y ago
  It’s different in that with capabilities the choice is no longer allow/deny, but allow/deny/circumvent. The allow/deny choice makes it so that the user is incentivized to allow things they don’t want just to get access to the app. If I can’t use the app without giving it access to my location, then I’m incentivized to just give it access in order to get what I want. Capabilities let you programmatically customize how to manage resources, so you’re not forced to click through just to get to the app. Furthermore, capabilities are more fine-grained. Today an app will ask for your location and you get to choose yes/no. If you say yes, it has full access to the GPS forever until revoked, sometimes in the background. Give it network access and it has that forever as well, and it can send anything to anyone (including the GPS data you just gave it access to.) Capability based security would allow you to give it access to the GPS for a limited time, or to give it access to a sensor spoofing service if it really needs that data. If you give it network access it would be for certain times, or it could only send data to a whitelist of servers. Moreover you can restrict the app from sharing granted capabilities to other apps. Or vice versa, you can delegate apps to work on your behalf and share capabilities with other apps, which you can later centrally revoke or restrict. It’s really a better security regime than what the major operating systems have ossified around.
  - TeMPOraL 4y ago
    Unfortunately we know now it wouldn't have helped much in practice. Take your GPS example: you can spoof GPS on Android, globally or per-app. Of the apps that are actually useful, many (most?) of the ones that want/need location data will attempt to detect GPS spoofing and deny you service until you turn it off. And lest you think you can work around this by rooting your phone, an increasing number of actually useful apps refuse to run on rooted devices, "because security", and Google is actively helping this by making available an API that streamlines those checks. Capability-based security is a good idea, but like all security technology, it only helps the owner of a device, and who is the owner of a device in any given context is a contested topic, with platforms, vendors, manufacturers and users all having a different opinion about it.
    - pabs3 4y ago
      How do they detect the GPS spoofing?
  - ako 4y ago
    That’s way too cumbersome for a user, I wouldn’t use it. I simply want an app that I can trust. If I use it to send a picture, obviously it should have access to the camera. But it shouldn’t be able to send that image to a destination unrelated to my use case.
    - ModernMech 4y ago
      > I simply want an app that I can trust. Sure, we all want that, but we’ve learned that trusting apps does not scale. Even if you like an app and trust it, it can be updated to break that trust. Capability based security puts you in control so you don’t have to rely on trust. > But it shouldn’t be able to send that image to a destination unrelated to my use case. Capability based security could do this, and you don’t have to trust anyone to implement that feature for you (or to not silently remove it via an update). You would create a capability that would require camera and network access. Any app that needs both resources could take such a capability and be restricted in where it can send photos.

by tonyg 4y ago

coldtea 4y ago

So? Nothing really changes with this scheme, compared to "Allow camera access" banner.

ModernMech 4y ago
It’s different in that with capabilities the choice is no longer allow/deny, but allow/deny/circumvent. The allow/deny choice makes it so that the user is incentivized to allow things they don’t want just to get access to the app. If I can’t use the app without giving it access to my location, then I’m incentivized to just give it access in order to get what I want. Capabilities let you programmatically customize how to manage resources, so you’re not forced to click through just to get to the app. Furthermore, capabilities are more fine-grained. Today an app will ask for your location and you get to choose yes/no. If you say yes, it has full access to the GPS forever until revoked, sometimes in the background. Give it network access and it has that forever as well, and it can send anything to anyone (including the GPS data you just gave it access to.) Capability based security would allow you to give it access to the GPS for a limited time, or to give it access to a sensor spoofing service if it really needs that data. If you give it network access it would be for certain times, or it could only send data to a whitelist of servers. Moreover you can restrict the app from sharing granted capabilities to other apps. Or vice versa, you can delegate apps to work on your behalf and share capabilities with other apps, which you can later centrally revoke or restrict. It’s really a better security regime than what the major operating systems have ossified around.
- TeMPOraL 4y ago
  Unfortunately we know now it wouldn't have helped much in practice. Take your GPS example: you can spoof GPS on Android, globally or per-app. Of the apps that are actually useful, many (most?) of the ones that want/need location data will attempt to detect GPS spoofing and deny you service until you turn it off. And lest you think you can work around this by rooting your phone, an increasing number of actually useful apps refuse to run on rooted devices, "because security", and Google is actively helping this by making available an API that streamlines those checks. Capability-based security is a good idea, but like all security technology, it only helps the owner of a device, and who is the owner of a device in any given context is a contested topic, with platforms, vendors, manufacturers and users all having a different opinion about it.
  - pabs3 4y ago
    How do they detect the GPS spoofing?
- ako 4y ago
  That’s way too cumbersome for a user, I wouldn’t use it. I simply want an app that I can trust. If I use it to send a picture, obviously it should have access to the camera. But it shouldn’t be able to send that image to a destination unrelated to my use case.
  - ModernMech 4y ago
    > I simply want an app that I can trust. Sure, we all want that, but we’ve learned that trusting apps does not scale. Even if you like an app and trust it, it can be updated to break that trust. Capability based security puts you in control so you don’t have to rely on trust. > But it shouldn’t be able to send that image to a destination unrelated to my use case. Capability based security could do this, and you don’t have to trust anyone to implement that feature for you (or to not silently remove it via an update). You would create a capability that would require camera and network access. Any app that needs both resources could take such a capability and be restricted in where it can send photos.