3 ms·

Just to be clear, these two are short for authentication and authorization, right? I guess it's awkward that those two related but different concepts share the

by mcv 3y ago

Just to be clear, these two are short for authentication and authorization, right? I guess it's awkward that those two related but different concepts share the same first 4 letters. But I think authc would have been clearer for disambiguation than authn.

deleted 3y ago
[deleted]
DylanSp 3y ago
Yes, that's what they're short for.
dv_dt 3y ago
I wish it were authi and authp for identity and permissions
sublinear 3y ago
authn/autho are much clearer in my opinion
- sanderjd 3y ago
  Yep, "authn" is good because it sounds like the first two syllables of "auth-en-ti-ca-tion". I now agree with you that "autho" would have been better for the same reason. Although "authz" sounds cooler :)
- jerf 3y ago
  In one of my crazy experimentation repos I played with just dropping the confusing "auth" portion, leaving "orization" and "entication". I don't know that those exact terms are a winner, though they did work quite effectively for me, but I think dropping the "auth" bit has some promise in the general sense. Leaving the redundant and confusing part at the beginning and lowering the disambiguation down to one letter seems like the wrong direction, no matter what the one letter is.
  - sublinear 3y ago
    The ambiguity of just "auth" is useful when describing it at a higher level. I can say "auth service" and it's well understood, even to the user, that service identifies them and determines their permissions.
- tomjakubowski 3y ago
  good ol' auth'n 'n' autho'
dragonwriter 3y ago
It would be even clearer if we just called them “identity” and “access” (or “permission”) instead of abbreviating longer terms with a common prefix. And we kind of do, in other (but closely related) contexts; e.g., the common cloud systems for managing both are “identity and access management systems" not “authentication and authorization management systems”. (Though, yes, “access" sometimes means something else; nothing is perfect.)
tptacek 3y ago
"Authn" and "authz" have over the last 10 years become the standard terms of art in software security for distinguishing between identification controls and access management controls, so whatever other terminology one might want to use --- authc, AAA, whatever --- you should probably keep authn and authz in your resident set.

by mcv 3y ago

deleted 3y ago

[deleted]

DylanSp 3y ago

Yes, that's what they're short for.

dv_dt 3y ago

I wish it were authi and authp for identity and permissions

sublinear 3y ago

authn/autho are much clearer in my opinion

sanderjd 3y ago
Yep, "authn" is good because it sounds like the first two syllables of "auth-en-ti-ca-tion". I now agree with you that "autho" would have been better for the same reason. Although "authz" sounds cooler :)
jerf 3y ago
In one of my crazy experimentation repos I played with just dropping the confusing "auth" portion, leaving "orization" and "entication". I don't know that those exact terms are a winner, though they did work quite effectively for me, but I think dropping the "auth" bit has some promise in the general sense. Leaving the redundant and confusing part at the beginning and lowering the disambiguation down to one letter seems like the wrong direction, no matter what the one letter is.
- sublinear 3y ago
  The ambiguity of just "auth" is useful when describing it at a higher level. I can say "auth service" and it's well understood, even to the user, that service identifies them and determines their permissions.
tomjakubowski 3y ago
good ol' auth'n 'n' autho'

dragonwriter 3y ago

It would be even clearer if we just called them “identity” and “access” (or “permission”) instead of abbreviating longer terms with a common prefix. And we kind of do, in other (but closely related) contexts; e.g., the common cloud systems for managing both are “identity and access management systems" not “authentication and authorization management systems”. (Though, yes, “access" sometimes means something else; nothing is perfect.)

tptacek 3y ago

"Authn" and "authz" have over the last 10 years become the standard terms of art in software security for distinguishing between identification controls and access management controls, so whatever other terminology one might want to use --- authc, AAA, whatever --- you should probably keep authn and authz in your resident set.