3 ms·

Capability security doesn't prevent data leakage and lateral movement, especially in today's age of "identity based security". A compromised application would

Capability security doesn't prevent data leakage and lateral movement, especially in today's age of "identity based security". A compromised application would most likely still be running with a privileged identity, giving it access to databases etc.

mikewarot 3y ago
There is no such thing as "privileged identity" in a capabilities based operating system. When you open a document, the application ONLY gets a handle to that document, and nothing else. It certainly can't just then open a pipe to a server somewhere and dump all your documents to it, unlike any random program these days.
- JohnMakin 3y ago
  You've never heard of the confused deputy problem? Yes in your perfect world that shouldn't be possible. However, the real world is complicated.
  - mikewarot 3y ago
    Yes, I have.... quoting Wikipedia[1] From Wikipedia, the free encyclopedia In information security, a confused deputy is a computer program that is tricked by another program (with fewer privileges or less rights) into misusing its authority on the system. It is a specific type of privilege escalation.[] The confused deputy problem is often cited as an example of why capability-based security is important. Capability systems protect against the confused deputy problem, whereas access-control list–based systems do not.[] [1] https://en.wikipedia.org/wiki/Confused_deputy_problem https://en.wikipedia.org/wiki/Confused_deputy_problem
    - JohnMakin 3y ago
      I guess that you missed in my parent comment that this type of security in practice is extraordinarily difficult to implement correctly and I've seen confused deputy privilege escalation issues in pretty much every system I've ever come across. Do you have any examples of someone doing it correctly? Otherwise you're just sort of no-true-scotsman'ing this and I have no interest in engaging that.
      - dwb 3y ago
        I don't have an opinion on this matter as I don't think I'm qualified (though I am interested in capability-based systems), but your comment is unclear to me: have you had significant experience in a capability-based system?
      - mikewarot 3y ago
        Every system you've worked on is likely an ACL based system, which is why the confused deputy problem was in play. I don't have any experience with capability based OSs, because you can't get one as a daily driver... yet. I do have plenty of real world experience with capabilities, though.... cash in a wallet is an economic capability. Circuit Breakers are an electrical version of capabilities. Virtual Machines are a low resolution version of capabilities. The whole point is to limit side effects before they happen. --- Back in the 1980s before we had hard drives, a 2 floppy DOS machine was an excellent capabilities based system.... you could only corrupt the data on un-write protected diskettes in the system. Thanks to this fact, and the ease of backing up boot disks, we routinely bought/shared/copied dozens, sometimes hundreds of diskettes full of programs from everywhere, just to see if we liked them. In perfect safety. People don't know what they're missing these days. Eventually, I'll have Genode's Sculpt OS[1] as my daily driver, and I'll be able to just run things, once again, without worry. No more virus scanners, worry about clicking on the wrong attachment, or a bad PDF, etc. [1] https://genode.org/download/sculpt https://genode.org/download/sculpt
- e12e 3y ago
  You don't have a camera phone, then?
  - mikewarot 3y ago
    Smartphones DO NOT implement capability based security, they implement permission flags, which suck, and only confuse the issue.
    - e12e 3y ago
      I meant to take a picture of the read-not-print document on your secure laptop.
      - mikewarot 3y ago
        "Read not print" documents are an aberration before the eyes of The Lord. If you want to hand a process only the document, and not a handle to the printer, that's fine... but that's your choice, not that of the the operating system, and certainly NOT the creator of the document. DRM is un-Holy, and definitely NOT part of Capability Based Security. There are some really weird beliefs in this world thanks to ambient authority and DRM.
        e12e 3y ago
        I was referring to: > When you open a document, the application ONLY gets a handle to that document, and nothing else. It certainly can't just then open a pipe to a server somewhere and dump all your documents to it, unlike any random program these days.
        mikewarot 3y ago
        My comment was in the context of a Capabilities Based secure OS. Once you have read-access to a document, you can copy it, and do almost anything else you want with it, it's your choice, and the OS will enforce that choice. DRM and "View but don't allow print" are both completely incompatible with Capabilities based OSs (but you could run a Windows VM on it, and that could have "DRM" in its internal state)

mikewarot 3y ago

There is no such thing as "privileged identity" in a capabilities based operating system. When you open a document, the application ONLY gets a handle to that document, and nothing else. It certainly can't just then open a pipe to a server somewhere and dump all your documents to it, unlike any random program these days.

JohnMakin 3y ago
You've never heard of the confused deputy problem? Yes in your perfect world that shouldn't be possible. However, the real world is complicated.
- mikewarot 3y ago
  Yes, I have.... quoting Wikipedia[1] From Wikipedia, the free encyclopedia In information security, a confused deputy is a computer program that is tricked by another program (with fewer privileges or less rights) into misusing its authority on the system. It is a specific type of privilege escalation.[] The confused deputy problem is often cited as an example of why capability-based security is important. Capability systems protect against the confused deputy problem, whereas access-control list–based systems do not.[] [1] https://en.wikipedia.org/wiki/Confused_deputy_problem https://en.wikipedia.org/wiki/Confused_deputy_problem
  - JohnMakin 3y ago
    I guess that you missed in my parent comment that this type of security in practice is extraordinarily difficult to implement correctly and I've seen confused deputy privilege escalation issues in pretty much every system I've ever come across. Do you have any examples of someone doing it correctly? Otherwise you're just sort of no-true-scotsman'ing this and I have no interest in engaging that.
    - dwb 3y ago
      I don't have an opinion on this matter as I don't think I'm qualified (though I am interested in capability-based systems), but your comment is unclear to me: have you had significant experience in a capability-based system?
    - mikewarot 3y ago
      Every system you've worked on is likely an ACL based system, which is why the confused deputy problem was in play. I don't have any experience with capability based OSs, because you can't get one as a daily driver... yet. I do have plenty of real world experience with capabilities, though.... cash in a wallet is an economic capability. Circuit Breakers are an electrical version of capabilities. Virtual Machines are a low resolution version of capabilities. The whole point is to limit side effects before they happen. --- Back in the 1980s before we had hard drives, a 2 floppy DOS machine was an excellent capabilities based system.... you could only corrupt the data on un-write protected diskettes in the system. Thanks to this fact, and the ease of backing up boot disks, we routinely bought/shared/copied dozens, sometimes hundreds of diskettes full of programs from everywhere, just to see if we liked them. In perfect safety. People don't know what they're missing these days. Eventually, I'll have Genode's Sculpt OS[1] as my daily driver, and I'll be able to just run things, once again, without worry. No more virus scanners, worry about clicking on the wrong attachment, or a bad PDF, etc. [1] https://genode.org/download/sculpt https://genode.org/download/sculpt
e12e 3y ago
You don't have a camera phone, then?
- mikewarot 3y ago
  Smartphones DO NOT implement capability based security, they implement permission flags, which suck, and only confuse the issue.
  - e12e 3y ago
    I meant to take a picture of the read-not-print document on your secure laptop.
    - mikewarot 3y ago
      "Read not print" documents are an aberration before the eyes of The Lord. If you want to hand a process only the document, and not a handle to the printer, that's fine... but that's your choice, not that of the the operating system, and certainly NOT the creator of the document. DRM is un-Holy, and definitely NOT part of Capability Based Security. There are some really weird beliefs in this world thanks to ambient authority and DRM.
      - e12e 3y ago
        I was referring to: > When you open a document, the application ONLY gets a handle to that document, and nothing else. It certainly can't just then open a pipe to a server somewhere and dump all your documents to it, unlike any random program these days.
        mikewarot 3y ago
        My comment was in the context of a Capabilities Based secure OS. Once you have read-access to a document, you can copy it, and do almost anything else you want with it, it's your choice, and the OS will enforce that choice. DRM and "View but don't allow print" are both completely incompatible with Capabilities based OSs (but you could run a Windows VM on it, and that could have "DRM" in its internal state)