3 ms·
Or use the industry standard AuthN, AuthZ nomenclature?
by candiddevmike 2y ago
Or use the industry standard AuthN, AuthZ nomenclature?
- jedberg 2y agoThe article addresses this. They aren't universal enough and when sound out loud they sound the same, and there are no verb forms.
- candiddevmike 2y agoThey aren't universal because folks like the article author keep trying to make fetch happen. Authentication, Authorization, and Accounting (AAA) are bedrock security concepts. They sound fine out loud, and I have no idea why a verb form would be a requirement for an abbreviation.
- DowagerDave 2y ago>> They aren't universal enough Yes, we need a NEW standard: https://xkcd.com/927/ https://xkcd.com/927/
- jedberg 2y agoThe beauty of this proposal is that it isn't a new standard -- it's suggesting that we use the already existing words and stop using the less understood acronyms.
- verdverm 2y agoauthn/z are more abbreviations than acronyms, which come with less organization or domain specific required knowledge, which is the typical complaint of acronyms
- kube-system 2y ago> there are no verb forms Authenticate. Authorize.
- alephxyz 2y agoAuthentify is also valid but obviously leads to even more confusion
- kazinator 2y agoNever heard of it. Just don't use the "auth" contraction for "autorization". Only for authentication. Or not at all. The system state which grants access to a resource based on a user's credentials is "permissions". Authentication is the process of establishing belief in the user's credentials. Authorization is the human assigned permission to a resource which may or may not be reflected by permissions. Incorrectly set permissions can allow unauthorized access to a resource. E.g. if /etc/shadow is accidentally made rw-r--r--, that doesn't mean everyone is authorized to access the password hashes. Doing so may still violate the organization's IT policy.