4 ms·

Computer science solved this problem (the "Confused Deputy" [1]) decades ago [2] [3] with capability-based security [4]. I don't have the time to find the exac

Computer science solved this problem (the "Confused Deputy" [1]) decades ago [2] [3] with capability-based security [4]. I don't have the time to find the exact reference I'm thinking of right now, but consider taking a look at one of the papers that give a background to CapDesk [5]: > Which addresses, among other things: > "All Windows and Unix operating systems (referred to as “Winix” hereafter) utterly disregard the concept of POLA [Principle of Least Authority]. When you launch any application—be it a $5000 version of AutoCAD fresh from the box or the Elf Bowling game downloaded from an unknown site on the Web—that application is immediately and automatically endowed with all the authority you yourself hold. Such applications can plant Trojans as part of your startup profile, read all your email, transmit themselves to everyone in your address book using your name, and can connect via TCP/IP to their remote masters for further instruction. This is, candidly, madness." [6] Since then, things have changed slightly - UAC under Windows, for instance, means applications now only have the ability to steal and hold your highly valuable and personal documents for ransom, but hey at least these sneaky trojans don't have admin rights! Which is of course the exact scenario that Cryptolocker happily exploits. There's really no reason a piece of junk attached to your email application should execute any more authority than you explicitly grant it. (And no that doesn't require clicking a bunch of buttons to "Allow" access -- intelligent UI design can make much of this completely transparent, provided the host platform is capability-based.) It's not that companies like Microsoft aren't well aware of capability-based security [7], it just seems to be that the appetite isn't there to really solve user's problems (breaking stuff like the Start Menu appears to be more important), despite the valiant efforts of some really smart people [8]. To be fair, shifting to a capability-based system would be a significant engineering effort, but definitely well within the realms of Microsoft or Apple's capabilities. (Interestingly, some of the ideas on erights.org were influenced by Nick Szabo, who created "Bit gold" and who a few people think might be Nakamoto himself [though he denies it] [9]) [1a] http://www.cis.upenn.edu/~KeyKOS/ConfusedDeputy.html http://www.cis.upenn.edu/~KeyKOS/ConfusedDeputy.html [1b] http://erights.org/elib/capability/deputy.html http://erights.org/elib/capability/deputy.html [2] http://www.cis.upenn.edu/~KeyKOS/Gnosis/Gnosis.html http://www.cis.upenn.edu/~KeyKOS/Gnosis/Gnosis.html [3] http://www.cis.upenn.edu/~KeyKOS/Key370/Key370.html http://www.cis.upenn.edu/~KeyKOS/Key370/Key370.html [4a] http://www.skyhunter.com/marcs/capabilityIntro/index.html http://www.skyhunter.com/marcs/capabilityIntro/index.html [4b] http://erights.org/elib/capability/3parts.html http://erights.org/elib/capability/3parts.html [5] http://www.combex.com/papers/index.html http://www.combex.com/papers/index.html [6] http://www.combex.com/tech/edesk.html http://www.combex.com/tech/edesk.html [7] http://research.microsoft.com/en-us/projects/singularity/ http://research.microsoft.com/en-us/projects/singularity/ [8] http://en.wikipedia.org/wiki/Capability-based_security http://en.wikipedia.org/wiki/Capability-based_security [9a] http://erights.org/related.html http://erights.org/related.html [9b] http://unenumerated.blogspot.com/2011/05/bitcoin-what-took-ye-so-long.html http://unenumerated.blogspot.com/2011/05/bitcoin-what-took-y...

toyg 13y ago
>(And no that doesn't require clicking a bunch of buttons to "Allow" access -- intelligent UI design can make much of this completely transparent, provided the host platform is capability-based.) I think that's actually a bigger problem than you make it out to be. Probably because people involved in this particular field tend to be dismissive of "lusers" and "marketing", it seems to me that almost every security tool out there has terrible UI. Just think of GPG, something we know we should be using since, uh, the 90s? and still nobody really does, because even just managing keys is a total pain in the neck. UAC? "Oh, I'll just click Yes all the time". Mobile apps asking for extremely-granular permission to marry your firstborn child? "Yeah, I'm sure they don't really need it, whatever". Building secure systems is hard, but building secure systems that users will use in a secure way without having to think about it is much harder, IMHO.
ufmace 13y ago
This sounds a lot like how Android does security - each app requests a specific list of permissions at install time, and you can either accept or reject it. That, and the apps being signed to prevent tampering, and by default can only be installed from the Play store. I think Android security has proven to be pretty solid - there have been a few spyware apps, mostly killed quickly, but nothing that was able to spread on it's own like the big desktop viruses. One thing that I'd like to see added that Android doesn't seem to have right now is a more limited Internet permission. Right now, apps have to either request full permission to send and receive anything on the internet, or no connection at all. Why not a permission to communicate only with specific domain names? Like Evernote can request permission to only communicate with addresses resolved from evernote.com, instead of anything on the internet. It might also have the effect of pushing apps to use the Android ad API instead of their own.
- derekp7 13y ago
  Only problem is that I don't know of anyone that examines that list of permissions, and will reject an app if those permissions seem to much. How is a regular user to know if it is bad for an app to access your phone book, or internet connection? Depending on the app, this may be necessary for the app to function. Or for it to serve ads. What is needed, is for trusted third parties to verify if a given list of permissions is needed, and give (via a security software add-on) a popup with an assessment of how safe it is to install that app -- green, yellow, or red, for example. That is about the only thing that most end users (and even busy geeks) can really comprehend.

toyg 13y ago

>(And no that doesn't require clicking a bunch of buttons to "Allow" access -- intelligent UI design can make much of this completely transparent, provided the host platform is capability-based.) I think that's actually a bigger problem than you make it out to be. Probably because people involved in this particular field tend to be dismissive of "lusers" and "marketing", it seems to me that almost every security tool out there has terrible UI. Just think of GPG, something we know we should be using since, uh, the 90s? and still nobody really does, because even just managing keys is a total pain in the neck. UAC? "Oh, I'll just click Yes all the time". Mobile apps asking for extremely-granular permission to marry your firstborn child? "Yeah, I'm sure they don't really need it, whatever". Building secure systems is hard, but building secure systems that users will use in a secure way without having to think about it is much harder, IMHO.

ufmace 13y ago

This sounds a lot like how Android does security - each app requests a specific list of permissions at install time, and you can either accept or reject it. That, and the apps being signed to prevent tampering, and by default can only be installed from the Play store. I think Android security has proven to be pretty solid - there have been a few spyware apps, mostly killed quickly, but nothing that was able to spread on it's own like the big desktop viruses. One thing that I'd like to see added that Android doesn't seem to have right now is a more limited Internet permission. Right now, apps have to either request full permission to send and receive anything on the internet, or no connection at all. Why not a permission to communicate only with specific domain names? Like Evernote can request permission to only communicate with addresses resolved from evernote.com, instead of anything on the internet. It might also have the effect of pushing apps to use the Android ad API instead of their own.

derekp7 13y ago
Only problem is that I don't know of anyone that examines that list of permissions, and will reject an app if those permissions seem to much. How is a regular user to know if it is bad for an app to access your phone book, or internet connection? Depending on the app, this may be necessary for the app to function. Or for it to serve ads. What is needed, is for trusted third parties to verify if a given list of permissions is needed, and give (via a security software add-on) a popup with an assessment of how safe it is to install that app -- green, yellow, or red, for example. That is about the only thing that most end users (and even busy geeks) can really comprehend.