3 ms·
That's not really what the confused deputy problem is about. Instead, a confused deputy has too much authority, and is being asked to "switch hats" and pretend
by bascule 11y ago
That's not really what the confused deputy problem is about.
Instead, a confused deputy has too much authority, and is being asked to "switch hats" and pretend to have the authority of a user/caller.
Confused deputies arise because they don't have a clear picture of what the authority of the user/caller actually is, and accidentally expose some authority that the user/caller wasn't supposed to have.
Capabilities let you model this authority as a first-class principle.
- Retric 11y agoIn principle that's true, but let's consider something like auto run when inseting a USB or CD etc. When auto run means full user permissions to run any program that's a huge security issue. If on the other hand auto run is specifically a dialog box based on the device format that's a much smaller security issue. The point being if you give an app permission to add a charge to a bill and only add a charge to a bill then the fact a user can increase there bill in an arbitrary fashion is still a problem, but it's a smaller one than letting them delete all charges.