Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There are cases where you have the opportunity, as a developer, to enforce stricter security features and protections on a software, though they could very well be managed at an environmental level (ie, the operating system would take care of it).

Where would you say you draw the line, and what elements do you factor in your decision?

Concrete Examples

User Management is the OS's responsibility

Not exactly meant as a security feature, but in a similar case Google Chrome used to not allow separate profiles. The invoked reason (though it now supports multiple profiles for a same OS user) used to be that user management was the operating system's responsibility.

Disabling Web-Form Fields

A recurrent request I see addressed online is to have auto-completion be disabled on form fields. Auto-completion didn't exist in old browsers, and was a welcome feature at the time it was introduced for people who needed to fill in forms often. But it also brought in some security concerns, and so some browsers started to implement, on top of the (obviously needed) setting in their own preference/customization panel, an autocomplete attribute for form or input fields. And this has now been introduced into the upcoming HTML5 standard. For browsers that do not listen to this attribute, strange hacks* are offered, like generating unique IDs and names for fields to avoid them from being suggested in future forms (which comes with another herd of issues, like polluting your local auto-fill cache and not preventing a password from being stored in it, but instead probably duplicating its occurences).

In this particular case, and others, I'd argue that this is a user setting and that it's the user's desire and the user's responsibility to enable or disable auto-fill (by disabling the feature altogether). And if it is based on an internal policy and security requirement in a corporate environment, then substitute the user for the administrator in the above.

I assume it could be counter-argued that the user may want to access non-critical applications (or sites) with this handy feature enabled, and critical applications with this feature disabled. But then I'd think that's what security zones are for (in some browsers), or the sign that you need a more secure (and dedicated) environment / account to use these applications.

* I obviously don't deny the ingeniosity of the people who were forced to find workarounds, just the necessity of said workarounds.


Questions

That was a tad long-winded, so I guess my questions are:

  • Would you in general consider it to be the application's (hence, the developer's) responsiblity?
  • Where do you draw the line, if not in the "general" case?

This is cross-posted from Programmers StackExchange, based on a moderator's comment.

share|improve this question
    
@D.W.: hmmm, I may have misunderstood the comment then, but it linked to a question on cross-posting, where the accepted answer is not to do it, but other answers mentioned acceptable cases. I assumed that's what the mod meant. I could attempt to rephrase it to make it more on focus here though. –  haylem Sep 16 '12 at 8:03
    
@D.W. That's almost always the case. This time around, moderators from Programmers talked with me and we found ourselves in a crux that answers from here might be better, but answers over there might reach an audience they'd be more useful to. This is thus the rare encouraged cross-post. We may migrate & merge later, but since StackExchange doesn't let mods link questions across sites, this our hack for the meantime. –  Jeff Ferland Sep 17 '12 at 1:16
    
I apologize for being negative, but I confess it's not clear to me exactly what is being asked here. The question talks about application-enforced security vs OS-enforced security; developers vs sysadmins; and user responsibility vs OS responsibility. Those are 3 different topics. It might help to revise the question to pick just one and be clear about what question is being asked. (The 2 examples didn't help me; I believe they were driven by other factors, not by any of the topics raised in the question, so they felt like a bit of a non sequitor to me.) –  D.W. Sep 17 '12 at 8:14
    
@D.W.: no need to apologize, I perfectly understand your point. I'll delete the question for now. –  haylem Sep 17 '12 at 12:40
    
@D.W.: ah, I can't. Well, I'll definitely need to re-write it then. Sorry. –  haylem Sep 17 '12 at 12:41

2 Answers 2

The dilemma is not specific to security, but security makes it easier to solve (although not in a philosophically satisfactory way).

Consider the Web browser Firefox. It is very self-contained. For instance, it has its own cryptographic layer, with its own storage of private keys and handling of certificates and SSL implementation and list of trust anchors. Similarly, Firefox has its own settings for proxies. On the other hand, both Internet Explorer and Chrome delegate quite a lot to the operating system in those areas. This is a trade-off: that which is delegated to the OS needs not be reimplemented, BUT this brings the OS configuration into the picture and can add constraints.

For instance, when we want to add some smartcard support to the browser, the relevant driver must be installed in the OS (in the Windows world, a "Cryptographic Service Provider") but this is not sufficient for Firefox, which also needs its own driver (a PKCS#11 DLL). The Firefox way then increases complexity and administration costs. On the other hand, if I set a proxy in Chrome, I set it system-wide and it impacts all other applications; whereas with Firefox, I can set it for Firefox only, which is more flexible; e.g. if I want to observe the behaviour of my Web server when connections come from distinct IP, I would like to run several browsers concurrently, some of which using SOCKS proxies -- I cannot do that with Chrome (unless I use VMs), I need Firefox for that.

So the dilemma is mostly about balancing flexibility with complexity. Firefox is an operating system in its own right, which makes it quite portable, but requires specific administration. Now how does security comes into that ? When we say "security", we often think "blame" (by this 'we' I mean 'most managers'). This solves the dilemma: if, as a developer, I have the choice between trusting the OS to do his job, or doing it myself, then I cannot be blamed for choosing the latter, even if it increases costs wildly.

As I said, this is highly unsatisfactory, but the dilemma is solved. It is even socially admitted that a hired developer refuses to do the job altogether if he feels it to be "unsafe". Whereas delegating to the OS, for security matters, is felt as bold and audacious, and somehow risky, and, as a developer, this had better work and never be hinted at introducing security issues, because otherwise the bold developer will become a bold scapegoat. Woe to him who dares not sharing the ambient paranoia !

(The argument above can be turned into an argument for the integration of the browser into the OS, which is what Microsoft does with IE.)

share|improve this answer
    
"if, as a developer, I have the choice between trusting the OS to do his job, or doing it myself, then I cannot be blamed for choosing the latter, even if it increases costs wildly.". Could be blamed for failing to do it properly AFTER having increased the costs widly though, as there's a decent probability you won't even get it right. Thanks for your answer. –  haylem Sep 16 '12 at 22:22

Your question is too broad to give a clear answer. The only answer I can possibly imagine is: "it depends".

Generally speaking, if you have an application-specific security property, then the application is going to need to enforce it and implement the security functionality. On the other hand, if you have a system-wide property that you want to be enforced on all applications, then it it might need to be enforced in the operating system or some other lower level. But the details of the specific situation are likely going to determine the right answer.

The situation with autocomplete is not really driven by some debate over security by developers vs by administrators. It is a specific situation, that arose due to other factors; if you would like to know more about how the web developed that way, please ask a separate question. But make sure to frame it carefully: a question about what browsers "should" do is likely to be too subjective to make a good question. And if you find yourself arguing in the question about what you think is the right thing to do, maybe this site is not really the best fit for the question -- try to avoid anything with any hint of a rant and focus on technical questions that have a technical answer, or where the answers can be backed up by evidence or analysis.

As a reminder, per the FAQ, questions should be about a specific, concrete situation you are facing. This is not a discussion forum. So, what is the actual problem you are facing? A question about a single, specific dilemna where this arose would be on-topic; but asking about "development-led vs administration-led security" (whatever that means) in general is just too broad.

share|improve this answer
    
+1 for a developed answer. Though we may have missed each other's point. I don't need to learn much about why the autocomplete feature (for this example) evolved this way as I know very well about it, but the fact that it exists gives the opportunity for this debate to occur. The system-wide vs app-wide approach is indeed a good decisional angle I think, but the problem is that it's kind of a "perfect scenario". Apps meant to be used one way or in one context may be requested by only a few customers to be used in a different context. That's where, as a developer, I DO need to debate it. –  haylem Sep 16 '12 at 8:16
    
The reason being, I need to worry about the use of software in both the general case and this specific case (if known in advance: can't plan for things that just "may" happen with no data backing up its probability, it's a waste of resources), because there's a trade-off in terms of usability. I agree my question is not clearly stated and is in a "it depends" area at the moment, but I'm having a hard-time formulating in a way that doesn't drive answers one way or another. Working on that. –  haylem Sep 16 '12 at 8:19
    
@haylem - "the fact that it exists gives the opportunity for this debate to occur" - Well, Security.SE is not intended for debates. Debates are off-topic on this site. –  D.W. Sep 17 '12 at 8:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.