Timeline for Who is responsible for the strength of user's passwords?
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 23, 2011 at 16:24 | comment | added | Mike Samuel | @this.josh, There are fine-grained mechanisms available in the security literature. For example, ocaps provides trust boundaries at the object level. | |
| Aug 23, 2011 at 8:17 | comment | added | this.josh | I think what you are describing is the lack of intuitive fine resolution mechanisms to protect information that is shared unequally amongst people. Current popular mechanisms have course resolution and boundries convenient to computer systems instead of people. Those boundries are file, directory, hardware component, process, user account, computer system, subnet, subdomain, domain, etc. | |
| Aug 23, 2011 at 1:45 | comment | added | Mike Samuel |
@this.josh, Yep. The value of a credential is proportional to the total authority it provides, both that invested in the credential holder, and in systems that delegate authority to the credential holder. In the PATH case, the problem arises because a shell-user delegates (via execvp) authority to files in a compromised directory, and in the code repo case, the exploit occurs because critical systems delegate (via code loaders) authority to compromised source files.
|
|
| Aug 23, 2011 at 1:31 | comment | added | this.josh | Interesting points to think about. It seems to conform to the rule that your security should be proportional the the value of the assets protected by that security. | |
| Aug 22, 2011 at 20:52 | history | edited | Mike Samuel | CC BY-SA 3.0 |
fixed typo
|
| Aug 22, 2011 at 18:53 | history | edited | Mike Samuel | CC BY-SA 3.0 |
added link
|
| Aug 22, 2011 at 18:47 | history | edited | Mike Samuel | CC BY-SA 3.0 |
moved link to first use
|
| Aug 22, 2011 at 18:07 | history | edited | Mike Samuel | CC BY-SA 3.0 |
added 93 characters in body
|
| Aug 22, 2011 at 17:53 | history | answered | Mike Samuel | CC BY-SA 3.0 |