2

I learned that in authorization there are somethings to keep in mind, there are:

-Authorization Creep this happens when an employee switch roles and the previous authorization isnt removed.
-Default to Zero
-Need to know Principle to limit information to someone that not need to know of the information
-Access Control List is a list of permissions attached to an object. An ACL specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects.

I have tried to search what is Default to Zero means on this, but I cant find it.
What does default to zero in this context means?

1
0

It appears to be "default to zero privileges, unless proven otherwise".

E.g. writing code like:

access_flags = NONE
if password_match:
    access_flags.add(ACCESS_USER)

Instead of:

access_flags = ACCESS_ADMIN + ACCESS_USER
if not password_match:
    access_flags.remove(ACCESS_USER)

Reason being that it's easier to make (and exploit) mistakes in latter code. In the above example, latter code would still leave ADMIN privileges if passwords don't match.

6
  • could you please explain to me the differences of !password_match() and password_match, access_flags |= ACCESS_USER and &= !ACCESS_USER? – Vlanzyvinz Nov 9 '16 at 17:05
  • rewritten pseudo code to be more english-like. clearer? – domen Nov 9 '16 at 17:18
  • oh, then that means before adding new access, we set the flags to zero first like on the first pseudo code? – Vlanzyvinz Nov 9 '16 at 17:25
  • I interpret it to start with zero access/privileges/permissions, and then add the appropriate on authentication. – domen Nov 9 '16 at 17:28
  • 1
    Don't accept answer so quickly. Normally you should give it a day or two, otherwise you'll discourage other people from answering. – domen Nov 9 '16 at 17:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.