2

I learned that in authorization there are some things to keep in mind, there are:

  • Authorization Creep this happens when an employee switch roles and the previous authorization isnt removed.
  • Default to Zero
  • Need to Know Principle to limit information to someone that not need to know of the information
  • Access Control List is a list of permissions attached to an object. An ACL specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects.

I have tried to search what "Default to Zero" means on this, but I can't find it. What does default to zero in this context mean?

1

1 Answer 1

0

It appears to be "default to zero privileges, unless proven otherwise".

E.g. writing code like:

access_flags = NONE
if password_match:
    access_flags.add(ACCESS_USER)

Instead of:

access_flags = ACCESS_ADMIN + ACCESS_USER
if not password_match:
    access_flags.remove(ACCESS_USER)

Reason being that it's easier to make (and exploit) mistakes in latter code. In the above example, latter code would still leave ADMIN privileges if passwords don't match.

4
  • could you please explain to me the differences of !password_match() and password_match, access_flags |= ACCESS_USER and &= !ACCESS_USER?
    – Vlanzyvinz
    Nov 9, 2016 at 17:05
  • rewritten pseudo code to be more english-like. clearer?
    – domen
    Nov 9, 2016 at 17:18
  • oh, then that means before adding new access, we set the flags to zero first like on the first pseudo code?
    – Vlanzyvinz
    Nov 9, 2016 at 17:25
  • 1
    I interpret it to start with zero access/privileges/permissions, and then add the appropriate on authentication.
    – domen
    Nov 9, 2016 at 17:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .