Development-led security vs administration-led security in a software product?

Question

There are cases where you have the opportunity, as a developer, to enforce stricter security features and protections on a software, though they could very well be managed at an environmental level (ie, the operating system would take care of it).

Where would you say you draw the line, and what elements do you factor in your decision?

Concrete Examples

User Management is the OS's responsibility

Not exactly meant as a security feature, but in a similar case Google Chrome used to not allow separate profiles. The invoked reason (though it now supports multiple profiles for a same OS user) used to be that user management was the operating system's responsibility.

Disabling Web-Form Fields

A recurrent request I see addressed online is to have auto-completion be disabled on form fields. Auto-completion didn't exist in old browsers, and was a welcome feature at the time it was introduced for people who needed to fill in forms often. But it also brought in some security concerns, and so some browsers started to implement, on top of the (obviously needed) setting in their own preference/customization panel, an autocomplete attribute for form or input fields. And this has now been introduced into the upcoming HTML5 standard. For browsers that do not listen to this attribute, strange hacks^* are offered, like generating unique IDs and names for fields to avoid them from being suggested in future forms (which comes with another herd of issues, like polluting your local auto-fill cache and not preventing a password from being stored in it, but instead probably duplicating its occurences).

In this particular case, and others, I'd argue that this is a user setting and that it's the user's desire and the user's responsibility to enable or disable auto-fill (by disabling the feature altogether). And if it is based on an internal policy and security requirement in a corporate environment, then substitute the user for the administrator in the above.

I assume it could be counter-argued that the user may want to access non-critical applications (or sites) with this handy feature enabled, and critical applications with this feature disabled. But then I'd think that's what security zones are for (in some browsers), or the sign that you need a more secure (and dedicated) environment / account to use these applications.

^{* I obviously don't deny the ingeniosity of the people who were forced to find workarounds, just the necessity of said workarounds.}

---

Questions

That was a tad long-winded, so I guess my questions are:

• Would you in general consider it to be the application's (hence, the developer's) responsiblity?
• Where do you draw the line, if not in the "general" case?

---

^{This is cross-posted from Programmers StackExchange, based on a moderator's comment.}

Answer 1

The dilemma is not specific to security, but security makes it easier to solve (although not in a philosophically satisfactory way).

Consider the Web browser Firefox. It is very self-contained. For instance, it has its own cryptographic layer, with its own storage of private keys and handling of certificates and SSL implementation and list of trust anchors. Similarly, Firefox has its own settings for proxies. On the other hand, both Internet Explorer and Chrome delegate quite a lot to the operating system in those areas. This is a trade-off: that which is delegated to the OS needs not be reimplemented, BUT this brings the OS configuration into the picture and can add constraints.

For instance, when we want to add some smartcard support to the browser, the relevant driver must be installed in the OS (in the Windows world, a "Cryptographic Service Provider") but this is not sufficient for Firefox, which also needs its own driver (a PKCS#11 DLL). The Firefox way then increases complexity and administration costs. On the other hand, if I set a proxy in Chrome, I set it system-wide and it impacts all other applications; whereas with Firefox, I can set it for Firefox only, which is more flexible; e.g. if I want to observe the behaviour of my Web server when connections come from distinct IP, I would like to run several browsers concurrently, some of which using SOCKS proxies -- I cannot do that with Chrome (unless I use VMs), I need Firefox for that.

So the dilemma is mostly about balancing flexibility with complexity. Firefox is an operating system in its own right, which makes it quite portable, but requires specific administration. Now how does security comes into that ? When we say "security", we often think "blame" (by this 'we' I mean 'most managers'). This solves the dilemma: if, as a developer, I have the choice between trusting the OS to do his job, or doing it myself, then I cannot be blamed for choosing the latter, even if it increases costs wildly.

As I said, this is highly unsatisfactory, but the dilemma is solved. It is even socially admitted that a hired developer refuses to do the job altogether if he feels it to be "unsafe". Whereas delegating to the OS, for security matters, is felt as bold and audacious, and somehow risky, and, as a developer, this had better work and never be hinted at introducing security issues, because otherwise the bold developer will become a bold scapegoat. Woe to him who dares not sharing the ambient paranoia !

^{(The argument above can be turned into an argument for the integration of the browser into the OS, which is what Microsoft does with IE.)}

Answer 2

Your question is too broad to give a clear answer. The only answer I can possibly imagine is: "it depends".

Generally speaking, if you have an application-specific security property, then the application is going to need to enforce it and implement the security functionality. On the other hand, if you have a system-wide property that you want to be enforced on all applications, then it it might need to be enforced in the operating system or some other lower level. But the details of the specific situation are likely going to determine the right answer.

The situation with autocomplete is not really driven by some debate over security by developers vs by administrators. It is a specific situation, that arose due to other factors; if you would like to know more about how the web developed that way, please ask a separate question. But make sure to frame it carefully: a question about what browsers "should" do is likely to be too subjective to make a good question. And if you find yourself arguing in the question about what you think is the right thing to do, maybe this site is not really the best fit for the question -- try to avoid anything with any hint of a rant and focus on technical questions that have a technical answer, or where the answers can be backed up by evidence or analysis.

As a reminder, per the FAQ, questions should be about a specific, concrete situation you are facing. This is not a discussion forum. So, what is the actual problem you are facing? A question about a single, specific dilemna where this arose would be on-topic; but asking about "development-led vs administration-led security" (whatever that means) in general is just too broad.