RE: Request for comments on security of authentication/authorisation UIs

Hey Steve!

Hi Allan,

Thanks for reaching out about this. Speaking from a design point of
view, having a more rigorous security model is something that we are
extremely interested in at the moment, and this is something that
Wayland has an obvious part to play in. There are also other
technologies that will be needed, of course, particularly in relation
to application sandboxing.

I'm afraid we don't currently have a clear plan for how all the pieces
will fit together, but we do have ideas and are looking to develop a
concrete plan for the UX in the near future.

One does one keep informed about this? Where do I sign up?

One relevant area is
sharing [1], as the UX mechanism through which it is possible to share
data between applications.

Interesting. It seems these UIs play a specific goal though, maybe better coined
as "Publishing" to specific destinations made compatible one by one. There are
many different models for how an app may process the user's data and how you could
combine apps. I've been trying to think of sandboxing in terms that don't involve
me having to figure out / describe / support these models at all but there is a
lot of research to do to find the right approach to data sharing for sandboxed apps.
There isn't a single existing product I'm happy with, but this is maybe off-topic
for now (very happy to discuss it elsewhere though).

I think that, in general, we'd like to
avoid Android-esque lists of permissions - since people tend not to
read these at install time, and you really want to know what apps are
trying to do in practice rather than giving blanket permissions
upfront. At the same time, we want to avoid dialog overload - we don't
want there to be so many authentication dialogs that it becomes



Agreed on both points!

PhD student in Information Security
University College London
Dept. of Computer Science
Malet Place Engineering, 6.07
Gower Street, London WC1E 6BT
OpenPGP : 1B6B1670

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]