Instead of "auth", we should say "permissions" and "login"

Re:Instead of "auth", we should say "permissions" and "login" by OvbiousError on Monday May 27, 2024 @03:44PM (#40493939)

For me as a non-native English speaker, "authorize" and "authenticate" are always pretty unclear as to what exactly they mean in a security context. I don't use it enough for it to stick. I'll actually try to remember "login" and "permissions" as shorthand for getting a feel of what they are. And yes, I've never dug deep in security code/systems, but doesn't that make this even more of a problem instead of less. I should be able to understand what these concepts by themselves want to achieve without having a deep understanding of the technical details or coming into contact with it on a regular basis.

[ Parent | on HN ]

Re:Instead of "auth", we should say "permissions" and "login" by oreilles on Monday May 27, 2024 @03:49PM (#40494004)

Think of it in a real life context instead of a software context. Let's say you want to go inside a building and there's a bouncer at the entry. By presenting him your ID, he'll be able to authenticate you (determine who you are). Only then, will he decide to authorize you in, or not - depending of your right to do so.

[ Parent | on HN ]

Re:Instead of "auth", we should say "permissions" and "login" by deanishe on Monday May 27, 2024 @05:38PM (#40495000)

The problem here, I think, is the words, not the concepts.

Like remembering when it's spelled "stationary" and when "stationery".

"Still" and "paper" are easier to remember.

[ Parent | on HN ]

Re:Instead of "auth", we should say "permissions" and "login" by kaashif on Monday May 27, 2024 @08:59PM (#40496339)

Stationery means more than just paper. I don't think there are any good synonyms for stationery, it's the only word with that exact meaning.

Same problem when someone wants to substitute "login" for "authenticate" - not synonyms.

[ Parent | on HN ]

Re:Instead of "auth", we should say "permissions" and "login" by barrkel on Monday May 27, 2024 @06:35PM (#40495414)

The problem is the similarity of the words, not understanding the concepts.

[ Parent | on HN ]

Re:Instead of "auth", we should say "permissions" and "login" by Control8894 on Tuesday May 28, 2024 @01:53AM (#40497733)

Is it? Or is the problem the similarity of the concepts?

[ Parent | on HN ]

Re:Instead of "auth", we should say "permissions" and "login" by numpad0 on Tuesday May 28, 2024 @07:10AM (#40499515)

imo it's stupid notion that authentication and authorizations are completely different concepts that were infuriatingly given similar spellings.

We give oranges and apples those distinct sounds, while giving blueberries and strawberries very similar names. It's just makes no sense that we should change the latter two so no one mixes them up trying to sprinkle some on yogurt.

[ Parent | on HN ]

Re:Instead of "auth", we should say "permissions" and "login" by barrkel on Monday May 27, 2024 @06:34PM (#40495410)

They're so unclear that HTTP error codes got them confused. 401 Unauthorized usually actually means Unauthenticated, while 403 Forbidden means Unauthorized.

I'm a native speaker and I need to pause for a few hundred milliseconds just to be sure I'm using the right one in a sentence.

[ Parent | on HN ]

Re:Instead of "auth", we should say "permissions" and "login" by Jensson on Tuesday May 28, 2024 @12:45AM (#40497402)

> Unauthorized usually actually means Unauthenticated

What does "unauthenticated" even mean here? You aren't logged in, not logged in isn't a state of "unauthenticated", you haven't given any credentials meaning currently you don't have any authority, so unauthorized makes sense. You can have several sets of credentials and switch between them, not giving them any isn't being in an unauthenticated state its a different thing, and using "unauthorized" in that case makes sense.

[ Parent | on HN ]

Re:Instead of "auth", we should say "permissions" and "login" by Control8894 on Tuesday May 28, 2024 @01:51AM (#40497719)

> What does "unauthenticated" even mean here?

That you're not logged in.

> You aren't logged in, not logged in isn't a state of "unauthenticated"

What? Yes it is.

> you haven't given any credentials meaning currently you don't have any authority, so unauthorized makes sense

Ok? Yes, if you are unauthenticated (and authentication is required), then you are also unauthorized. However, the error code is not communicating that you are unauthorized; it is communicating that you need to authenticate, thus unauthenticated is more appropriate.

> You can have several sets of credentials and switch between them

Ok?

> not giving them any isn't being in an unauthenticated state its a different thing

That is exactly what being in an unauthenticated state means. What would you define to be an unauthenticated state otherwise?

[ Parent | on HN ]

Re:Instead of "auth", we should say "permissions" and "login" by RiverCrochet on Tuesday May 28, 2024 @07:06AM (#40499476)

While we're at it, let's change 404 from "file not found" to "nothing here." The stream thrown back at you in response to an HTTP request is often not really a file.

[ Parent | on HN ]

Re:Instead of "auth", we should say "permissions" and "login" by dbsmith83 on Tuesday May 28, 2024 @10:33AM (#40501110)

Unix would like a word (file) with you :)

[ Parent | on HN ]

Re:Instead of "auth", we should say "permissions" and "login" by withinboredom on Tuesday May 28, 2024 @10:51AM (#40501277)

401 may or may not be unauthenticated, but it doesn't necessarily mean that. It just means that you do not have the authority to do whatever you were trying to do. A 401 implies that you need to gain authority to do what you want to do and try again[1].

A 403 means that it is simply forbidden. You cannot gain the authority to do what you want to do[2] and has nothing to do with credentials, no matter how nicely you ask.

For example, getting a project in your organization may return 401 (simply ask an admin for access), while getting a project in a different organization may return a 403 (you cannot get access to other organizations, ever).

1: https://www.rfc-editor.org/rfc/rfc9110#name-401-unauthorized

2: https://www.rfc-editor.org/rfc/rfc9110#name-403-forbidden

[ Parent | on HN ]

Re:Instead of "auth", we should say "permissions" and "login" by clwg on Monday May 27, 2024 @08:39PM (#40496234)

I think of them like this: Authentication is the act of verifying that you are who you say you are, generally with something you know (password) and ideally with something you have (token, authenticator app, etc.). This lets you log in.

Once you log in, you are granted authorization for certain tasks. This could be rights to an individual record or column, or it could be administrative privileges within an app. It's not involved in determining who you say you are; it authorizes you to access things based on who you are (from the act of authenticating).

That's the way I understand those two terms and their practical applications.

[ Parent | on HN ]