Title: RE: [xacml] Proposed semantics for operations involving INDETERMI NATE
They may have it presented the same way for the user - but in this case the equivalent of a PEP is the shell, I think. Is not it? Logging facilities and the shell do have this information - then they have a choice how to present it.. That's what I thought - PEP has a choice how to present information to the end client, but it still knows the distinction of what happened in PDP. At least, I would guess that even in this systems, if you examine the system logs you will find different records.
I was talking about having protocol available between PDP and PEP as it
does have use for several variations of recombination algorithms and for
PDP clustering. How it is presented to the end client - is not it a choice done by an application? They may choose to behave the same for GRANT and DENY as well - this is out of the scope of the XACML protocol..
-----Original Message-----
From: Anne Anderson - Sun Microsystems
To: xacml
Sent: 7/24/02 7:55 AM
Subject: RE: [xacml] Proposed semantics for operations involving INDETERMI NATE
"Daniel Engovatov" <> wrote:
>Completely disagree. Every single security system differentiates
between,
>say, "incorrect password" and "service not available".
OSF DCE, Apollo Domain, and HP-UX all are very careful NOT to make any
distinctions (I've worked on lots of other systems, but not recently
enough to speak with reliance on my memory). The systems I've worked
with
even introduce intentional delays so that a user
can't tell whether a login attempt failed due to invalid user name,
invalid password, some service not available, etc. This is to avoid
leaking any information that might help an attacker. Login either
succeeds or it fails, and the time it takes to get a response is the
same
in either case.
Anne Anderson
Internet Security Research Group, Sun Labs
Sun Microsystems, Inc., Burlington, MA
----------------------------------------------------------------
To subscribe or unsubscribe from this elist use the subscription
manager: <http://lists.oasis-open.org/ob/adm.pl>
