hah! i figured out what's different about user-capability: faking the credential has a known cost.
here's an early example of user-capability security: penelope saying she'll marry whoever can string her missing husband odysseus's bow. she was able to know not only that none of the men likely to vie for her hand could string it, but that none of them could become strong enough to string it within a short time-frame (hopefully long enough for odysseus to return).
one could as well simply ask users to pay a fixed fee to be authenticated. in fact, i bet casinos do some version of this somewhere... and atm enclosures have locks that open if you produce any card with a mag stripe, thereby proving that you have a card with a mag stripe and so might be a customer.
cryptographers do make calculations based on the cost of breaking their systems by brute force. but that assumes there's no flaw in the algorithm. with user-capability authentication, there is no flaw in the algorithm: what you see is what you get. so calculations of how difficult it is to duplicate the authentication ought to be straightforward.
![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png)
branchandroot
no subject
Date: 2008-12-11 05:00 am (UTC)here's an early example of user-capability security: penelope saying she'll marry whoever can string her missing husband odysseus's bow. she was able to know not only that none of the men likely to vie for her hand could string it, but that none of them could become strong enough to string it within a short time-frame (hopefully long enough for odysseus to return).
one could as well simply ask users to pay a fixed fee to be authenticated. in fact, i bet casinos do some version of this somewhere... and atm enclosures have locks that open if you produce any card with a mag stripe, thereby proving that you have a card with a mag stripe and so might be a customer.
cryptographers do make calculations based on the cost of breaking their systems by brute force. but that assumes there's no flaw in the algorithm. with user-capability authentication, there is no flaw in the algorithm: what you see is what you get. so calculations of how difficult it is to duplicate the authentication ought to be straightforward.