Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Tangent: "When designing a security system, regardless of purpose or protocol, you need to think of authentication and authorization separately. Authentication securely verifies that the client is who it claims to be, but does not grant any permissions. After the successful authentication, authorization decides whether or not the client can perform a specific action."

These two operations are often abbreviated "authn" (for autheNtication) and "authz" (for authoriZation) in security frameworks.



In fact, we use a lot the terms authn, authz, authnz and AAA at Facebook. :-)


When I was doing security work, AAA stood for "authorization, authentication and audit"


The last one was also known as "accounting."


But not referred to in the article, which I found surprising since they're such common terms for those in the know. :)


How confusing for those of us in British English countries!

(or should I say 'confuzing'? :p )




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: