Wouldn’t capability based security just bring you the current situation on mobile phones where most users simply approve access as they have no clue what is being asked, nor do they have real alternatives?
Furthermore, capabilities are more fine-grained. Today an app will ask for your location and you get to choose yes/no. If you say yes, it has full access to the GPS forever until revoked, sometimes in the background. Give it network access and it has that forever as well, and it can send anything to anyone (including the GPS data you just gave it access to.)
Capability based security would allow you to give it access to the GPS for a limited time, or to give it access to a sensor spoofing service if it really needs that data. If you give it network access it would be for certain times, or it could only send data to a whitelist of servers.
Moreover you can restrict the app from sharing granted capabilities to other apps. Or vice versa, you can delegate apps to work on your behalf and share capabilities with other apps, which you can later centrally revoke or restrict.
It’s really a better security regime than what the major operating systems have ossified around.
And lest you think you can work around this by rooting your phone, an increasing number of actually useful apps refuse to run on rooted devices, "because security", and Google is actively helping this by making available an API that streamlines those checks.
Capability-based security is a good idea, but like all security technology, it only helps the owner of a device, and who is the owner of a device in any given context is a contested topic, with platforms, vendors, manufacturers and users all having a different opinion about it.
Sure, we all want that, but we’ve learned that trusting apps does not scale. Even if you like an app and trust it, it can be updated to break that trust. Capability based security puts you in control so you don’t have to rely on trust.
> But it shouldn’t be able to send that image to a destination unrelated to my use case.
Capability based security could do this, and you don’t have to trust anyone to implement that feature for you (or to not silently remove it via an update). You would create a capability that would require camera and network access. Any app that needs both resources could take such a capability and be restricted in where it can send photos.
https://www.youtube.com/watch?v=kFRy4IwUNog
Phones do not do capability based security, they could, but they OS doesn't offer that as a possibility, we get the low rent knock-off imitation instead.
We keep layering more and more gloop on the web. It will always be a game of wack-a-mole.
It's like Windows requires TPM, but then gives itself permission to snoop at your files. Or we have oauth, but then github is cracked to reveal the private keys. And so on and so forth, etc. ad nauseam. The clowns at Microsoft, Facebook and Google simply can't be trusted. They've proven that time and time again.
Security is better obtained "via negativa" (to quote from Taleb). Be parsimonious in what you allow. Keep things simple. If you don't really need security, then don't have it.
Phones don't do capability based security. There's no way to say, here... you can have access to THIS photo, or this location, once, in an easy way.
On PCs, you have to trust the application to do what it says when it uses the system supplied dialog boxes to "open" files, etc. In a capability based system, that's not the case. The OS never trusts the application, ever.
"Give X permission to access Y forever" is not capability based security.