96 karma · joined April 15, 2018
"Authentication" is "is the entity is who it says it is?"
"Entity logging in" is an example of authentication. Is the entity trying to log in the entity it claims to be? An example claimed identity is a username, and example proof of authentic claim is a correct password.
"Entity trying to read data" is an example of authorization. Does the entity trying to read the data have permission to read that data? Checking an access control list against a username is an example of checking authorization.
How are they different, and separate?
I claim to be a user and supply a password. My claim is authenticated and I successfully log in. I have requested access to zero resources and thus no authorization has occurred.
A hacker steals my session while I'm logged in and requests my sensitive data. The system sees the request came from a username that is on the access control list for the resource and authorizes the hacker to see my data. No check on my actual identity (authentication) occurred, only a check whether the provided identity is authorized.
This article is pretty frustrating. Another reason for this effect, and one I've always thought true, is that using nouns in English is often more circuitous, using more "fillers" like prepositions to convey the same idea, thus softening or obfuscating the harshness of the meaning communicated.
In other words, they don't seem to prove that nouns cause this effect, but that English's use of nouns causes this effect.
"The machine at the bottom of your consciousness is a strange loop. Having a look at this strange loop is a lot more fun than reading about it."
Awesome. Great style and expectation-setting in the intro portion. From my perspective as a programmer, occasional Vipassana-practicer, and not-speed-reader, and having read only the intro portions, this has piqued my interest enough to sink time into reading.