Subject: [iucg] authentification vs. authorisation

From: JFC Morfin <[email-masked]>
Date: Sat, 21 Feb 2009 22:13:42 +0100

Je poursuis sur l'appel à l'IESG de Douglas Otis and Dave Rand au sujet de
la confusion entre authentification et autorisation. Quelqu'un voudrait-il
monter une page sur le wiki de l'IUCG pour réunir des positions pratiques
d'utilisateurs ?

"The Authentication-Results draft is responsible for omitting the input
provided the authorization mechanism.  It is not the authorization mechanism
itself that is responsible for the omission.

"The goal of the appeal is to better ensure information is available that is
required to assess the reputation of the "authenticated origin identity" as
specified by section 4.1.  The presence of this information will not be of
harm to recipients, and will better ensure their safety as well as that of
the domain.  The issue is only whether to display or not the results of this
header at the MUA after checking the reputation of its source.  In order to
perform this check, the "authenticated origin identity" must be clearly
represented in the trusted headers.

"The IESG faces the hard decision of whether they are to act in the greater
interests of better protecting millions of recipients, or acquiesce to the
interests of influential providers acting out of self interest."

Si nous ne nous prenons pas par la main, nous aurons l'internet des
commerciaux américains.
jfc