technoweenie / restful-authentication
watch download tarball
public
Forks232Right
Watchers2181Right
Description: Generates common user authentication code for Rails/Merb, with a full test/unit and rspec suite and optional Acts as State Machine support built-in.
Homepage: http://weblog.techno-weenie.net
Clone URL: git://github.com/technoweenie/restful-authentication.git
Click here to lend your support to: restful-authentication and make a donation at www.pledgie.com !
restful-authentication / notes / Trustification.txt
100644 50 lines (33 sloc) 1.337 kb
raw blame history 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

See also
* "Trustlet Wiki":http://www.trustlet.org/wiki
 
Potential Ingredients for a trust metric
 
h2. Reputation
 
* Web of trust
* Reputation systems
** Akismet, Viking, etc.
 
* prove_as_human Completing a 
* validate_email
 
  logged_in
  akismet, etc.
  session duration
 
h2. Accountability
 
Does the person tied to this identity stand to lose or gain anything based on this action?
 
 
h2. Past history
 
* past history
** we can revisit past trust decisions based on revised trust estimates
* recency of errors (reduce trust on an application exception)
 
h2. Commitment
 
* are_you_sure -- ask for con
* willingness to pay a "hate task" (compute big hash) a la Zed Shaw
* send_me_one_cent a micropayment
** shows commitment
** secondary validation from payment system
** offsets rist
 
h2. Identity Binding
 
* Stale sessions
  bq. "If your application allows users to be logged in for long periods of time
  ensure that controls are in place to revalidate a user’s authorization to a
  resource. For example, if Bob has the role of “Top Secret” at 1:00, and at
  2:00 while he is logged in his role is reduced to Secret he should not be able
  to access “Top Secret” data any more." -- http://www.owasp.org/index.php/Guide_to_Authorization
 
* how I authenticated: for instance, 'logged in by cookie' << 'logged in by password'