Even in DC, Authentication is a Guess

Florida Congresswoman hangs up on Obama twice (story):

For Florida Republican Rep. Ileana Ros-Lehtinen, the voice on her cell phone sounded eerily familiar.

“He sounded just like Obama,” she said on Thursday, referring to President-elect Barack Obama.
Sensing she was the victim of a spoof by a South Florida radio station, she promptly disconnected the call.

Trouble was, it was Obama.

A chagrined Ros-Lehtinen told the Fox News Channel that she also hung up on Obama’s chief of staff, Rahm Emanuel, when he called her back to explain it really was the next president on the line.

Both Emanuel and Obama tried to convince her the call was for real.

“Guys, it’s a great prank, really,” she said she told them.

It took a subsequent call from California Democratic Rep. Howard Berman, chairman of the House Foreign Affairs Committee, to finally convince Ros-Lehtinen to talk to Obama.

To convince her that it really was Berman, she said she told him, “Give me the private joke that we share.”

This underscores a point that I make in training, which is that at design time you must separate your authentication logic from your authorization logic. At runtime they are frequently combined, but at design time its crucial to realize that authentication is a guess, and authorization is a memory; or if you prefer you can think of it as authentication is a mystery and authorization is a puzzle. 

In the authorization case you have all the assertions at hand and need to render a decision, in the authentication case you need to piece together your guess at the reality of the situation and then bind to the principal (which becomes the assertion). Confusing or conflating the two separate functions leads to all sorts of problems.

Comments

[Richard Veryard]

If you don't know whether the caller is a president or a radio prankster, the best thing to do is to find things to say that fit both contexts.

Like if a caller asks for information about your products, and you suspect it might be a competitor, then you give him a bit of information (in case it is a real customer) but not too much.

I think the task of security in such cases is not to select (and bind to) the most likely reality, but to detect the possibility of impersonation and produce a low-risk response that fits any of the possible realities.