On Mon, 25 Mar 2013 22:19:53 -0400, David Lamb <
dal...@cs.queensu.ca>
wrote:
Lately, definitions seem to be a can of worms around here. We could
analyze what the word "authorize" means (outside of
technical/computing terminology). Then we could go down the road of
"well here's what it means to _________" (fill in the blank with any
one person, group of people in a given industry, etc.
I think what matters for purpose of this thread is the context I was
using for the term when I talked about Steam using authorization
rather than DRM, because that was the meaning that John was attempting
to counterargue.
That context was the generally accepted meaning in computing, which is
basically "verifying a user is who they say they are". That does not
mean necessarily that the user has given a real name or true
identifying information, it just means that if I have registered with
a service under the name John Doe, then that service authorizes me
when I log on using some unique password that proves I am John Doe
(even if I'm not really John Doe). The term is usually used to
identify the "credential identification" portion of a login sequence
or other type of check, and to differentiate it from "authorization"
(the two terms are often confused or used incorrectly).
In other words, authentication is "Who's there? Lets see some ID.."
and authorization is "Ok John Doe, we've confirmed you're who you say
you are, here's what you have access to based on your permission set".
When you enter a serial key into an application to "unlock it",
"activate it" (i.e. allow the player to play it), that process is
really authorization (and usually called serial key authorization),
because it is not about identifying a users credentials or logging
them into to a session for some entity (although admittedly it could
be combined with that, as it is for some Steam games with serial
keys), because it is basically authorizing that computer (not person)
to play the game.
I believe Steam is a somewhat pure example of authentication, because
it's really all about identifying the account holder. The company
that sells/produces the games sold on Steam are who decides how it is
authorized, whether DRM is involved, etc. Steam is just verifying you
are who you say you are (arguably you could still be anonymous
although that typically changes the moment you give them a credit
card, a somewhat "more accurate" form of authentication). A game
company can release a completely free to play game on Steam; in that
case, anyone can play from any account and any PC, thus there is
really no authorization in that case. A company can also sell a game
that is restricted to one paid copy per account (Steam has handled the
authentication, but the seller of the game is handling authorization).
They could also go one step further and add DRM, which can do things
like restrict how many PC's total the app can be installed on.
Some folks think Steam itself *is* the DRM mechanism but it's not. Can
it be utilized if the game publisher chooses to help enforce DRM?
Surely, but by itself Steam only authenticates.