<html>
<body>
At 08:01 PM 9/17/2007, Dean Tribble wrote:<br><br>
<br>
<blockquote type=cite class=cite cite="">On 9/17/07, <b>Ka-Ping Yee</b>
<<a href="mailto:cap-talk@zesty.ca">cap-talk@zesty.ca</a>>
wrote:<br>
<dl>
<dd>... Users do not always<br>
<dd>predict the consequences of their actions correctly; there are
two<br>
<dd>ways we can address this:<br><br>
<dd> 1. Change the system model to fit the mental
model.<br><br>
<dd> 2. Change the mental model ( i.e. educate users)
to fit the system.<br><br>
</dl><br>
One should also add:<br><br>
3. where possible, minimize the impact of a bad grant.<br><br>
4. where feasible, recover and/or repair the consequences of a bad grant
after revocation <br><br>
Occasional bad grants are inevitable, whether through ignorance or
misbehavior of someone who had been "trusted". Making
POLA choices to enable or simplify 3 and 4 is interesting to
consider.</blockquote><br>
I believe mechanisms that support revocation in an understandable way
(e.g. the Horton identity based mechanism) can also help in this area (#3
and #4).<br>
<x-sigsep><p></x-sigsep>
--Jed
<a href="http://www.webstart.com/jed-signature.html" eudora="autourl">
http://www.webstart.com/jed-signature.html</a></body>
</html>