The Confused Deputy¶
Hardy, N. (1988). The Confused Deputy: (or why capabilities might have been invented). ACM, 22(4), 36-38.
Cited by¶
11 citations across 11 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Access Control
This sourceOrigin of the confused-deputy problem, motivating capability-based authority; bibliography-only (cited in tension T4 prose without a FACT marker — verified existence and linked).
- Confused Deputy
- When an action passes through an intermediary, its effective authority should be the intersection of the caller's authority and the intermediary's — the action is permitted only if both the originator and the executor were entitled to it.
This sourceOrigin of the confused-deputy concept (the compiler-billing example) and the capability-based remedy of carrying the originator's authority with the request.
- When an action passes through an intermediary, its effective authority should be the intersection of the caller's authority and the intermediary's — the action is permitted only if both the originator and the executor were entitled to it.
- Data-Control Plane Breach
- Naive analyses of injection attacks, social engineering, viral infection, and brood parasitism treat each as a substrate-specific failure — the parser was wrong, the user was gullible, the immune system was overwhelmed, the bird is foolish — and so miss what unifies them.
This sourceFoundational statement of the confused-deputy structure: a correctly-functioning program is induced to wield its own authority on behalf of a less-privileged caller because data (a file path) is acted on as control — the canonical data-as-control unification underlying injection-style breaches.
- Naive analyses of injection attacks, social engineering, viral infection, and brood parasitism treat each as a substrate-specific failure — the parser was wrong, the user was gullible, the immune system was overwhelmed, the bird is foolish — and so miss what unifies them.
- Indirection
- Information Use License
- The defect is invisible at every individual hop and visible only in the composite, which is why it surfaces late, in the hands of a party that did nothing wrong, and traces to no single bad decision.
This sourceShows authority composed across individually valid steps producing an action no principal intended to authorise, the defect being invisible at each step and visible only in the composite.
- The defect is invisible at every individual hop and visible only in the composite, which is why it surfaces late, in the hands of a party that did nothing wrong, and traces to no single bad decision.
- Untrusted Input Execution
- The transferred and non-obvious lesson is constant across substrates: a correctly-functioning interpreter is not a defense, so effort spent making the interpreter "smarter" about its inputs or harder to authenticate is misdirected, and the only durable fixes act on the boundary or the authority — which is why the capability-based fix proposed in 1988 reappears, structurally identical, as object capabilities, OAuth scopes done correctly, prepared-statement parameter binding, sealed content roles, and signed authority chains
This sourceIntroduces the confused-deputy problem and the capability-based fix that re-attaches the originator's authority so effective authority is the intersection, not the union — the 1988 fix that recurs structurally identical across substrates.
- The transferred and non-obvious lesson is constant across substrates: a correctly-functioning interpreter is not a defense, so effort spent making the interpreter "smarter" about its inputs or harder to authenticate is misdirected, and the only durable fixes act on the boundary or the authority — which is why the capability-based fix proposed in 1988 reappears, structurally identical, as object capabilities, OAuth scopes done correctly, prepared-statement parameter binding, sealed content roles, and signed authority chains
Domain-specific¶
- Cross-Site Scripting
- That mechanism genuinely recurs as co-instances across distinct interpreters — SQL injection (the database query parser), command injection (the shell), log injection, template injection, and prompt injection in LLMs (the model as interpreter) — and it shares a parent with the classical confused-deputy attack Hardy described, in which a program with no interpreter at all acts on a caller-supplied designation using authority of its own rather than the caller's
This sourceSupplies the confused-deputy limb this sentence closes on — a Tymshare compiler that 'serves two masters and carries some authority from each ... has no way to keep them apart', acting on a caller-supplied designation with authority of its own and no interpreter anywhere in the picture — but not the injection co-instances listed alongside it.
- That mechanism genuinely recurs as co-instances across distinct interpreters — SQL injection (the database query parser), command injection (the shell), log injection, template injection, and prompt injection in LLMs (the model as interpreter) — and it shares a parent with the classical confused-deputy attack Hardy described, in which a program with no interpreter at all acts on a caller-supplied designation using authority of its own rather than the caller's
Mechanisms¶
- Access Control List
- The classic misuse is the confused deputy
This sourceShows how an ACL-protected compiler can be induced by its caller to exercise the compiler’s own authority against a protected file.
- The classic misuse is the confused deputy
- Authentication Broker
- And a broker that acts on ambient authority can be turned into a confused deputy
This sourceShows how a caller can exploit a privileged program's ambient authority, inducing it to exercise that authority for a purpose the caller could not authorize directly.
- And a broker that acts on ambient authority can be turned into a confused deputy
- Confused-Deputy Abuse-Case Test
- The name points at the classic failure it hunts: the deputy that is not compromised, just confused about whose will it is serving.
This sourceShows an uncompromised deputy misapplying authority because it cannot distinguish which principal’s authority governs a request.
- The name points at the classic failure it hunts: the deputy that is not compromised, just confused about whose will it is serving.
Verification¶
This reference passed the adversarial substantiation pipeline: it was checked to exist and to support the claim it is attached to. See how references were verified.
Registry ID ref:5f5a3412bb12 · see in the full table