Repository navigation
docs(f3): owner-only is an authority, and an authority is not a proof - #107
Merged
Merged
Conversation
F3-R39 closed the sheet a reader mints for themselves. The same screen exists one account further out: the owner sets a partner's password and mints a partner's recovery sheet, and both were gated on being the owner and nothing else. Owner-only is a property of the session, so a session in the wrong hands carries it whole. The ceiling is higher than F3-R39's, too: the partner changing their own password retires neither write, because one of them set that password and the other issues the codes that reset it. F3-R40 asks for the owner's own account password. It has to be the owner's rather than the partner's — the partner's credential is not available to the surface that replaces it, which is the reason that surface exists, and the partner is not at the device to consent, which is the premise. What is being exercised is the owner's authority, so the thing to prove is that the owner is present. Proof matches the authority being used, not the credential being rewritten. Spec: F3-R40 Signed-off-by: Wessel Verheij <info@nightworks.io>
lessevv
enabled auto-merge (squash)
September 13, 2026 09:27
|
github-actions
Bot
added
the
awaiting-maintainer
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
F3-R39closed the sheet a reader mints for themselves. The same screen exists one account further out: the owner sets a partner's password and mints a partner's recovery sheet, and both were gated on being the owner and nothing else.Owner-only is a property of the session, so a session in the wrong hands carries it whole. The ceiling is higher than
F3-R39's, too: the partner changing their own password retires neither write, because one of them set that password and the other issues the codes that reset it.F3-R40asks for the owner's own account password. It has to be the owner's rather than the partner's — the partner's credential is not available to the surface that replaces it, which is the reason that surface exists, and the partner is not at the device to consent, which is the premise. What is being exercised is the owner's authority, so the thing to prove is that the owner is present. Proof matches the authority being used, not the credential being rewritten.The implementation PR in
beatraxcites this id and follows.Spec: F3-R40