[ghnws]

Having two almost identical terms that mean completely different things is not a very good idea. Also here you are explaining what the words mean, when "login" and "permission" are immediately obvious. Most people don't speak english natively either.

[nulbyte]

If you think two different words having different meanings is difficult, wait 'til you hear about contranyms! English is full of words like these, where context is needed to understand the meaning.

If something is fast, it moves quickly or not at all. Cocktails can be garnished, but so can wages. Sales or trade of a product could be sanctioned by one country, but sanctioned by another.

I generally think it is a good thing to communicate clearly. Sometimes that means using words differently to explain something. Other times, that means using words the same way as others. I think this is a case of the latter.

Also, I think the idea of "native speaker" is a bit of a red flag. There are plenty of people that speak English from birth but are utterly unintelligible, and there are plenty of people that speak English as a second language who speak more clearly than those.

[thfuran]

>wait 'til you hear about contranyms! English is full of words like these, where context is needed to understand the meaning.

It is, unfortunately, possible for more than one thing to be bad at a time.

[matt-attack]

When I'm at a restaurant and I don't see anything I like, I just order something "off the menu".

When I'm at a restaurant and I like everyone I see, I order something "off the menu".

[JadeNB]

Something can be held fast, but I don't think it is usual English to say that something fixed is fast.

Garnishment of wages is garnisheeing, though here I'll agree "garnishing" seems to be acceptable too.

[BobaFloutist]

Sanction and nonplus are the most insane examples, because sometimes it's literally not possible to figure out from the context which of the two opposite meanings is intended.

[janalsncm]

> Also, I think the idea of "native speaker" is a bit of a red flag

I assume you mean “red herring”. Red flag just means a sign that something is wrong.

[krakrnews]

I sanction this comment.

[4death4]

I don’t really consider making an API call as “logging in”. The term sounds really out of place other than in a few specific contexts.

[Too]

The term “Identify” is a lot better in this regard.

It’s already universally used in IAM, where the other half of the puzzle is also clear and free from ambiguity: “Access”.

[rwoerz]

Indeed. "Logging in" implies some kind of long lasting session. And logging in conceptually only requires "identification" (e.g. via a username) but not necessarily "authentication" (e.g. via a password)

[jagged-chisel]

IMO…

To “log in” is to convert the username/password pair (or API key, or whatever) into a smaller token with an expiration. Doesn’t matter of it’s put in a cookie in my browser, held in memory by some other API client, etc.

Aside: Why bother even doing that? Because every time you transmit the credential, there’s the possibility of leaking. We would rather leak the token that has an expiration.

[mistercow]

The wild thing is that they’re apparently from different etymologies. “Authorization” comes from “auctor” in Latin, meaning “leader” or “author”, whereas “authentication” originally comes from the Greek “auto” meaning “self”. There probably was some cross influence that brought them into line though.

[lupire]

I'm going to call IAM "Classics", with "Latin" for identity and "Greek" for access.

[mepiethree]

I don’t think they are almost identical, they just have the same prefix. “Login” and “permission” each have the same problem: “login” is very similar to “logging”, and “permission” shares a prefix with “persistence” (or permanent). Ultimately software engineering is a broad enough field that we will necessarily have to use similar words to describe the many, many concepts

[pjerem]

The issue is that they have the same prefix AND that unfortunately this prefix is used to abbreviate both words.

What does the "auth" module ?

[bigyikes]

Not a good analogy.

“Permission” and “persistence” have the same prefix but entirely different semantics. They also occur more commonly in everyday life.

AuthN and AuthZ are similar in in spelling, appear in similar contexts, and are less colloquial, making the distinction a lot less clear.

There’s a reason many junior devs use them interchangeably without knowing better.

[croes]

But authentication and authorization are often used in the same context where confusion is lethal.

[inopinatus]

"login" refers to the record of access¹, not the access itself, so it is more properly associated with audit. This dates from the early days² of time-sharing systems when you didn't need a password, you were just saying hi to the computer.

__________

[1] Derived from the signing of a ship's logbook³ when coming aboard.

[2] A few decades ago.

[3] The logbook originally⁴ recorded navigational data and is named for instruments measuring speed through water⁵, of which the simplest is literally throwing roped wooden logs off the stern and counting the knots on the line paying out per interval⁶.

[4] Doubtless some bright-eyed young hornblower with a glittering future career as an admiralty archivist realised that log-structured records could be generalised usefully to all timestamped event and measurement capture, which is why your syslog is full of crap.

[5] Consequently any vessel, maritime or otherwise, measures its speed through the medium in knots. The Enterprise NCC-1701-D, for example, tops out ca.146 megaknots under impulse engine.

[6] It follows by transitive etymology that you may use the term "knots" to edify and delight your colleagues when referring to the rate of creation of user sessions.

[joemi]

offtopic, but: I think when your footnotes themselves need footnotes, there's probably a clearer way to write what you wanted to write. Jumping through multiple levels of nested footnotes is fairly hard to read, at least for me.

[bru]

That's because they share the same root auto-, i.e. "self". Because they're related concepts...

[yencabulator]

Apparently not.

> “Authorization” comes from “auctor” in Latin, meaning “leader” or “author”

https://news.ycombinator.com/item?id=40493073

[bigstrat2003]

> Most people don't speak english natively either.

This is a problem with only one solution: continue to improve one's skill with the language. You can't solve this by choosing different terms, because then something else will be the "this is confusing to non-native speakers" hangup. You can whack those moles until the day you die and you'll never get them all.

[jknoepfler]

I disagree. To authenticate something is to challenge it to prove its identity. Authentication is much broader in scope than "login," even within the narrow domain of computer science. JWT signing, domain certs and so forth fall under the "authN" header and use the same cryptographic tools and techniques... even many forms of user authN don't have a "login" flow.

Why would we choose "login" - which is more of a special case than the norm to describe something we already have a precise term for?

[ehnto]

If words being similar is truly an issue we would have vastly different languages.

Related words for related concepts is very normal, and if you are a professional in this space it's the least we can do to recognize the difference. We aren't astronauts, we have the time to figure it out.

Language learners already learned a second language, they have the skills to figure this out. At least it's not a homonym.

[popalchemist]

Most people literally do speak English

https://www.google.com/search?q=most+popular+language+in+the...

but the rest of your point is dead on.

[amrangaye]

Sorry I don’t understand - the link you posted shows that “most people” actually speak mandarin and Spanish?

[voxelghost]

'permission' might be ok, but 'login' is very imprecise and much more ill defined than authenticate.

[chipdart]

> Having two almost identical terms that mean completely different things is not a very good idea.

What's the problem of telling apart the task of authenticating users from authorizing their access?

There's already identification and authorization (IAM) which is mostly a backronym.

[swombat]

Identification & Authorisation are a better pairing here than Authentication and Authorisation.

This way, if someone says "Oh yeah we have an auth module on this site" you don't need to immediately disambiguate the statement.

But then "auth" itself is ambiguous. So it might make sense to get rid of the lot. "Identification" is a good word for the first. Perhaps "Permissions" for the second?

[Spooky23]

In the case of “auth”, it stands for two related but often separately managed operational processes.

From an end user perspective, auth is the problem. Users can’t determine what is login vs permission. If non native speakers can’t handle the distinction, it’s a valuable lesson to learn.

[funcDropShadow]

Login is not obvious. A login is usual a process step before the main part of the process. That does not fit to an API call which is authenticated using a token.

[renegade-otter]

Well, in that case, we are all going to have to talk about the difference between a "product manager" and a "project manager" ;)

[gtirloni]

what's the difference between login and logon?

[interbased]

I believe “login” is the process of actually logging in, or the set of credentials used to log in. “Logon” refers to the act of connecting to something. They’re often used interchangeably, though.

[kenjackson]

Except then I won't be able to flip the bozo bit on people who confuse authentication for authorization in conversation...

[rockemsockem]

You're saying that they are almost identical because they share the first 4 letters.... That's a pretty low bar.