Authentication is not authorization Nice piece in The Register that points out the difference between authentication and authorization and explains why Microsoft's recent moves with regards to HailStorm should not be interpreted as any sort of Redmond concession. As I pointed out about six months ago, if the locus of control moves from the hardware (authentication) to the user (authorization) then it does not matter what OS the system runs on. .NET is a gigantic authorization infrastructure controlled by Microsoft.