UBNS requires a mechanism for (1) authentication of users over
the network and (2) allowing server processes to change the user
on whose behalf they execute. Implementing the cryptographic
mechanisms for user authentication as part of the application is
complex and error prone, and as we showed, requires a
substantial amount of code. Moving the authentication and
cryptographic mechanisms outside the application makes the
application independent of these mechanism, and application
programmers are usually not skilled in this area. Moreover, the
OS mechanisms for change of process ownership are also dangerous
as such privileges are among the strongest in a computer system,
since changing a user typically allows the privileges of any
user to be appropriated. And hence, programmers typically defer
such considerations, ignoring them during initial design. But
UBNS affects the very structure of programs and when its
consideration is delayed, it becomes increasingly expensive to
retrofit. Thus many applications will