What is the relation between abstraction and security?

[chaitanya karthikk]

Hi all, my name is Chaitanya. I was interviewed recently on java. The interviewer asked me a question, "What is the advantage of abstraction?".

I said that "abstraction is hiding the implementation details. Suppose that we have an abstract class with an undefined method and a child class is extending the abstract class, inturn another class is extending the child class. The programmer need not know at which level of hierarchy the method is implemented. This is called as abstraction."

The other advantage of abstraction I know is that there can be any number of implementations. For example take List interface of the collection framework. In the interface there are methods declarations for what a List must do. Now ArrayList and LinkedList are implementing the List interface. Here we are having 2 different implementations. ArrayList is speed in searching, LinkedList is speed in manipulations. Like this we can have any number of implementations in our application using abstraction,

The interviewer said that the answer is partially right. But the actual answer is "the main advantage/use of abstraction is to provide security to the code" and he was telling about some stuff related to showing the design to the client. I did not understand it actually. Since it was an interview I did not ask him to explain in detail. I have read few threads in coderanch and few forums. But did not find any answer related to security with abstraction.

Can anyone tell me? Thank you all in advance, good day.

[Winston Gutkowski]

chaitanya karthikk wrote:The interviewer said that the answer is partially right. But the actual answer is "the main advantage/use of abstraction is to provide security to the code" and he was telling about some stuff related to showing the design to the client...

Personally, I'd say you're probably better off not getting a job there, since he clearly doesn't know what he's talking about (unless you've misquoted him).

Questions of that sort are patently absurd anyway, since they're far too general. They're probably only using as a mantrap for you to fall into.

Winston

[Henry Wong]

chaitanya karthikk wrote:The interviewer said that the answer is partially right. But the actual answer is "the main advantage/use of abstraction is to provide security to the code" and he was telling about some stuff related to showing the design to the client. I did not understand it actually. Since it was an interview I did not ask him to explain in detail. I have read few threads in coderanch and few forums. But did not find any answer related to security with abstraction.

Sounds to me that the interviewer transitioned to a customer use case discussion (and did a poor job at it). Regardless, you need to engage when the interviewer does this. You need to be very interested in the use case (or just show that you are interested); you need to brain storm about the use case, etc. This means that if you don't understand, you need to ask.

I understand that you don't want to ask, since that may show that you don't understand, but there are huge issues with that. First, you can't engage, which in turn, may show that you don't understand anyway. Second, the deflecting of the topic may show lack of interest, either in the company, technology, or their customer. And finally, it is an opportunity to show how you think through something that you don't understand.

Henry

[Jeff Verdegan]

chaitanya karthikk wrote:
The interviewer said that the answer is partially right. But the actual answer is "the main advantage/use of abstraction is to provide security to the code" and he was telling about some stuff related to showing the design to the client.

That is absolutely false. The main purpose of abstraction, in my opinion, is to decouple design from implementation. It gives us the ability to say what something does without specifying how it does it. I'm sure there are other valid opinions on the "main use" of abstraction, but "to provide security to the code" is absolutely not one of them.

Additionally, what the interviewer was talking about isn't really "security" in any commonly used sense of the word. It's more about protecting intellectual property. And, when you get right down to it, the example he gave of showing the design do the client (but presumably not the code that implements it) is precisely what I'm talking about.

So I'd say the main use of abstraction is to decouple design from implementation, and one advantage of doing that (but definitely not the main one) is that it can help provide the kind of intellectual property protection the interviewer was talking about. I agree with Henry that this would have been a good chance for you to engage the interviewer (perhaps stating what I just did) for the goals of 1) Demonstrating your understanding of the concepts and ability to adapt that understanding to different situations and usages, and 2) to learn more about the perspective of the interviewer and the company.

[chaitanya karthikk]

Thank you all.

Now I understood that abstraction has nothing to do with security. It is used to decouple the design with implementation.

[Mariah DeMarco]

I'm replying to a  ten year old post incase anyone stumbles upon this because it took me quite a while to find the answer after seeing over and over again the line that abstraction is to create more secure code with no reasoning provided.

excuse the quickly done and incomplete code but
Lets says you are on a banking website and this is the code for checking your balance

abstract class CustomerFinances {
    private int balance;
    securityKey key;
    int accountNo;
    public increaseBalance(int amount){
         if(securityKey = hash(accountNo)){
  	     this.balance = this.balance + amount;
          }
    }
}

class Customer extends CustomerFinances {
    String name;
    int age;
}

class Main {
  public static void main(String[] args) {
    Customer customer = new Customer();
    int amount = 30;
    boolean depositButtonPressed = true;
    if(depositButtonPressed){
    	customer.increaseBalance(amount);
    }
  }
}

Using a reflection API you are able to modify and see all the details about a class in which an object belongs to at runtime.
Inside main we made a customer object since we used private in our parent class we cant access or modify balance or see balance implementation because Customer class doesnt have access to it. You might think why is abstraction important? why can't we just use inheritance since CustomerFinances didnt have any abstract methods. It is because if it werent abstract in main we'd be able to create CustomerFinances customer = new Customer(); and that would make the code vulnerable to the reflection API.

[Liutauras Vilda]

Welcome to the Ranch.

Mariah DeMarco wrote:You might think why is abstraction important? why can't we just use inheritance since CustomerFinances didnt have any abstract methods.

But inheritance is used, because Customer extends CustomerFinance. And by that we sort of saying Customer IS-A CustomerFinance. Let's ignore the fact that it doesn't make sense.

Mariah DeMarco wrote:if it werent abstract in main we'd be able to create CustomerFinances customer = new Customer();

As I see CustomerFinances is an abstract class, but that doesn't stop us from having in the given Main class (assuming code compiles):

CustomerFinances customer = new Customer();