Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I read the federal government’s Zero-Trust Memo so you don’t have to

bastionzero.com

Post reply on HN
Print view View original

21–30 of 369 posts

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#21

Post by brimble »

adreamingsoul wrote: post #16

Here in Norway we have BankID which uses MFA. To access any government, banking, or official system you have to authenticate with your BankID. Its simple amazing.

There's significant bi-partisan resistance, in the US, to anything like a national ID, unfortunately, with the result that we have one anyway (because of course we do, the modern world doesn't work without it) it's just an ad-hoc combination of other forms of ID, terrible to work with, heavily reliant on commercial 3rd parties, unreliable, and laughably insecure. But the end result is still a whole bunch of public and private databases that personally identify us and contain tons of information—kind of by necessity, actually, since our ID is a combination of tons of things.

It's a very frustrating situation. Worst of both worlds.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#22

Post by KarlKemp »

I’m somewhat unhappy the “zero trust” terminology ha caught on. The technology is fine, but trust is an essential concept in many parts of life[0], and positioning it as something to be avoided or abolished will just further erode the relationships that define a peaceful and civil society.

0: trade only works if the sum of your trust in the legal system, intermediates, and counterparts reaches some threshold. The same is true of any interaction where the payoff is not immediate and assured, from taxes to marriage and friendship, and, no, it is not possible to eliminate it, nor would that be a society you’d want to live in. The only systems that do not rely on some trust that the other person isn’t going to kill them are maximum-security prisons and the US president’s security bubble. Both are asymmetric and still require trust in some people, just not all.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#23

Post by thomascgalvin »

adreamingsoul wrote: post #16

Here in Norway we have BankID which uses MFA. To access any government, banking, or official system you have to authenticate with your BankID. Its simple amazing.

I'm America, about 30% of the population would start screaming about the Mark of the Beast if we tried to roll out something like this.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#24

Post by paganel »

> Do not give long-lived credentials to your users.

This screams "we'll use more post-it notes for our passwords compared to before", or maybe the real world to which this memo is addressed is different compared to the real (work-related) world I know.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#26

Post by dev-3892 »

suns wrote: post #3
staticassertion wrote: post #2

This is pretty incredible. These aren't just good practices, they're the fairly bleeding edge best practices. 1. No more SMS and TOTP. FIDO2 tokens only. 2. No more unencrypted network traffic - including DNS, which is such a recent development and they're mandating it. Incredible. 3. Context aware authorization. So not just "can this user access this?" but attestation about device state! That's extremely cutting edg…

Yea, imagine the implications of federal agencies all implementing this successfully. Can't wait to see what the trickle down(?) effect is.

"downstream" might be the word you're looking for

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#27

Post by pitaj »

staticassertion wrote: post #2

This is pretty incredible. These aren't just good practices, they're the fairly bleeding edge best practices. 1. No more SMS and TOTP. FIDO2 tokens only. 2. No more unencrypted network traffic - including DNS, which is such a recent development and they're mandating it. Incredible. 3. Context aware authorization. So not just "can this user access this?" but attestation about device state! That's extremely cutting edg…

What's wrong with TOTP?

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#28

Post by mkohlmyr »

adreamingsoul wrote: post #16

Here in Norway we have BankID which uses MFA. To access any government, banking, or official system you have to authenticate with your BankID. Its simple amazing.

We have that in Sweden too. As an expat it's a complete nightmare for me from day one. Getting my bank to successfully issue it was impossible.

First, in the days before mobile bank-id, they sent windows-only hardware as I recall. Then came the days of letters/cards/hardware getting lost in the mail.

I gave up on it in the end. I have multiple things (banking-wise) I no longer have online access to because of it.

If you're going to make one system to rule them all you need to make sure the logistics actually work.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#29

Post by 3np »

jsmith99 wrote: post #20
3np wrote: post #13

Earlier quoted context omitted.

For anyone confused about the term "figleaf", I assume it's a reference to fig leafs being used by Renaissance artists to mask genitalia. So "things concealing the naked truth" approximately.

It's older than that: it's a biblical reference to Adam and Eve covering themselves.

My memory serves me wrong; thought that it being a fig leaf in particular was newer than the Bible but it's not (Genesis 1:3:7)

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#30

Post by Sesse__ »

pitaj wrote: post #27
staticassertion wrote: post #2

This is pretty incredible. These aren't just good practices, they're the fairly bleeding edge best practices. 1. No more SMS and TOTP. FIDO2 tokens only. 2. No more unencrypted network traffic - including DNS, which is such a recent development and they're mandating it. Incredible. 3. Context aware authorization. So not just "can this user access this?" but attestation about device state! That's extremely cutting edg…

What's wrong with TOTP?

It authenticates the user to the service, but not the service to the user, so it's vulnerable to phishing (or MITM, of course, if you don't have TLS).
Post reply on HN