4 ms·

How fortunate that an executive order was waiting in the wings, which requires federal contractors to purchase an authentication service and guarantee they use

How fortunate that an executive order was waiting in the wings, which requires federal contractors to purchase an authentication service and guarantee they use the underspecified ZTA (which will probably mean pay for AWS or Azure services to do anything at all), days after multiple highly-publicized million-dollar cybercrime heists were, quite astonishingly, thwarted by the FBI resulting in no money lost.

meepmorp 5y ago
Or, apparently, we can just use https://login.gov https://login.gov (link from https://news.ycombinator.com/item?id=27530920 https://news.ycombinator.com/item?id=27530920)
- grumblenum 5y ago
  That appears to be for consumers of federal government web services, which I would not expect to prevent large breaches. The service itself would be a massive single point of failure, and I'm not sure how it would prove a contractor has ZTA, or whatever an administrator thinks that means, all the way down.
  - toomuchtodo 5y ago
    It alone is not a silver bullet for ZTA, but authn and authz are critical components of ZTA. Most are not good at auth*, should not roll their own, and absolutely should delegate to a service that provides this functionality (commercially, you see this with Okta and Auth0, for example).
  - pimlottc 5y ago
    While primarily targeted at the public, login.gov is used for some internal gov sites as well.
ww2buff 5y ago
What exactly is this pile of innuendo meant to allege
- grumblenum 5y ago
  Since you asked, I'll make it explicit. My pile of innuendo alleges that the FBI is directly responsible or at least complicit for the Colonial Pipeline and JBM hacks, and the executive order is likely written by lobbyists who sell or intend to sell authentication services or "secure" platforms to federal contractors. Do you remember back when there were no weapons of mass destruction and the "Intelligence Community", the media, and other agents of reputable institutions all went along with the lie so that unrelated geopolitical objectives could be satisfied and defense contractors would make insane amounts of money? It's like that.

meepmorp 5y ago

Or, apparently, we can just use https://login.gov https://login.gov (link from https://news.ycombinator.com/item?id=27530920 https://news.ycombinator.com/item?id=27530920)

grumblenum 5y ago
That appears to be for consumers of federal government web services, which I would not expect to prevent large breaches. The service itself would be a massive single point of failure, and I'm not sure how it would prove a contractor has ZTA, or whatever an administrator thinks that means, all the way down.
- toomuchtodo 5y ago
  It alone is not a silver bullet for ZTA, but authn and authz are critical components of ZTA. Most are not good at auth*, should not roll their own, and absolutely should delegate to a service that provides this functionality (commercially, you see this with Okta and Auth0, for example).
- pimlottc 5y ago
  While primarily targeted at the public, login.gov is used for some internal gov sites as well.

ww2buff 5y ago

What exactly is this pile of innuendo meant to allege

grumblenum 5y ago
Since you asked, I'll make it explicit. My pile of innuendo alleges that the FBI is directly responsible or at least complicit for the Colonial Pipeline and JBM hacks, and the executive order is likely written by lobbyists who sell or intend to sell authentication services or "secure" platforms to federal contractors. Do you remember back when there were no weapons of mass destruction and the "Intelligence Community", the media, and other agents of reputable institutions all went along with the lie so that unrelated geopolitical objectives could be satisfied and defense contractors would make insane amounts of money? It's like that.