3 ms·

https://www.cloudflare.com/learning/security/glossary/what-is-zero-trust/ https://www.cloudflare.com/learning/security/glossary/what-i... Zero Trust just means

by varenc 2y ago

https://www.cloudflare.com/learning/security/glossary/what-is-zero-trust/ https://www.cloudflare.com/learning/security/glossary/what-i... Zero Trust just means you stop inherently trusting your private network and verify every user/device/request regardless. If you opt in to using Cloudflare to do this then it requires running Cloudflare software.

bdd8f1df777b 2y ago
But with public key auth I'm already distrusting everyone on my private network.
- resoluteteeth 2y ago
  Technically I guess that's "zero trust" in the sense of meeting the requirement of not trusting internal connections more than external ones, but in practice I guess "zero trust" also typically entails making every connection go through the same user-based authentication system, which uploading specific keys to specific servers manually definitely doesn't achieve.
PLG88 2y ago
Thats one interpretation... ZT also posits assuming the network is compromised and hostile, that also applies to CF and their cloud/network. It blows my mind that so many solutions claim ZT while mandating TLS to their infra/cloud, you can trust their decryption of your date, and worst IMHO, they will MITM your OICD/SAML key to ensure the endpoint can authenticate and access services... that is a hell of a lot of implicit trust in them, not least of them being served a court order to decrypt your data. Zero trust done correctly done not have those same drawbacks.
- sshine 2y ago
  One element is buzzword inflation, and another is raising the bar. On the one hand, entirely trusting Cloudflare isn't really zero trust. On the other hand, not trusting any network is one narrow definition. I'll give you SSH keys when you pry them from my cold, dead FDE SSDs.
michaelt 2y ago
Zero Trust means you stop trusting your private network, and start trusting Cloudflare, and installing their special root certificate so they can MITM all your web traffic. To keep you safe.
- gobip 2y ago
  Same thing with their "serverless" servers where you host everything there.

by varenc 2y ago

bdd8f1df777b 2y ago

But with public key auth I'm already distrusting everyone on my private network.

resoluteteeth 2y ago
Technically I guess that's "zero trust" in the sense of meeting the requirement of not trusting internal connections more than external ones, but in practice I guess "zero trust" also typically entails making every connection go through the same user-based authentication system, which uploading specific keys to specific servers manually definitely doesn't achieve.

PLG88 2y ago

Thats one interpretation... ZT also posits assuming the network is compromised and hostile, that also applies to CF and their cloud/network. It blows my mind that so many solutions claim ZT while mandating TLS to their infra/cloud, you can trust their decryption of your date, and worst IMHO, they will MITM your OICD/SAML key to ensure the endpoint can authenticate and access services... that is a hell of a lot of implicit trust in them, not least of them being served a court order to decrypt your data. Zero trust done correctly done not have those same drawbacks.

sshine 2y ago
One element is buzzword inflation, and another is raising the bar. On the one hand, entirely trusting Cloudflare isn't really zero trust. On the other hand, not trusting any network is one narrow definition. I'll give you SSH keys when you pry them from my cold, dead FDE SSDs.

michaelt 2y ago

Zero Trust means you stop trusting your private network, and start trusting Cloudflare, and installing their special root certificate so they can MITM all your web traffic. To keep you safe.

gobip 2y ago
Same thing with their "serverless" servers where you host everything there.