Hacker News Reader

Comment by grumblenum | Hacker News Reader

How fortunate that an executive order was waiting in the wings, which requires federal contractors to purchase an authentication service and guarantee they use the underspecified ZTA (which will probably mean pay for AWS or Azure services to do anything at all), days after multiple highly-publicized million-dollar cybercrime heists were, quite astonishingly, thwarted by the FBI resulting in no money lost.

View on HN

Or, apparently, we can just use https://login.gov

(link from https://news.ycombinator.com/item?id=27530920)

That appears to be for consumers of federal government web services, which I would not expect to prevent large breaches. The service itself would be a massive single point of failure, and I'm not sure how it would prove a contractor has ZTA, or whatever an administrator thinks that means, all the way down.

It alone is not a silver bullet for ZTA, but authn and authz are critical components of ZTA. Most are not good at auth*, should not roll their own, and absolutely should delegate to a service that provides this functionality (commercially, you see this with Okta and Auth0, for example).

While primarily targeted at the public, login.gov is used for some internal gov sites as well.

What exactly is this pile of innuendo meant to allege

Since you asked, I'll make it explicit. My pile of innuendo alleges that the FBI is directly responsible or at least complicit for the Colonial Pipeline and JBM hacks, and the executive order is likely written by lobbyists who sell or intend to sell authentication services or "secure" platforms to federal contractors.

Do you remember back when there were no weapons of mass destruction and the "Intelligence Community", the media, and other agents of reputable institutions all went along with the lie so that unrelated geopolitical objectives could be satisfied and defense contractors would make insane amounts of money? It's like that.

Reply on news.ycombinator.com