Hacker News Reader

Comment by theamk | Hacker News Reader

I think you are making it sound more complex than it is. ZT is an architecture where people don't need trusted network, but still have the same or better level of security as traditional VPN.

To measure ZT progress, count the services and security controls which rely on VPN/LAN. The closer it is to zero, the closer you are to ZT.

View on HN

Don't trust everything inside the gate isn't necessarily about getting rid of the gate. Like another child comment points out, ZT isn't about getting rid of VPN. There is still a place for VPNs in an organization that embraces the ZT way.

eh no. !VPN is not the hallmark of ZT. It'd be so easy just to put services on the Internet with user/pass. Does that give you ZT?

It gives you zero network trust, which is unfortunately what a lot of companies still have. How many companies really do device attestation to connect to a VPN? I haven't been in a single one. (well, one tried, but it didn't really keep you from using a third party client)

Putting your internal apps behind an OIDC proxy instead of the VPN is a straight upgrade at that point. Especially if your provider already does some checks for you (e.g. Chrome Enterprise, requiring Cloudflare WARP app)

Just a plain user/pass is not going to cut it, I said "same or better level of security" for a reason.

For example, all VPNs give you a single lockout/change password point, so this has to be at least common authentication. And VPNs have good logging for connections, so you got to have this too. And if your VPN client had device attestation, your solution should have have this too. And also services on VPN are not nearly vulnerable to auth bypass bugs, so your webserver should have some protection on this too (authenticating proxy?).

I think !VPN is exactly hallmark of ZT... as long as security is preserved. If you disagree, what do you think ZT's hallmark is?

(There is a philosophical question: if a company had a crappy VPN with no logging, and multiple VPN servers with no central auth.. and went to equally crappy user/pass webapp on internet.. does this count as "ZT transition"?)

Reply on news.ycombinator.com