Hacker News Reader

The opposite: increasing the set of network endpoints that are untrusted from the internet to both the internet and the LAN.

View on HN

That would only be true if the access granted to machines that were in the previously trusted network was now completely eliminated (probably breaking all sorts of critical systems).

Instead, the proponents of zero trust have redefined "untrusted network endpoints" to mean "trusted network endpoints".

I get this, but I don’t get why that means we should do away with VPNs, etc. Isn’t “in my private network” an additional piece of information that can be used to help authenticate a client?

VPNs aren't necessarily "done away with" in the ZT model, in fact in many circumstances they would still be encouraged.

Sure you can still have a VPN. It’s just not used for security because that’s a terrible idea.

We’re talking about situations where you have some control over both sides. If you’re authenticating with some random embedded device, you’d likely use a VPN for security.

Reply on news.ycombinator.com