I read the federal government’s Zero-Trust Memo so you don’t have to
This is pretty incredible. These aren&#x27;t just good practices, they&#x27;re the fairly bleeding edge best practices.<p>1. No more SMS and TOTP. FIDO2 tokens only.<p>2. No more unencrypted network traffic - including DNS, which is such a recent development and they&#x27;re mandating it. Incredible.<p>3. <i>Context aware</i> authorization. So not just &quot;can this user access this?&quot; but attestation about device state! That&#x27;s extremely cutting edge - almost no one does that today.<p>My hope is that this makes things more accessible. We do all of this today at my company, except where we can&#x27;t - for example, a lot of our vendors don&#x27;t offer FIDO2 2FA or webauthn, so we&#x27;re stuck with TOTP.