I read the federal government’s Zero-Trust Memo so you don’t have to
This is pretty incredible. These aren't just good practices, they're the fairly bleeding edge best practices.<p>1. No more SMS and TOTP. FIDO2 tokens only.<p>2. No more unencrypted network traffic - including DNS, which is such a recent development and they're mandating it. Incredible.<p>3. <i>Context aware</i> authorization. So not just "can this user access this?" but attestation about device state! That's extremely cutting edge - almost no one does that today.<p>My hope is that this makes things more accessible. We do all of this today at my company, except where we can't - for example, a lot of our vendors don't offer FIDO2 2FA or webauthn, so we're stuck with TOTP.