Hacker News Reader

Comment by varenc | Hacker News Reader

https://www.cloudflare.com/learning/security/glossary/what-i...

Zero Trust just means you stop inherently trusting your private network and verify every user/device/request regardless. If you opt in to using Cloudflare to do this then it requires running Cloudflare software.

View on HN

Thats one interpretation... ZT also posits assuming the network is compromised and hostile, that also applies to CF and their cloud/network. It blows my mind that so many solutions claim ZT while mandating TLS to their infra/cloud, you can trust their decryption of your date, and worst IMHO, they will MITM your OICD/SAML key to ensure the endpoint can authenticate and access services... that is a hell of a lot of implicit trust in them, not least of them being served a court order to decrypt your data.

Zero trust done correctly done not have those same drawbacks.

One element is buzzword inflation, and another is raising the bar.

On the one hand, entirely trusting Cloudflare isn't really zero trust.

On the other hand, not trusting any network is one narrow definition.

I'll give you SSH keys when you pry them from my cold, dead FDE SSDs.

Zero Trust means you stop trusting your private network, and start trusting Cloudflare, and installing their special root certificate so they can MITM all your web traffic. To keep you safe.

Same thing with their "serverless" servers where you host everything there.

But with public key auth I'm already distrusting everyone on my private network.

Technically I guess that's "zero trust" in the sense of meeting the requirement of not trusting internal connections more than external ones, but in practice I guess "zero trust" also typically entails making every connection go through the same user-based authentication system, which uploading specific keys to specific servers manually definitely doesn't achieve.

Reply on news.ycombinator.com