I read the federal government’s Zero-Trust Memo so you don’t have to

> Do not give long-lived credentials to your users.

This screams "we'll use more post-it notes for our passwords compared to before", or maybe the real world to which this memo is addressed is different compared to the real (work-related) world I know.

It specifically calls out not requiring regular password rotation. Short-lived credentials is for tokens with expiration, not the password you use to login to the service that gives you the token.

Got it, thanks.

The general attitude among practitioners now is that "post-it notes with passwords on them" is superior to the more common practice of "shitty passwords shared across multiple services".

This was a very unfortunate choice of words by the author, as they don't mean credentials as in the credential a user uses to initially authenticate to the system. Rather they mean authentication tokens, be they Kerberos tickets, bearer tokens, etc.

This memo in particular emphasizes the existing guidance the US government has issued around not expiring passwords. If you are a federal agency, you can have (and are in fact encouraged to have!) users with passwords that are unchanged for years.

Edit: it's worth pointing out that the memo does a great job of laying this out. I work in security, so possibly there's some curse of knowledge at play, but I found the blog post explainer to be less clear than the memo it is explaining...

Back in 2009 or so I stored my most-frequently used psswords on a piece of paper in my wallet.

(These days I simply use 1Password.)

> Do not give long-lived credentials to your users.

That was poorly worded in the article. Among the things it is is saying you should give to your users is a WebAuthn token. Inside the WebAuthn token is a random private key it never reveals. That is the thing the authentication "you are you" ultimately relies on, and it is very much a "long lived credential".

What he is trying to say is more complex. It's something along the lines of "you go to some authentication / authorisation service, prove you're you and say you want access to a service, and it hands you back some short term credentials you can provide to that service allowing you to use it". You, the authentication provider, and the service you trying to access might be in different countries. The danger in that scenario is someone might steal those credentials while they are in transit. One way to mitigate that is to ensure those credentials don't last for very long.

So, it's a statement about how distributed systems should handle passing credentials among themselves. The user never sees these credentials, and of course never has to remember them. Any temporary credential lasting longer than a persons sleep/wake cycle it considered broken in this world, but it's understood the user will carry with them a relatively long lived way of proving they are who they say they are.