←back to thread

I read the federal government’s Zero-Trust Memo so you don’t have to

(www.bastionzero.com)
656 points EthanHeilman | 2 comments | 27 Jan 22 15:06 UTC | HN request time: 0s | source
Show context
paganel ◴[27 Jan 22 18:16 UTC] No.30104004[source]▶
> Do not give long-lived credentials to your users.

This screams "we'll use more post-it notes for our passwords compared to before", or maybe the real world to which this memo is addressed is different compared to the real (work-related) world I know.

replies(4): >>30104332 #>>30104631 #>>30104886 #>>30123541 #
1. tptacek ◴[27 Jan 22 19:00 UTC] No.30104631[source]▶
The general attitude among practitioners now is that "post-it notes with passwords on them" is superior to the more common practice of "shitty passwords shared across multiple services".
replies(1): >>30106746 #
2. cpach ◴[27 Jan 22 21:11 UTC] No.30106746[source]▶
Back in 2009 or so I stored my most-frequently used psswords on a piece of paper in my wallet.

(These days I simply use 1Password.)