Top all-time · #11645
BastionZero
Company blog · bastionzero.com/blog · on HN as EthanHeilmansecuritysystems
BastionZero is the company blog at bastionzero.com, writing about security and systems. Since 2021, 6 different Hacker News readers have linked it 16 times, most often “I read the federal government’s Zero-Trust Memo so you don’t have to”. It is still writing: the last post was on 2026-11-02, and you can follow it by feed.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers link BastionZero for its security model page and a blog post summarising key points of the US federal zero-trust guidance. Most comments cite it as a source rather than judging the writing.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
The BastionZero blog on zero trust infrastructure access: SSH and Kubernetes security, remote access without VPNs, threat analysis and product news.
Most-linked posts?
- I read the federal government’s Zero-Trust Memo so you don’t have to4 people · 5 mentions · first linked 2022-01-27
What Hacker News says?
BastionZero is a similar product which gives you multiple roots of trust, one to BastionZero, and one to your identity provider (Google, Okta, etc.) https://www.bastionzero.com/security-model
Comment linking /security-model
on “How our free plan stays free”Submitted I read the federal government’s Zero-Trust Memo so you don’t have to as a story · 656 points
HN discussionIn the USA, the latest government guidance from Jan 2022 is that "Password policies MUST NOT require use of special characters or regular rotation". [1] This is a strong upgrade from earlier softer language like "don't have to/should not". In practice, this new rule contradicts almost every InfoSec stance out there, but all government agencies must comply with this new rule by the end of the year, so expect lots of…
Comment linking /blog/i-read-the-federal-governments-zero-trust-memo-so-you-dont-have-to
on “There’s no need to change passwords if they're robust, unique and not breached”Submitted Summary of the USA federal government's zero-trust memo as a story · 49 points
HN discussionMy company[0] is building someone very similar. * Cloudflare seems to be taking the approach of "trust us with your SSH keys we are cloudflare". * Whereas we are taking the approach of "trust no one". I believe both are viable approaches. If someone is already trusting cloudflare for everything else why not this additional trust assumption, vs. bastionzero allowing someone to reduce attack surface and trust assumpti…
Comment linking /
on “A Zero Trust terminal in the browser”Submitted In which I agree with the federal government and bash VPNs for fun and profit as a story · 49 points
HN discussionTo toot my own companies horn[0] we designed our authentication protocol OpenPubkey[1] to have two signers on tokens: 1. The IDP signer (like microsoft or google) 2. The Cosigner (like bastionzero.com) ...so that even if microsoft's signing key is stolen, the attacker also needs to compromise the cosigner's signing key as well. It's like multisig for authentication tokens. I don't know if OpenPubkey would have helpe…
Comment linking /
on “Microsoft lost its keys, and the government got hacked”Submitted I Read CISA’s Cloud Security Technical Reference Architecture as a story · 3 points
HN discussionI run a free, open source login provider[0] and have been keeping a close eye on passkeys. I think this article gets a bit too much into FUD territory. While big tech control over passkeys is certainly something that should be watched closely as we move forward, all signs currently are that the system will be relatively open to third party developers, including open source solutions. That said, I have other concerns…
Comment linking /openpubkey
on “Are Passkeys the beginning of the end of passwords? I certainly hope not”Submitted How to avoid getting pwned when your SSO is hacked as a story · 3 points
HN discussionand a blogpost I found discussing key points if you want the TL;DR: https://www.bastionzero.com/blog/i-read-the-federal-governme...
Comment linking /blog/i-read-the-federal-governments-zero-trust-memo-so-you-dont-have-to
on “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles [pdf]”Submitted OpenPubkey: I think it is the most important security research I’ve done as a story · 2 points
HN discussionSubmitted From blockchain to infrastructure: How to pivot a startup in 90 days as a story · 2 points
HN discussionSubmitted Summary of the USA federal government's zero-trust memo as a story · 1 points
HN discussionSubmitted Why Running a CA Is Hard, and Why You Shouldn’t Try Doing It Yourself as a story · 1 points
HN discussionSubmitted In which I agree with the federal government and bash VPNs for fun and profit as a story · 1 points
HN discussion
