Exercise 2: Why Time-Limited Credentials Are Stronger, Without Shaming Anyone — Possible Solution ==================================================================== WHY TIME-LIMITED CREDENTIALS ARE GENUINELY STRONGER ------------------------------ Per this chapter, "if a short-lived credential leaks, the exposure window is naturally bounded; a permanent one keeps working until someone notices and explicitly revokes it." A short-lived credential automatically becomes useless after a fixed period, regardless of whether anyone realizes it leaked - the damage a leaked credential can do is capped by time alone. A permanent credential has no such built-in limit - it remains fully valid indefinitely unless a person actively notices the leak and manually revokes it, which may never happen or may take a long time. THE STRUCTURAL DIFFERENCE THIS CREATES ------------------------------ With time-limited credentials, security doesn't depend on someone detecting a leak in time - the exposure ends automatically. With permanent credentials, security depends entirely on human detection and action, which is a much less reliable safety net. WHY THIS CHAPTER IS CAREFUL NOT TO TREAT MISSING INFRASTRUCTURE AS A FAULT ------------------------------ Per this chapter, "not every organization has this kind of infrastructure built out yet, and standing access used with good discipline is still far better than no discipline at all - this describes a genuinely stronger option where it's available, not a judgment on anyone whose organization hasn't built it." Setting up short-lived credential infrastructure (like a bastion issuing certificates) is a real, nontrivial engineering investment many organizations simply haven't made yet - the chapter distinguishes between "this is a better option when it exists" and "you're doing it wrong if it doesn't," recognizing that the absence of this infrastructure isn't itself a discipline failure. WHY THIS WORKS AS AN ANSWER ------------------------------ It explains the specific mechanism that makes time-limited credentials safer (a bounded exposure window that doesn't depend on human detection), and explains the chapter's own explicit reasoning for why lacking this infrastructure isn't treated as a fault.