Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Wag, MFA and Enrollment for WireGuard

github.com

Post reply on HN
Print view View original

31–40 of 68 posts

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#31

Post by drio »

lmeyerov wrote: post #18
aragilar wrote: post #4

[flagged]

TailScale made key parts of their stack proprietary, route key bits centrally, and I'm sure other issues. And, just like with browsers, alts are good. I'd expect a lot of whitespace for a more open, secure, and usable impl. Most people do not use TailScale. I'd encourage doing the work of understanding why, there is likely a big opportunity somewhere here.

> Most people do not use TailScale. I'd encourage doing the work of understanding why, there is likely a big opportunity somewhere here.

When you use Tailscale extensively, it becomes your new network. Now all your systems depend on a piece of software that you do not fully control. The control plane is not open source, and it is a key component of Tailscale. Headscale is a great effort, but it doesn't have feature parity with Tailscale (1). Moreover, the dedicated team at Tailscale keeps releasing amazing new functionality regularly.

That being said, if I had to buy software from a company, Tailscale would be my first pick. I respect and trust the founders and the early engineers working there.

As a side note, I'm planning to contribute to Headscale. This technology is crucial, and I want to help ensure its success.

(1) The functionality offered by Headscale is sufficient to build a robust mesh network and enjoy its benefits. Kudos to the team and to Tailscale for supporting it.

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#32

Post by yonatan8070 »

Avicebron wrote: post #6
d-z-m wrote: post #3

Do you protect against bruteforcing the TOTP code? I.e. via rate-limiting or a set amount of retries? I took a quick glance at the code and couldn't find anything to this effect. The scenario I'm imagining is: someone opens the TOTP entry UI in their browser, opens devtools, and starts to loop through all possible TOTP codes.

I can't speak to the specifics of this particular implementation but usually if someone has the login (username + password) to get to totp that user has already been compromised..

If a user keeps their credentials in a notebook and it got stolen, the TOTP check can be the difference between the attacker getting in, and the user being notified and changing their password

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#34

Post by lmeyerov »

drio wrote: post #31
lmeyerov wrote: post #18

Earlier quoted context omitted.

TailScale made key parts of their stack proprietary, route key bits centrally, and I'm sure other issues. And, just like with browsers, alts are good. I'd expect a lot of whitespace for a more open, secure, and usable impl. Most people do not use TailScale. I'd encourage doing the work of understanding why, there is likely a big opportunity somewhere here.

> Most people do not use TailScale. I'd encourage doing the work of understanding why, there is likely a big opportunity somewhere here. When you use Tailscale extensively, it becomes your new network. Now all your systems depend on a piece of software that you do not fully control. The control plane is not open source, and it is a key component of Tailscale. Headscale is a great effort, but it doesn't have feature p…

That's true today, no reason to be true tomorrow, else we would all still be on mosaic or netscape or firefox (who fired the rust/servo team afaict once they weren't as valued)

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#35

Post by aborsy »

drio wrote: post #31
lmeyerov wrote: post #18

Earlier quoted context omitted.

TailScale made key parts of their stack proprietary, route key bits centrally, and I'm sure other issues. And, just like with browsers, alts are good. I'd expect a lot of whitespace for a more open, secure, and usable impl. Most people do not use TailScale. I'd encourage doing the work of understanding why, there is likely a big opportunity somewhere here.

> Most people do not use TailScale. I'd encourage doing the work of understanding why, there is likely a big opportunity somewhere here. When you use Tailscale extensively, it becomes your new network. Now all your systems depend on a piece of software that you do not fully control. The control plane is not open source, and it is a key component of Tailscale. Headscale is a great effort, but it doesn't have feature p…

The security of the devices don’t depend on Tailscale coordination server, if tail lock is enabled.

An attacker with access to coordination or relay servers would be able to change whatever is in the admin console, which are basically ACLs.

Am I missing anything?

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#37

Post by yardstick »

yonatan8070 wrote: post #32
Avicebron wrote: post #6

Earlier quoted context omitted.

I can't speak to the specifics of this particular implementation but usually if someone has the login (username + password) to get to totp that user has already been compromised..

If a user keeps their credentials in a notebook and it got stolen, the TOTP check can be the difference between the attacker getting in, and the user being notified and changing their password

Unfortunately these days it’s even easier with password managers containing all three (user, pass, token)

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#39

Post by ThePowerOfFuet »

yardstick wrote: post #37
yonatan8070 wrote: post #32

Earlier quoted context omitted.

If a user keeps their credentials in a notebook and it got stolen, the TOTP check can be the difference between the attacker getting in, and the user being notified and changing their password

Unfortunately these days it’s even easier with password managers containing all three (user, pass, token)

The difference being the notebook is paper and easily read, while the password manager is... quite a bit harder.

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#40

Post by mbreese »

stavros wrote: post #29
mbreese wrote: post #28

Earlier quoted context omitted.

I don’t know if the parent was edited or not, but that’s not how I read the parent post. I didn’t take it as malicious, but trying to understand more about this method. I’d love for the author to tell us a bit more about how it works. I’m curious about what obstacles the author hit and how they got around them. Note: re: the flagged sibling comment. Yeah, that one doesn’t get the benefit of the doubt and was out of b…

Oh, I'm not saying it's malicious, it's just a mindset of "creating a thing must be externally motivated" vs "we make things because we like making things".

I agree that that dichotomy is on display here quite often. And it isn’t a good mindset. Making for the sake of making and learning should be celebrated.

I just didn’t get that vibe from the now flagged comment by @aragilar. I saw it as a genuine curiosity about the design choices. Maybe I was wrong.

    “¯\_(ツ)_/¯“
Post reply on HN