Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Identity-Aware Proxy

cloud.google.com

Post reply on HN
Print view View original

21–30 of 51 posts

Re: Google Identity-Aware Proxy

#21

Post by rrdharan »

brazzledazzle wrote: post #19
mcpherrinm wrote: post #2

I'm super happy to see this. Square uses something similar for employee access to our datacenter, and I hope more people follow this trend. It's one of the annoying parts of open-sourcing our infrastructure -- we can't generally assume folks have an authenticating proxy around. With a few examples in the wild, I'll be happy to start doing that. We use mutually-authenticated TLS (ie, the proxy presents a client cert t…

Have you seen https://github.com/bitly/oauth2_proxy ?

I love that thing - I use it with nginx to secure access to stuff running on my home machine that I want to expose publicly (e.g. the Transmission Web UI).

Re: Google Identity-Aware Proxy

#22

Post by cobookman »

dzhiurgis wrote: post #10

What is a difference between proxy and a VPN?

Lets you have a whitelist of accounts per serivce. for example your HR payroll site can have IAP sitting in front of the site. IAP can only allow managers & hr access where-as the underlying system might not have this identity protection.

You can then have different whitelists per service.

Also IAP doesn't require the use of a VPN client. All one needs is a web browser with an internet connection. Giving your workers freedom to access corp assets just about anywhere.

Re: Google Identity-Aware Proxy

#23

Post by cypherpunks01 »

nathancahill wrote: post #13
eeZi wrote: post #5

Can anyone recommend this? https://github.com/bitly/oauth2_proxy

I've also used it internally, works great.

Is there any good way to configure it to handle many subdomains with one instance, or do you still have to pick between using one primary proxy.tld vs. running lots of instances of the proxy?

Re: Google Identity-Aware Proxy

#25

Post by brazzledazzle »

rrdharan wrote: post #21
brazzledazzle wrote: post #19

Earlier quoted context omitted.

Have you seen https://github.com/bitly/oauth2_proxy ?

I love that thing - I use it with nginx to secure access to stuff running on my home machine that I want to expose publicly (e.g. the Transmission Web UI).

That's a great use for it I hadn't considered. Thanks for the idea.

Re: Google Identity-Aware Proxy

#27

Post by closeparen »

hdhzy wrote: post #14
kyrra wrote: post #9

As you can sort-of see from the linked site, this is a public version of what Google uses internally, which is called BeyondCorp[0]. It's really an amazing way to think about security for a company. If you deploy it universally across your company, VPNs become obsolete. This solves a popular attack vector where bad-actors just need to get onto a corporate network to do damage. If you can authenticate at every service…

As far as I remember BeyondCorp required users to be equipped only with attested hardware (no BYOD). This device's health then was constantly being monitored and taken into account when granting / denying access. I'd like to see the differences between IAP and Google's internal BeyondCorp. Quick search did not reveal anything.

In general, you can prevent BYOD with this approach by rolling out client certificates with config management and requiring them at the proxy.

Re: Google Identity-Aware Proxy

#28

Post by nunez »

cobookman wrote: post #22
dzhiurgis wrote: post #10

What is a difference between proxy and a VPN?

Lets you have a whitelist of accounts per serivce. for example your HR payroll site can have IAP sitting in front of the site. IAP can only allow managers & hr access where-as the underlying system might not have this identity protection. You can then have different whitelists per service. Also IAP doesn't require the use of a VPN client. All one needs is a web browser with an internet connection. Giving your workers…

VPNs are also much more expensive to maintain (good VPN hardware isn't cheap), introduce much more network latency and are another thing for help desk personnel to have to support (read: spend money supporting).

BeyondCorp/UberProxy is just a really complicated whitelist. That's it. Super simple.

Re: Google Identity-Aware Proxy

#29

Post by kuschku »

wffurr wrote: post #15
hdhzy wrote: post #14

Earlier quoted context omitted.

As far as I remember BeyondCorp required users to be equipped only with attested hardware (no BYOD). This device's health then was constantly being monitored and taken into account when granting / denying access. I'd like to see the differences between IAP and Google's internal BeyondCorp. Quick search did not reveal anything.

The only BYOD device allowed is Chromebooks with a signed bootloader, aka no developer mode or Crouton.

Unless you modify the hardware, of course.

Considering Google has teams designing custom PCBs and even ICs, there's a non-insignificant amount of Google devs who could easily circumvent this entire system.

Post reply on HN