Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Identity-Aware Proxy

cloud.google.com

Post reply on HN
Print view View original

31–40 of 51 posts

Re: Google Identity-Aware Proxy

#31

Post by londons_explore »

kuschku wrote: post #29
wffurr wrote: post #15

Earlier quoted context omitted.

The only BYOD device allowed is Chromebooks with a signed bootloader, aka no developer mode or Crouton.

Unless you modify the hardware, of course. Considering Google has teams designing custom PCBs and even ICs, there's a non-insignificant amount of Google devs who could easily circumvent this entire system.

Google's model requires two factor user auth, and trusted hardware.

Even someone with serious hardware-foo would only be able to maybe break the trusted hardware bit (by cloning one device id to another, or emulating a device). They couldn't get round the two factor authentication bit.

I'd say it's still a pretty watertight model.

Re: Google Identity-Aware Proxy

#32

Post by londons_explore »

closeparen wrote: post #27
hdhzy wrote: post #14

Earlier quoted context omitted.

As far as I remember BeyondCorp required users to be equipped only with attested hardware (no BYOD). This device's health then was constantly being monitored and taken into account when granting / denying access. I'd like to see the differences between IAP and Google's internal BeyondCorp. Quick search did not reveal anything.

In general, you can prevent BYOD with this approach by rolling out client certificates with config management and requiring them at the proxy.

And the client certs can be tpm backed so they can't be copy+pasted to other machines.

Re: Google Identity-Aware Proxy

#33

Post by pizzetta »

londons_explore wrote: post #31
kuschku wrote: post #29

Earlier quoted context omitted.

Unless you modify the hardware, of course. Considering Google has teams designing custom PCBs and even ICs, there's a non-insignificant amount of Google devs who could easily circumvent this entire system.

Google's model requires two factor user auth, and trusted hardware. Even someone with serious hardware-foo would only be able to maybe break the trusted hardware bit (by cloning one device id to another, or emulating a device). They couldn't get round the two factor authentication bit. I'd say it's still a pretty watertight model.

Like many things, I'm sure you can make a case for exceptions or whitelists --although granted they likely monitor and or shunt traffic to less trusted vlans or something?

Re: Google Identity-Aware Proxy

#35

Post by weeks »

kuschku wrote: post #29
wffurr wrote: post #15

Earlier quoted context omitted.

The only BYOD device allowed is Chromebooks with a signed bootloader, aka no developer mode or Crouton.

Unless you modify the hardware, of course. Considering Google has teams designing custom PCBs and even ICs, there's a non-insignificant amount of Google devs who could easily circumvent this entire system.

The purpose of ascertaining device identity is to prevent someone who can't obtain legitimate Google issued hardware from using stolen user credentials. If you're already a Google employee you can just ask for more trusted hardware, so there would be little point in breaking that part of the security model.

Re: Google Identity-Aware Proxy

#36

Post by mcpherrinm »

brazzledazzle wrote: post #19
mcpherrinm wrote: post #2

I'm super happy to see this. Square uses something similar for employee access to our datacenter, and I hope more people follow this trend. It's one of the annoying parts of open-sourcing our infrastructure -- we can't generally assume folks have an authenticating proxy around. With a few examples in the wild, I'll be happy to start doing that. We use mutually-authenticated TLS (ie, the proxy presents a client cert t…

Have you seen https://github.com/bitly/oauth2_proxy ?

I hadn't before this thread. It looks cool. I'm definitely going to look into it more. Thanks!

Re: Google Identity-Aware Proxy

#37

Post by StavrosK »

rrdharan wrote: post #21
brazzledazzle wrote: post #19

Earlier quoted context omitted.

Have you seen https://github.com/bitly/oauth2_proxy ?

I love that thing - I use it with nginx to secure access to stuff running on my home machine that I want to expose publicly (e.g. the Transmission Web UI).

Wouldn't something like Caddy's multipass[1] be easier and with less third-party approval?

That said, I just use Caddy to proxy all my home's internal services with basic auth. At work I use the same setup, except it authenticates against our LDAP server.

[1]: https://caddyserver.com/docs/multipass

Re: Google Identity-Aware Proxy

#38

Post by willejs »

brazzledazzle wrote: post #19
mcpherrinm wrote: post #2

I'm super happy to see this. Square uses something similar for employee access to our datacenter, and I hope more people follow this trend. It's one of the annoying parts of open-sourcing our infrastructure -- we can't generally assume folks have an authenticating proxy around. With a few examples in the wild, I'll be happy to start doing that. We use mutually-authenticated TLS (ie, the proxy presents a client cert t…

Have you seen https://github.com/bitly/oauth2_proxy ?

I'm a big fan. Ive been using it to do 'outside in' google type, expose services on the internet via oauth for ages. Its solid and great.

Re: Google Identity-Aware Proxy

#39

Post by deepsun »

AlphaWeaver wrote: post #34

Seems like a cool service, but not really a fan that the acronym mirrors a different service from AWS (Identity and Access Management.) Could be confusing.

Because Google Cloud already has had IAM for some time: https://console.cloud.google.com/iam-admin/iam

As with AWS IAM, it manages access to the infrastructure, like your machine instances.

But this new Google thing, as far as I understand, is about giving other (potentially non-technical) users access to your corporate resources using single identity.

Post reply on HN