[deleted]
Show HN: Twingate – A modern solution for remote access
21–30 of 52 posts
Re: Show HN: Twingate – A modern solution for remote access
#22Seems like an alternative to Pritunl Zero
Re: Show HN: Twingate – A modern solution for remote access
#23So does anyone else notice the number of pro-twingate comments on this submission with accounts that have under 5 karma?
Like I want to try new things, but this entire comment thread seems to be full of astroturf and spam. And if that was something that was done as part of this launch and post then I have ethical questions about the product.
Re: Show HN: Twingate – A modern solution for remote access
#24This looks very interesting. Very similar to Cloudflare Access. How does it handle auditing? Is there an ability to log SSH or HTTP traffic?
This is our very first public launch, and auditing/analytics are next up on our roadmap! Just to be clear, we do not currently and do not plan to intercept any traffic—any client application connections remain encrypted inside of our TLS transport tunnel. What we will be providing is connection-level analytics for Twingate traffic flowing through connectors you deploy on your network. For example, connection start and end times, which authorized user accessed the destination resource and how much data was transferred. How would that fit with your needs?
By the way, this is similar to Cloudflare Access, but we’re protocol agnostic (any TCP or UDP traffic can be proxied) and we don’t require you to change or create any public DNS entries. In fact, our best practice recommendation is that you exclusively use private DNS to cloak your private network.
Re: Show HN: Twingate – A modern solution for remote access
#25So does anyone else notice the number of pro-twingate comments on this submission with accounts that have under 5 karma? Like I want to try new things, but this entire comment thread seems to be full of astroturf and spam. And if that was something that was done as part of this launch and post then I have ethical questions about the product.
I saw one or two as well, but they seem to be disappearing even with "show dead" on?
Re: Show HN: Twingate – A modern solution for remote access
#26So does anyone else notice the number of pro-twingate comments on this submission with accounts that have under 5 karma? Like I want to try new things, but this entire comment thread seems to be full of astroturf and spam. And if that was something that was done as part of this launch and post then I have ethical questions about the product.
I saw one or two as well, but they seem to be disappearing even with "show dead" on?
Yeah, seems like they are going away- that's pretty funky. Wonder if they posters removed them or they were flagged?
Nice to see that things cleaned up pretty quick, so thanks to whomever did that.
Re: Show HN: Twingate – A modern solution for remote access
#27A few issues I have with these NoVPN products:
* They are entirely proprietary or are proprietary extensions on top of open source software
* The clients are mostly proprietary and the distribution channels are limited. I'm guessing no .DMG is offered for macOS due to Apple's insane restrictions on OS-integrated VPN clients.
* There is usually a hard dependency on the provider for the connection, negotiation, or key exchange with no uptime guarantees.
* Pricing is not competitive with the alternatives including proprietary offerings from the big clouds.
* They all cite "Google BeyondCorp" without an understanding of what it is. Hardly do any of these products offer anything to do with inventory, device health checks, or MDM.
Re: Show HN: Twingate – A modern solution for remote access
#28We currently use a mildly exotic "temporary bastion" approach, where upon request / approval a dev can get a container launched. The container is launched on ECS running an ssh server, pinned to the dev's individual public key, and that container has the appropriate security groups / IAM roles to access various production resources. Right now, a dev will 1) VPN to get shallow network access and 2) SSH over VPN to get…
Hey, great question, and your setup seems very secure, but I’m sure it would be nice to reduce some of the overhead. The right way to support your ephemeral bastion use case with Twingate will ultimately be to use a public API that we plan to launch later this year. That will allow you programmatically deploy connectors as needed. However, I’d also question whether you even need your ephemeral bastions anymore with T…
Can you explain how this is more secure than SSH to a bastion host via an out of band network?
Re: Show HN: Twingate – A modern solution for remote access
#29Is it correct that the Twingate systems have all the necessary credentials to grant arbitrary access to your resources?
Our general approach is to rely on widely-used delegated trust mechanisms (eg. OAuth, SAML, CAs, etc.) and from our perspective the more of that we can do the better, as it helps decentralize control mechanisms and improve overall security. Ultimately, you’re absolutely right that it comes down to trust, and we’re very aware of that.
Like most aspects of security, it’s about assessing the tradeoffs involved. From our standpoint, our interests are completely aligned with our users—earning their trust by keeping them secure benefits us, too. When you compare that to the security risks inherent to VPN (implicit total trust of devices, granting access based on joining a network, etc.) for the complexity of remote access today, what we’re hearing from our initial customers is that it’s a no-brainer.
The best analogy I can think of is Okta. Theoretically, Okta could arbitrarily authorize access to any of your internal applications, but from their customers’ standpoint that potential risk is vastly outweighed by the additional security benefits afforded by SSO.
That said, we definitely want to keep doing everything we can to improve trust in our product. One idea we’ve discussed is allowing our customers to have complete signing authority (on hardware/service entirely under their control) over all tokens in our system. As an example, would that go further to address concerns around trust from your perspective?
Re: Show HN: Twingate – A modern solution for remote access
#30Congrats to Alex and the team. Been super hard work for them and really pleased to see how this is working out!