Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Twingate – A modern solution for remote access

twingate.com

Post reply on HN
Print view View original

41–50 of 52 posts

Re: Show HN: Twingate – A modern solution for remote access

#44

Post by iojin_z_bajin »

dclaw wrote: post #39

Is it just me, or do the installation instructions for the client really say you just enter a company name..... No other user/pass/key https://docs.twingate.com/docs/download To me that reads that I could just pick a known company using your service and get right in. What's going on here folks?

Twingate integrates with the existing Identity Provider used by that company to authenticate users. So you'll be redirected to that IdP upon your first start of the client.

[p.s. I'm one of the engineers working on Twingate.]

Re: Show HN: Twingate – A modern solution for remote access

#45

Post by alexmensch »

techload wrote: post #41

Why there is no option to sign up with email?

The most important factor in this decision is maintaining separation of concerns between user authentication (identity provider) and network authorization (Twingate). Since we rely on an identity authority for access, if the user--or an attacker--is unable to authenticate themselves, we can't allow a network connection to proceed, keeping the destination resources safe. This is even more important for customers using an identity provider like Okta, allowing them to continue managing all of their users centrally.

Re: Show HN: Twingate – A modern solution for remote access

#48

Post by onorua »

yownie wrote: post #42

read the whole page, still don't understand how it works or what it does.

I don't work for twingate, but I know several guys who do. From the chat with them, I understood it installs transparent proxy to your client, and forwards all the traffic to specific destinations through access nodes over the TLS tunnel. In case specific route is not "white-listed" - it asks for authentication/authorization. Basically instead of having one point of authentication e.g. VPN gateway, you may have several specific for resource, you don't need to play with routes and have a good internet connection while connecting to the services you care through secure connection.

Re: Show HN: Twingate – A modern solution for remote access

#49

Post by onorua »

microcolonel wrote: post #36

In general it seems convenient to configure; but in terms of operation how does it really differ from connecting your services as clients to a VPN LAN? With WireGuard for the tunnels themselves, you can even have as many routers/"relays" as you want, with virtually no overhead.

VPN has one important limitation - it either provides you with default gateway and all the traffic goes through your VPN node, or you need to maintain and play with routes in order to prevent this. Another limitation is - as soon as you passed the VPN GW - you are "at home", and can access anything you like. Twingate provides you with the possibility to avoid VPN gateway for everything except for specific "access points" which are close to the sites you would like to limit access to. They also check the endpoint client attempts to connect and if the client doesn't have permission - it got rejected. Even though it can access other available resources through the same access point. You can have many "access points". I believe they use some proprietary protocol (which is bad if you ask me), I could not find any security audit on their site about the protocol. From the other hand, according to the documentation they use TLS, which is good. I believe WireGuard could be a better use here because it is OpenSource and widely used by big players. On the other hand, TLS is used even more, but I would like to get some security audit results.
Post reply on HN