Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Making an SSH client the hard way

tailscale.com

Post reply on HN
Print view View original

41–50 of 108 posts

Re: Making an SSH client the hard way

#41

Post by Spivak »

shp0ngle wrote: post #38
dgentry wrote: post #13

Earlier quoted context omitted.

The Tailscale VPN client, the same one which runs on other devices, is compiled to WASM. It handles all of the key exchanges to connect to the tailnet. The SSH session is running as a WASM Tailscale client. The browser, opening connections from within the browser engine, doesn't have the keys for SSH or VPN access.

It doesn’t have the keys, but it can inject any javascript and do whatever the user can do.

To me it seems they've taken all precautions they can reasonably take -- "what if the user installs a keylogger" isn't fixable by anyone.

Re: Making an SSH client the hard way

#42

Post by Spivak »

> To make this possible, we ported the following to WebAssembly: the Tailscale client, WireGuard®, a complete userspace network stack (from gVisor), and an SSH client.

I love that they were clearly inspired by fly.io. Warms my heart that a random blog post with a good idea can spread like this.

Re: Making an SSH client the hard way

#43

Post by Scaevolus »

vngzs wrote: post #10

This is really cool and fun, but is this a safe way to run SSH clients? If, say, the adblock Chrome extension you're using gets bought by a malware operator and backdoored[0], now it also has SSH and VPN access. [0]: https://www.wired.co.uk/article/fake-chrome-extensions-malwa...

If you have an actively malwared extension, there's probably an easier way to exploit any given target-- the simplest being recording passwords.

There's not really a "safe" website when the browser is malicious.

Re: Making an SSH client the hard way

#44

Post by capdeck »

easton wrote: post #14

Could the Tailscale client be packaged as an extension so I can visit sites on my Tailnet without having to install a client? Sometimes I want to visit a "internal" site without having to install the client, if I'm using a temporary box for something. I'm not sure how much more work would have to be done, might have to dig into the open source pieces of this.

Putting my vote in for this feature as well... Also, why not compile VNC into WASM and get full remote desktop experience for graphical apps. It seems that hard work has already been done!

Re: Making an SSH client the hard way

#45

Post by vngzs »

dgentry wrote: post #13
vngzs wrote: post #10

This is really cool and fun, but is this a safe way to run SSH clients? If, say, the adblock Chrome extension you're using gets bought by a malware operator and backdoored[0], now it also has SSH and VPN access. [0]: https://www.wired.co.uk/article/fake-chrome-extensions-malwa...

The Tailscale VPN client, the same one which runs on other devices, is compiled to WASM. It handles all of the key exchanges to connect to the tailnet. The SSH session is running as a WASM Tailscale client. The browser, opening connections from within the browser engine, doesn't have the keys for SSH or VPN access.

Sounds like about "as good as this gets" if you happen to want to do this in browsers. Good job.

Re: Making an SSH client the hard way

#46

Post by bradfitz »

capdeck wrote: post #44
easton wrote: post #14

Could the Tailscale client be packaged as an extension so I can visit sites on my Tailnet without having to install a client? Sometimes I want to visit a "internal" site without having to install the client, if I'm using a temporary box for something. I'm not sure how much more work would have to be done, might have to dig into the open source pieces of this.

Putting my vote in for this feature as well... Also, why not compile VNC into WASM and get full remote desktop experience for graphical apps. It seems that hard work has already been done!

> Also, why not compile VNC into WASM and get full remote desktop experience for graphical apps. It seems that hard work has already been done!

Yup. :)

In fact, that's mentioned in the original public bug: https://github.com/tailscale/tailscale/issues/3157

Re: Making an SSH client the hard way

#47

Post by chatmasta »

Cool feature! I was just looking at boringtun last night and wondering if it could compile to WASM, to get a virtualized network interface in the browser.

Did you experiment with the new WebTransport API [0] at all? It's only supported in Chromium browsers, but seems promising for this kind of use case.

[0] https://chromestatus.com/feature/4854144902889472

Re: Making an SSH client the hard way

#48

Post by bradfitz »

Spivak wrote: post #42

> To make this possible, we ported the following to WebAssembly: the Tailscale client, WireGuard®, a complete userspace network stack (from gVisor), and an SSH client. I love that they were clearly inspired by fly.io. Warms my heart that a random blog post with a good idea can spread like this.

Which blog post are you referring to?

But yes, we love Fly and use them (and they use us) and we share a slack channel between our two companies for casual banter.

Re: Making an SSH client the hard way

#49

Post by Asmod4n »

dgentry wrote: post #13
vngzs wrote: post #10

This is really cool and fun, but is this a safe way to run SSH clients? If, say, the adblock Chrome extension you're using gets bought by a malware operator and backdoored[0], now it also has SSH and VPN access. [0]: https://www.wired.co.uk/article/fake-chrome-extensions-malwa...

The Tailscale VPN client, the same one which runs on other devices, is compiled to WASM. It handles all of the key exchanges to connect to the tailnet. The SSH session is running as a WASM Tailscale client. The browser, opening connections from within the browser engine, doesn't have the keys for SSH or VPN access.

And then the addon intercepts the loading of the Wasm code, injects it’s own payload into it and has access to the keys.

Re: Making an SSH client the hard way

#50

Post by PaulWaldman »

> To make this possible, we ported the following to WebAssembly: the Tailscale client, WireGuard®, a complete userspace network stack (from gVisor), and an SSH client.

Would it be possible to bundle the same into a portable application allowing you to use Tailscale without installing it? My understanding is that currently if you can't install Tailscale on a client you need to use Subnet Router. https://tailscale.com/kb/1109/devices-without-tailscale/

Post reply on HN