81–90 of 108 posts
Let me say again, though I admire it, I'd never use this. I like to sleep soundly, as irrational as that may be.
Earlier quoted context omitted.
If the extension in question has the read/modify all websites permission, why would it not be able to access your email or password manager?
Who's using extensions in a work context anyway? I only use an ad-blocker because it's safer from a malware perspective.
literally everyone?
Earlier quoted context omitted.
From the article > Web-based SSH clients aren’t new. Nearly every VPS and cloud provider already lets you connect to your VMs from the web — so how is this different? This is clearly isn't for everyone, but if you need or already use something like that, then I think this has a chance to be more secure than some other options.
I really liked Chrome SSH extension but now I've returned to using the ssh command line client on all three platforms. The issue is wiring up the browser-hosted application with a custom network inside the browser. It's a truly interesting but highly disruptive concept and I'm curious how it will play out. Perhaps in the future every program will statically compile its own TCP stack and talk over RAW sockets, but...…
> Perhaps in the future every program will statically compile its own TCP stack and talk over RAW sockets
A surprising number of common applications already do this.
I ran into a recent bug[1] caused by a Windows update where TLS handshakes would randomly fail. But this only presented in a few apps. Browsers and .NET apps were all completely unaffected because they don't use the OS level functionality to handle TLS.
[1]: This is a link to the KB that fixed the issue, which was introduced in the 22H2 cumulative update (search for "SEC_E_ILLEGAL_MESSAGE"): https://support.microsoft.com/en-us/topic/october-25-2022-kb...
This significantly increases the threat model for your remote servers to include all sorts of remote attacks through the web, including: * garden-variety web attacks (i.e., XSS, CRSF, etc) * attacks that might become viable against the browser (for example, Mobile Safari has a history of vulnerabilities) * various attacks against the backend web server (API attacks) * attacks against the WASM layer * CDN injections *…
Earlier quoted context omitted.
If the extension in question has the read/modify all websites permission, why would it not be able to access your email or password manager?
Who's using extensions in a work context anyway? I only use an ad-blocker because it's safer from a malware perspective.
Earlier quoted context omitted.
You‘d have to redirect all network usage (i.e. the sockets API or your platform‘s equivalent) through the custom stack, which is possible if you can rebuild the source or by using something like LD_PRELOAD for binaries, but can get very tricky in the general case. There‘s an utility called SSHuttle that does something similar for SSH instead of Tailscale/Wireguard: It redirects all sockets usage to go through an SSH…
SSHuttle was created by the CEO/co-founder of Tailscale :)
In the old days, people said you shouldn't write crypto in JavaScript because it was somehow insecure. Have those concerns gone away with WebAssembly and https everywhere?
Nowadays, it's a lot harder to get past browser security and people run all sorts of applications in browsers such as banking, business critical SAAS, email, etc. So, perfectly fine to include some crypto in that and probably not optional to do so for a lot of applications.
What's still true is that you should not be rolling your own crypto libraries and instead use libraries from reputable sources that have been scrutinized by people that know what they are doing. That's true whether you use javascript, C or whatever. And of course with web assembly you can just compile those libraries and use them in a browser sandbox.
Earlier quoted context omitted.
Tailscale SSH's check mode ( https://tailscale.com/kb/1193/tailscale-ssh/#configure-tails... ) is meant to address the issue of "rogue process starts an SSH connection". For truly sensitive applications, you can set the check period to be "1s" to always require it.
Hmm. If the problem is that Tailscale SSH doesn’t strongly associate the person authenticating with the connection being authenticated, asking the person to reauthenticate seems like a pretty weak solution.
No check mode reuses the auth of the tailscale client, check mode authenticates the ssh connection itself
One of the things that Teleport lacks (IMO) is Wireguard
In the old days, people said you shouldn't write crypto in JavaScript because it was somehow insecure. Have those concerns gone away with WebAssembly and https everywhere?
I think the consensus is still that you can't write side-channel/timing proof crypto in (most) Javascript (runtimes) - but that with webcrypto(?) most runtimes will provide the secure crypto primitives you need in order to do (secure) crypto with Javascript?
However on the bright side performance.now() has a much worse resolution on most browsers, making timing attacks harder.