>To make this possible, we ported the following to WebAssembly: the Tailscale client, WireGuard®, a complete userspace network stack (from gVisor), and an SSH client.
Wow, and they're proud of it.
Making an SSH client the hard way
91–100 of 108 posts
Re: Making an SSH client the hard way
#92Earlier quoted context omitted.
Given the apparent (yet possibly unfounded) concern, it might be useful to discuss this issue in the blog post. Would you consider updating it?
Doesn't the post say exactly what the parent comment did? It explains the process that they came up with the WASM Tailscale, and how it authorizes and works. If anything, the parent comment just paraphrased the article.
It doesn't paragraph, this is the important sentence
> Connections opened from the browser engine don't get the ability to reach the tailnet.
That was not really explained in the article. Maybe it's obvious to some people, but I'm sure it's not for many.
Re: Making an SSH client the hard way
#93Earlier quoted context omitted.
A browser extension cannot access your email or password manager. But it can use this new security hole created by tailscale.
If the extension in question has the read/modify all websites permission, why would it not be able to access your email or password manager?
Not OP, but...my email and password managers are not websites. I have a local app that does email, I have a local app that does password management. So the extension could certainly access passwords I put into my browser, but I don't see a vector to the "keys to the kingdom" so to speak.
Re: Making an SSH client the hard way
#94This is really cool and fun, but is this a safe way to run SSH clients? If, say, the adblock Chrome extension you're using gets bought by a malware operator and backdoored[0], now it also has SSH and VPN access. [0]: https://www.wired.co.uk/article/fake-chrome-extensions-malwa...
I believe that replacing vscode.exe that you just downloaded is entirely possible with extension. So if you’ve got compromised browser, it’s gotta be hard to stay safe elsewhere. Lots of attack vectors. Better don’t get infected.
Re: Making an SSH client the hard way
#95Earlier quoted context omitted.
Who's using extensions in a work context anyway? I only use an ad-blocker because it's safer from a malware perspective.
React Developer Tools, for example.
Ah, thanks. I'm more on sysadmin side for my day job, and didn't even know about this. I'll have to keep it in mind as I've been dabbling with learning a modern web framework and React was a candidate.
Re: Making an SSH client the hard way
#96Will Tailscale SSH support FreeBSD any time soon?
Re: Making an SSH client the hard way
#97>To make this possible, we ported the following to WebAssembly: the Tailscale client, WireGuard®, a complete userspace network stack (from gVisor), and an SSH client. Wow, and they're proud of it.
It's a pretty good approach and pretty hard to pull off. I'd be proud of it too.
Re: Making an SSH client the hard way
#98Earlier quoted context omitted.
It will never go away because you can't guarantee constant time algorithms will be implemented as such when transformed by a JIT.
If machine code can issue the necessary hints to the hardware to skip all time-variant optimizations, why couldn‘t the same work for a WASM runtime?
It could, but you need a lot of work on a lot of layers, possibly routed through an entire standards committee, to get it done. If it ever happens it's going to be a long time.
Re: Making an SSH client the hard way
#99Earlier quoted context omitted.
You‘d have to redirect all network usage (i.e. the sockets API or your platform‘s equivalent) through the custom stack, which is possible if you can rebuild the source or by using something like LD_PRELOAD for binaries, but can get very tricky in the general case. There‘s an utility called SSHuttle that does something similar for SSH instead of Tailscale/Wireguard: It redirects all sockets usage to go through an SSH…
SSHuttle was created by the CEO/co-founder of Tailscale :)
that's a bit worrying
there's a rather large misunderstanding on its github page:
> You can't use openssh's PermitTunnel feature because it's disabled by default on openssh servers; plus it does TCP-over-TCP, which has terrible performance.
it doesn't do TCP over TCP, it's a bytestream over TCP (exactly the same as shuttle)
something like OpenVPN running in TCP mode would be TCP over TCP
Re: Making an SSH client the hard way
#100This is really cool and fun, but is this a safe way to run SSH clients? If, say, the adblock Chrome extension you're using gets bought by a malware operator and backdoored[0], now it also has SSH and VPN access. [0]: https://www.wired.co.uk/article/fake-chrome-extensions-malwa...
The Tailscale VPN client, the same one which runs on other devices, is compiled to WASM. It handles all of the key exchanges to connect to the tailnet. The SSH session is running as a WASM Tailscale client. The browser, opening connections from within the browser engine, doesn't have the keys for SSH or VPN access.
The wasm code runs in the browser, hence the keys live in browser memory, so the browser has access to the keys.