Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale doesn't want your password

tailscale.com

Post reply on HN
Print view View original

31–40 of 316 posts

Re: Tailscale doesn't want your password

#31

Post by hsn915 »

This sounds counter productive.

Third party authentication providers are a single point of failure, and usually they themselves require a password to authenticate you anyway.

If your gmail password is hacked, then effectively all your accounts on websites that use Google auth are also hacked.

Passkeys appear to also be handled by central services? At least that appears to be the case with Apple, according to the link in the post:

https://developer.apple.com/passkeys/

I personally think having a browser-managed "private key" (the same kind used for ssh auth) would be better, but now as a user you have to manage the multiple private keys you have associated with an account; a totally confusing concept for the average user.

Re: Tailscale doesn't want your password

#32

Post by shawnz »

rjzzleep wrote: post #17
QhwyF3AxE wrote: post #12

Earlier quoted context omitted.

This is a great point. And to respond to the other part of the parent comment about storing "all their credentials with one of the large tech companies" — you don’t even need to do that, if you don’t want to. Apple just extended their Credential Provider API such that passkeys can now be synced using external providers, meaning password manager apps can save and offer passkeys on iOS, iPadOS, and macOS. So you can ch…

You guys conveniently ignores the fact that Apple and Google are still the gatekeepers in that scenario.

But no more than they are the gatekeepers of your password when you use their keyboard software, right?

Re: Tailscale doesn't want your password

#33

Post by jabbany »

andrewmcwatters wrote: post #27

[flagged]

I'm pretty sure passkeys are just a rebranded version of virtual WebauthN tokens.

So while passkey secrets can be synced (unlike U2F physical tokens) they can also be implemented as being backed by a physical token (think Yubikey) that never goes om the cloud.

Re: Tailscale doesn't want your password

#34

Post by iknowstuff »

awayto wrote: post #30

I haven't yet looked into the inner mechanics of passkeys, and the link only talks about the first login. What is the experience like when a user wants to log in from a different system? They press the "Login with Passkey" button on Device 2, and then...?

It presents a qr code you can scan with the other device. You can try it on https://passkeys.io

Re: Tailscale doesn't want your password

#35

Post by pcthrowaway »

kccqzy wrote: post #21
akomtu wrote: post #14

Earlier quoted context omitted.

e2e encryption is one forced update away from being plain text.

I trust big tech companies more than I trust startups or smaller tech companies. I have faith that neither Apple nor Google would do that. This is a personal belief based on chatting with Apple and Google employees. You don't have to agree.

Regardless of how much you trust them, the fact that they can force a decryption of these keys (and selectively, per-user, no less) means that you are not in custody of your own authentication identity. Add to that, they can be legally compelled to take such a measure (and I'm sure they will in due time).

Compared to using, say, KeepassXC with a unique, secure password per vault. Now you can sync on iCloud or google drive, but neither Google nor Apple can decrypt the vault; the keepassXC maintainers presumably could make a malicious update (which you'd still have to accept, since the updates aren't forced on you), but that would also affect the security of everyone using KeepassXC (and potentially be much more harmful to the economy and society as a whole than the government is willing to accept in order to get intel on an individual person of interest)

Re: Tailscale doesn't want your password

#36

Post by belltaco »

YPPH wrote: post #22

My work uses Microsoft SSO for everything. Passkeys aren't enabled though. And management won't enable them on Azure AD. Instead, they enable the tried and tested and ultra secure method of SMS based 2FA with a password. (This is sarcasm.) The alternative is the Microsoft authenticator app with its associated risk of approval fatigue. I have already had several malicious login attempts. Fortunately I'm attuned enough…

> I have already had several malicious login attempts

Doesn't that mean they know your username and password? How does that happen so easily.

Re: Tailscale doesn't want your password

#38

Post by iknowstuff »

lukeschlather wrote: post #24
woodruffw wrote: post #9

Earlier quoted context omitted.

Passkeys are WebAuthn under the hood; they don't store your credentials with a large company any more than using a hardware token stores your credentials with Yubikey. Apple does some additional trickery to synchronize credentials between devices, but they get away with this because their devices have contained dedicated silicon for sensitive data management for years[1]. They have some user-facing documentation on h…

Apple can synchronize the passkey between devices. As far as I understand I cannot. So I don't really understand how this can be said to be a hardware security token. It seems pretty clear that it is as far as I am concerned, but that Apple has nothing constraining them from copying my passkeys. Which seems like the worst of both worlds.

You can use 3rd party password managers to sync your passkeys however you please.

Apple has no access to keychain data: https://support.apple.com/en-us/HT213305

Re: Tailscale doesn't want your password

#39

Post by jabbany »

systemvoltage wrote: post #19

Like many round trips we have made, I suspect in the year 2035, we’ll look back and say to ourselves: “Yeah, password was super based. Just copy paste it in the box and you’re logged in. Can store it anywhere, even in a notebook. Safekeep it by printing them. No need for HyperBigTechCorp. Portable. Those gray beards had it right the whole time.” Can we please stop the bandwagon for a moment and inquire about the down…

Technologically there's nothing really bad about them (imagine a managed version of ssh keypairs). Technically they could even be backed by physical devices like Yubikeys and never touch the cloud.

My worry is the actual implementation, where platforms might lock you into their cloud as the sole provider simply by not implementing interoperability...

Re: Tailscale doesn't want your password

#40

Post by brenns10 »

belltaco wrote: post #36
YPPH wrote: post #22

My work uses Microsoft SSO for everything. Passkeys aren't enabled though. And management won't enable them on Azure AD. Instead, they enable the tried and tested and ultra secure method of SMS based 2FA with a password. (This is sarcasm.) The alternative is the Microsoft authenticator app with its associated risk of approval fatigue. I have already had several malicious login attempts. Fortunately I'm attuned enough…

> I have already had several malicious login attempts Doesn't that mean they know your username and password? How does that happen so easily.

They said login attempt, not successful login. So no.
Post reply on HN