Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale doesn't want your password

tailscale.com

Post reply on HN
Print view View original

71–80 of 316 posts

Re: Tailscale doesn't want your password

#71

Post by ec109685 »

shortcake27 wrote: post #60
tiffanyh wrote: post #41

Apple Slightly off topic: did Apple just make it super easy for law enforcement to unlock your phone & passkeys as part of iOS 17? > ”Apple ID. Securely sign in to your iPhone using a nearby device or any email address or phone number listed in your account.” https://www.apple.com/ios/ios-17-preview/

What the heck? SMS as a second factor was considered bad practice ten years ago. Allowing it to be used as the only factor to access your entire Apple ID is absolute negligence as SIM-swapping is still and forever will be trivial. I'm genuinely shocked. Engineers at Apple must have been screaming into their pillows at night as they watched some incompetent BA ignore all advice and force this through.

My guess is that they aren’t making things less secure. There are flows that let you reset your password but don’t let you login today, so letting you login via those flows would be a step up in usability.

If you don’t have your phone as your second factor or can’t use phone today to reset password, then I don’t expect you’ll be able to login via that mechanism.

Re: Tailscale doesn't want your password

#72

Post by amanzi »

shortcake27 wrote: post #60
tiffanyh wrote: post #41

Apple Slightly off topic: did Apple just make it super easy for law enforcement to unlock your phone & passkeys as part of iOS 17? > ”Apple ID. Securely sign in to your iPhone using a nearby device or any email address or phone number listed in your account.” https://www.apple.com/ios/ios-17-preview/

What the heck? SMS as a second factor was considered bad practice ten years ago. Allowing it to be used as the only factor to access your entire Apple ID is absolute negligence as SIM-swapping is still and forever will be trivial. I'm genuinely shocked. Engineers at Apple must have been screaming into their pillows at night as they watched some incompetent BA ignore all advice and force this through.

It's true - I have to use SMS as second factor to log into iCloud. Apple don't let you use a generic OTP as MFA - the only other option is to get a notification on your iPhone or iPad. I don't have an iPhone and I rarely have my iPad with me, so SMS is the only way I can log in to icloud.com.

Re: Tailscale doesn't want your password

#74

Post by decryption »

zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

You need to add multiple passkeys so if one breaks, you can still access the service.

Ditto for Yubikeys (which can be added as a passkey), you need more than one so if you lose it you can still access.

Re: Tailscale doesn't want your password

#75

Post by croes »

jesseendahl wrote: post #46
lukeschlather wrote: post #24

Earlier quoted context omitted.

Apple can synchronize the passkey between devices. As far as I understand I cannot. So I don't really understand how this can be said to be a hardware security token. It seems pretty clear that it is as far as I am concerned, but that Apple has nothing constraining them from copying my passkeys. Which seems like the worst of both worlds.

>So I don't really understand how this can be said to be a hardware security token. No one claimed it's a hardware security token, but the private keys are stored in iCloud Keychain, which is end-to-end encrypted. Apple cannot access your private keys even if iCloud is compromised by an external attacker or employee. If you're curious about the security engineering, you should watch the "Synchronizing secrets" part o…

But Appel could deactivate E2E encryption without your knowledge to get all your keys. For instance on request of government agencies.

Re: Tailscale doesn't want your password

#76

Post by benatkin »

Aaron2222 wrote: post #61
benatkin wrote: post #50

TL;DR Google, Microsoft, GitHub, Apple, Apple’s macOS and iOS, Google Chrome and Android, as well as 1Password, Yubikey Yay. https://indieweb.org/NASCAR_problem

Passkeys are just a standard protocol, i.e. there'd just be a single "Use Passkey" button.

Yeah it seems sort of like web notifications and I find it quite centralized, favoring the browser vendor. So I'll have to see what it's like in practice. But I hope it doesn't take off.

Re: Tailscale doesn't want your password

#77

Post by croes »

kccqzy wrote: post #4
marcrosoft wrote: post #2

I don’t understand why someone would want to store all their credentials with one of the large tech companies. It seems like this makes it really easy for law enforcement to grab access to all accounts easily.

When you use passkeys with either Apple's iCloud Keychain or Google Password Manager, the key material is end-to-end encrypted. Law enforcement cannot get your passkeys through these two big tech companies.

>Law enforcement cannot get your passkeys through these two big tech companies.

Of course they can, just not from the stored cloud data. But that's just software. One little patch and your cloud sync is without E2E.

Re: Tailscale doesn't want your password

#78

Post by zoomTo125 »

decryption wrote: post #74
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

You need to add multiple passkeys so if one breaks, you can still access the service. Ditto for Yubikeys (which can be added as a passkey), you need more than one so if you lose it you can still access.

What happens if some websites don't allow you to add more than one passkey? Now, you need to keep track of which site has backup key, and which site doesn't have one. Also, the website needs to store multiple public keys now.

Re: Tailscale doesn't want your password

#80

Post by lukeschlather »

iknowstuff wrote: post #38
lukeschlather wrote: post #24

Earlier quoted context omitted.

Apple can synchronize the passkey between devices. As far as I understand I cannot. So I don't really understand how this can be said to be a hardware security token. It seems pretty clear that it is as far as I am concerned, but that Apple has nothing constraining them from copying my passkeys. Which seems like the worst of both worlds.

You can use 3rd party password managers to sync your passkeys however you please. Apple has no access to keychain data: https://support.apple.com/en-us/HT213305

Could you give an example? That support article doesn't mention anything about it. I do recall reading something about that recently, but I read the article and it it made no mention of what syncing passkeys actually means. It sounds like theoretically I could write an app that uses the same APIs Apple uses to sync encrypted credentials between TPMs. But "however you please" sounds suspiciously like "however you please, as long as you don't sync it to anywhere Apple can't vouch for the safety of the keys."

Which again, seems like the worst of both worlds.

Post reply on HN