Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale doesn't want your password

tailscale.com

Post reply on HN
Print view View original

111–120 of 316 posts

Re: Tailscale doesn't want your password

#111

Post by [deleted] »

sgk284 wrote: post #102
rebeccaskinner wrote: post #91

Earlier quoted context omitted.

I see a lot of claims that passkeys are more secure than passwords with 2fa, but my understanding is that they are strictly less secure. As it stands right now, if someone wanted to compromise a service that I use 2fa with, they'd need to both obtain my physical device, and also get my password. Either one of those things may be relatively easy, but it's harder to do both- especially without my knowledge. With passke…

> if someone steals my physical device, then they have full access Apple protects passkeys via FaceID or TouchID. If you're satisfied with biometrics as a 2nd factor, then there is no regression in your scenario.

[deleted]

Re: Tailscale doesn't want your password

#112

Post by drdaeman »

PhilipRoman wrote: post #109
dfabulich wrote: post #88

Earlier quoted context omitted.

It's way simpler than you think. You reset your passkey the same way you'd reset your password. So, how do you reset your password when you forget it? Well, it depends. Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there. Som…

The email password reset feature is an overlooked part of modern security. It has become sort of like a master key for every service. Combined with password reuse it becomes really risky (but oh, so convenient).

This approach basically makes all the security provided by the passkeys void, as the whole system becomes no better than login-via-email-link or login-via-SMS-code scheme.

Re: Tailscale doesn't want your password

#113

Post by kune »

The comments are full of statements regarding security capabilities for passkeys. But there is no public specification that even defines requirements for the exchange of passkeys between devices. Google and Apple make statements on their websites regarding the security, but all of it is practically unverifiable. Please note that end-to-end encryption is useless, if you are not controlling all the endpoints.

Sites of course could use the device public key extension of the WebAuthn protocol, to rely on more than a private key copied intransparently between devices, but I wonder, who will even know about it and actually use it. Google has stated they support the extension, but I cannot find a statement by Apple. A question whether DevPubKey is supported by Apple is unanswered on the Apple Developer Forums.

Re: Tailscale doesn't want your password

#114

Post by lrhegeba »

akomtu wrote: post #44
kccqzy wrote: post #21

Earlier quoted context omitted.

I trust big tech companies more than I trust startups or smaller tech companies. I have faith that neither Apple nor Google would do that. This is a personal belief based on chatting with Apple and Google employees. You don't have to agree.

When Apple or Google receives a request to give user data, and they get thousands of such requests, they compare the cost of complying and the cost of not complying. I'll tell you an open secret that such companies are doormat-level compliant and are very very proud of that.

please stop spreading unfounded and vicious rumours - or show us some proof.

Re: Tailscale doesn't want your password

#115

Post by eastbound »

woodruffw wrote: post #85
croes wrote: post #75

Earlier quoted context omitted.

But Appel could deactivate E2E encryption without your knowledge to get all your keys. For instance on request of government agencies.

This is indistinguishable from the "I don't trust my computer" threat model. Apple could also surreptitiously scrape your screen or copy your processes' memory.

It’s not, because law enforcement considers your computer as private property, while anything you upload on the cloud is seizable without warrant. I’m not joking, it was rapported on HN at the time of the Snowden leaks that NSA can legally monitor your data as long as you transmit it over the wire.

Re: Tailscale doesn't want your password

#117

Post by noAnswer »

kccqzy wrote: post #21
akomtu wrote: post #14

Earlier quoted context omitted.

e2e encryption is one forced update away from being plain text.

I trust big tech companies more than I trust startups or smaller tech companies. I have faith that neither Apple nor Google would do that. This is a personal belief based on chatting with Apple and Google employees. You don't have to agree.

Remember Snoden. IIRC only two or three guys in all of Skype knew about/worked on the backdoor. Everyone else would have sworn it is end to end encrypted all the time.

Re: Tailscale doesn't want your password

#118

Post by croes »

woodruffw wrote: post #85
croes wrote: post #75

Earlier quoted context omitted.

But Appel could deactivate E2E encryption without your knowledge to get all your keys. For instance on request of government agencies.

This is indistinguishable from the "I don't trust my computer" threat model. Apple could also surreptitiously scrape your screen or copy your processes' memory.

The difference is the effort it takes. Deactivating E2E is just a flag.

Re: Tailscale doesn't want your password

#119

Post by freitasm »

decryption wrote: post #74
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

You need to add multiple passkeys so if one breaks, you can still access the service. Ditto for Yubikeys (which can be added as a passkey), you need more than one so if you lose it you can still access.

Except the Tailscale implementation doesn't allow you to add more passkeys to an account. There is no "one account multiple keys" here.

Re: Tailscale doesn't want your password

#120

Post by drdaeman »

jjav wrote: post #103
dfabulich wrote: post #88

Earlier quoted context omitted.

It's way simpler than you think. You reset your passkey the same way you'd reset your password. So, how do you reset your password when you forget it? Well, it depends. Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there. Som…

> (Of course, it's possible to have a site that has no way to reset your password, and just assumes that you'll never forget your password. Similarly, those sites could have no way to reset your passkey. In that case, the problem is as you say: there'd be no way to recover your keys if you lost access to them.) Isn't this the catch though (I haven't been following passkey work much)? Every site knows users will absol…

There's more. Password recovery means that you're changing your password. Every single password reset flow does what it says on the tin - resets your password. After it's complete, old password is gone, account has a new password. This is logical.

For Passkeys, going through the recovery flow may indicate two possible things: 1) that you lost the Passkey and going through the recovery to replace it with a new one; or 2) that you merely want to log in on a different device where the original Passkey is not available.

This, of course, is going to work in practice - much worse designs had worked after all. But it's all logically unsound, and not really addressed by standard bodies or large implementers. It's not a big deal and there are ways to make it logical - but because it's not addressed it's gonna be a mess.

Post reply on HN