Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale doesn't want your password

tailscale.com

Post reply on HN
Print view View original

151–160 of 316 posts

Re: Tailscale doesn't want your password

#151

Post by vladharbuz »

ksajadi wrote: post #135

I have an honest question, but am afraid that I get downvoted for reasons that perhaps relate to my question: Why is this on top of HN? Is it a novel invention by Tailscale? Are they the first company who’ve done it? Are they used by so many people (like GitHub) that this will have other implications? Does the article go to technical details of their implementation that relates to the dev crowd? Please, educate me, t…

I don't really know anything about Tailscale. But I really dislike passwords — I think they're very frustrating for users to use, and it feels like we should have found a technological solution to this problem by now. Passkeys seem to be a solution to this problem, but it's up to people to adopt them. I upvoted this post so that others might see a company implementing passkeys, and that this might encourage them to implement passkeys too. Once we have widespread enough support for passkeys, maybe we might finally ditch passwords.

(Or, maybe passkeys are bad, I don't know, but we need to have a conversation in order to find a better solution.)

Re: Tailscale doesn't want your password

#152

Post by nottorp »

kccqzy wrote: post #21
akomtu wrote: post #14

Earlier quoted context omitted.

e2e encryption is one forced update away from being plain text.

I trust big tech companies more than I trust startups or smaller tech companies. I have faith that neither Apple nor Google would do that. This is a personal belief based on chatting with Apple and Google employees. You don't have to agree.

> This is a personal belief based on chatting with Apple and Google employees.

Have you chatted with the Apple and Google CEOs? How about with the future Apple and Google CEOs?

Re: Tailscale doesn't want your password

#153

Post by thefz »

ksajadi wrote: post #135

I have an honest question, but am afraid that I get downvoted for reasons that perhaps relate to my question: Why is this on top of HN? Is it a novel invention by Tailscale? Are they the first company who’ve done it? Are they used by so many people (like GitHub) that this will have other implications? Does the article go to technical details of their implementation that relates to the dev crowd? Please, educate me, t…

It's a product a lot of people use and it is nice to be informed about its development. At least this news entry is not the n-th "here's my top life advice" from a 30 years-old.

Re: Tailscale doesn't want your password

#154

Post by NolF »

YPPH wrote: post #22

My work uses Microsoft SSO for everything. Passkeys aren't enabled though. And management won't enable them on Azure AD. Instead, they enable the tried and tested and ultra secure method of SMS based 2FA with a password. (This is sarcasm.) The alternative is the Microsoft authenticator app with its associated risk of approval fatigue. I have already had several malicious login attempts. Fortunately I'm attuned enough…

My employer uses the MS Auth app. Now when logging in, it shows a number on the screen that you have to type on the app and then use the finger print. Before it used to be the fingerprint only. Seems like a relatively effective way to ensure people are not just approving everything prompted by the app.

Re: Tailscale doesn't want your password

#155

Post by systemvoltage »

aetch wrote: post #139
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

The passkey people won’t give you a straightforward answer because you won’t like the answer. If the passkey is truly secure, you don’t get your key bak if you lose the passkey. If you make a copy of the passkey, the passkey purists will say it’s not “secure”. If you lose your phone and delete your existing login cookies you don’t get access again. If email or sms is the recovery method, you might not be able to logi…

> The passkey people won’t give you a straightforward answer because you won’t like the answer.

Well, then this culture needs to be condemned strongly.

Re: Tailscale doesn't want your password

#156

Post by crote »

taberiand wrote: post #81
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

Those issues are applicable to using password management tools generally, rather than specifically to passkeys, aren't they? It sounds to me like passkeys are a simpler and more secure approach that apply within the existing context that requires unique complex passwords for every account. In terms of solving those issues, a 1Password account configured on multiple devices with a secured accessible backup of the emer…

Not really. Every single password management tool allows plaintext export, so making a backup or transferring them to a different tool is trivial. You can even make a paper copy if you want to.

Passkeys, not so much. They are opaque blobs which are never supposed to leave the manager.

Re: Tailscale doesn't want your password

#157

Post by nottorp »

mdeeks wrote: post #143
ksajadi wrote: post #135

I have an honest question, but am afraid that I get downvoted for reasons that perhaps relate to my question: Why is this on top of HN? Is it a novel invention by Tailscale? Are they the first company who’ve done it? Are they used by so many people (like GitHub) that this will have other implications? Does the article go to technical details of their implementation that relates to the dev crowd? Please, educate me, t…

Mainly because Tailscale is popular with the HN crowd. Many people use it for their personal home networks, and some companies do to (we do at Instacart). The nice thing about this is it means you can invite anyone into your network without requiring them to have a Google/Apple/Github account. They just need a phone. It also means you can be much more confident inviting these people because they are unlikely to get p…

> Many people use it for their personal home networks, and some companies do to

To nitpick, you can't use just tailscale, you need to use tailscale and some authentication provider.

Re: Tailscale doesn't want your password

#158

Post by crote »

aniforprez wrote: post #101
rebeccaskinner wrote: post #91

Earlier quoted context omitted.

I see a lot of claims that passkeys are more secure than passwords with 2fa, but my understanding is that they are strictly less secure. As it stands right now, if someone wanted to compromise a service that I use 2fa with, they'd need to both obtain my physical device, and also get my password. Either one of those things may be relatively easy, but it's harder to do both- especially without my knowledge. With passke…

> With passkeys, if someone steals my physical device, then they have full access Unless they also have access to your fingerprints, face or something to that effect, they do not have access to your device. Every time I create a passkey, I am required by the device to provide authentication. I'm not sure if this is a hard requirement because all my devices have PINs, passwords and fingerprints but I assume that your…

Biometrics are not a technical requirement for passkeys, so your security model cannot rely on them being used. Moreover, as history has shown, the biometric security model is most likely flawed as your device will be covered in copies of your fingerprints anyways. It's a huge single-point-of-failure.

The "traditional" security model of a password vault on a computer and a 2FA token on a smartphone requires both devices to be compromised, Theft of either device is pointless, and even the theft of both is often insufficient as the password vault usually requires a passphrase.

Re: Tailscale doesn't want your password

#159

Post by crote »

n42 wrote: post #98
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

if you're someone who uses a password manager already, and is generating unique random passwords for every website, the only appreciable difference between a passkey and what you do today is: - the passkey is never transmitted anywhere when logging in, eliminating the largest attack vectors for stealing passwords - you can no longer manually type the passkey in on random devices that don't have your password manager…

Not quite.

The biggest difference is that websites seem to trust a passkey as both a password and a 2FA token at the same time. So security-wise it essentially means giving up 2FA altogether, as passkeys are about as secure as a password manager.

So for anyone with a password manager and 2FA tokens, passkeys are a downgrade.

Re: Tailscale doesn't want your password

#160

Post by crote »

woodruffw wrote: post #9
marcrosoft wrote: post #2

I don’t understand why someone would want to store all their credentials with one of the large tech companies. It seems like this makes it really easy for law enforcement to grab access to all accounts easily.

Passkeys are WebAuthn under the hood; they don't store your credentials with a large company any more than using a hardware token stores your credentials with Yubikey. Apple does some additional trickery to synchronize credentials between devices, but they get away with this because their devices have contained dedicated silicon for sensitive data management for years[1]. They have some user-facing documentation on h…

Except that passkeys are treated as both a password and token at the same time. They are the sole thing needed to access a website, so you are absolutely storing your credentials with a large tech company.
Post reply on HN