161–170 of 316 posts
Are people still happy about Tailscale being a user land version of wireguard? The last benchmarks I saw showed an ~ 50% performance penalty over the native kernel level implementation.
Plenty of use cases where performance doesn't really matter, and getting it working is orders of magnitude easier than wireguard. I've been using it for about a year now, and I rarely notice it even exists.
Earlier quoted context omitted.
Passkeys are just a standard protocol, i.e. there'd just be a single "Use Passkey" button.
Yeah it seems sort of like web notifications and I find it quite centralized, favoring the browser vendor. So I'll have to see what it's like in practice. But I hope it doesn't take off.
Earlier quoted context omitted.
When Apple or Google receives a request to give user data, and they get thousands of such requests, they compare the cost of complying and the cost of not complying. I'll tell you an open secret that such companies are doormat-level compliant and are very very proud of that.
please stop spreading unfounded and vicious rumours - or show us some proof.
Earlier quoted context omitted.
You guys conveniently ignores the fact that Apple and Google are still the gatekeepers in that scenario.
Yes you need to trust your operating system developer to some extent. If your threat model includes not trusting the company that writes the source code to your OS…don’t use computers I guess?
For example in the case of email, you generaly dont worry about google reading your email but we should definitely be concerned if gmail allows send & recieve from only few domains or providers it chooses.
Earlier quoted context omitted.
no, this is false. this is different than 2FA. you can reset your passkey just like you can a password.
You can if there is a provision for that. As mentioned before it doesn't look like Taiscale allows you to either have more than one passkey or reset the passkey.
Earlier quoted context omitted.
if you're someone who uses a password manager already, and is generating unique random passwords for every website, the only appreciable difference between a passkey and what you do today is: - the passkey is never transmitted anywhere when logging in, eliminating the largest attack vectors for stealing passwords - you can no longer manually type the passkey in on random devices that don't have your password manager…
No, it's not "just a long password". Here are the main benefits not mentioned, which a password cannot offer, regardless of how securely it is stored: - Phishing protection - passkey credential will be uniquely bound to a domain, so you cannot be phished - Keys cannot be exfiltrated from the hardware, so even if your password manager is compromised, your key would still protect you - Duplication protection - synced c…
"Passkeys allow you to go passwordless — rather than a password that can still be phished — you get strong credential that syncs securely across your devices, using your chosen password/passkey manager." This sentence doesn't quite make grammatical sense to me. Is there a typo or two here, or am I missing something?
you get _a_ strong credential, or you get _strong credentials_ , probably There's a lot going on in there!
I have an honest question, but am afraid that I get downvoted for reasons that perhaps relate to my question: Why is this on top of HN? Is it a novel invention by Tailscale? Are they the first company who’ve done it? Are they used by so many people (like GitHub) that this will have other implications? Does the article go to technical details of their implementation that relates to the dev crowd? Please, educate me, t…
Good. I get they don't want to be responsible for keeping user credentials. But requiring permission from a big tech company to manage or access your own networks boggles my mind and made me not use it. Now if only they supported this for setting up the entire account too, as opposed to additional users only. I hope that's coming.
If I understood the docs correctly, it looks like they allow signing up with custom oidc provider.
May be worth looking into it if your only concern with their service is delegating access via big tech.
Earlier quoted context omitted.
if you're someone who uses a password manager already, and is generating unique random passwords for every website, the only appreciable difference between a passkey and what you do today is: - the passkey is never transmitted anywhere when logging in, eliminating the largest attack vectors for stealing passwords - you can no longer manually type the passkey in on random devices that don't have your password manager…
Not quite. The biggest difference is that websites seem to trust a passkey as both a password and a 2FA token at the same time. So security-wise it essentially means giving up 2FA altogether, as passkeys are about as secure as a password manager. So for anyone with a password manager and 2FA tokens, passkeys are a downgrade .