Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale doesn't want your password

tailscale.com

Post reply on HN
Print view View original

261–270 of 316 posts

Re: Tailscale doesn't want your password

#261

Post by JohnFen »

stavros wrote: post #203
drdaeman wrote: post #97

Earlier quoted context omitted.

Which is going to be a major pain in the ass. Every time you sign up for something you have to perform a complex rite: 1) sign up or add a portable authenticator (Yubikey or software token in something cross-platform like 1Password); and 2) run around the house, grabbing up all the different devices you have that aren't transparently synchronizing (so, something from Apple, something from Microsoft, something from Go…

I don't understand the issue here. Passkeys are just a way for a site to ask your browser for credentials. If you don't like the current solutions, write your own, and it'll work with all Passkeys-enabled sites. Why do you need the standard to be different?

Writing your own is only an option as long as everyone ignores attestation. Which might be what everyone does -- but the standard absolutely supports attestation, so there's no guarantee.

Re: Tailscale doesn't want your password

#262

Post by hooverd »

fragmede wrote: post #29
systemvoltage wrote: post #19

Like many round trips we have made, I suspect in the year 2035, we’ll look back and say to ourselves: “Yeah, password was super based. Just copy paste it in the box and you’re logged in. Can store it anywhere, even in a notebook. Safekeep it by printing them. No need for HyperBigTechCorp. Portable. Those gray beards had it right the whole time.” Can we please stop the bandwagon for a moment and inquire about the down…

How do you bootstrap it? You get robbed at gunpoint by some ruffians and they take your wallet, cellphone, keys, and laptop. Hopefully they can't get into your accounts, but never mind that, how do you get back in to everything?

You don't.

Re: Tailscale doesn't want your password

#263

Post by zamadatix »

stavros wrote: post #251
zamadatix wrote: post #250

Earlier quoted context omitted.

Well, that's my point. People are referring to what is possible today but your "misconceptions" are responses to what could be possible in the future.

Well, I disagree. People aren't saying "I want to use this today and can't because X is missing", they're saying "I'm opposed to this technology because X will never be possible", when it will be. Look at this comment, as the first example I found: https://news.ycombinator.com/item?id=36237683 It basically says "Passkeys = USB keys", which is wrong. If you don't like the tradeoffs that specific authenticator makes, u…

While I do agree that thread is different, it'd make sense to reply to that thread about it instead of this one.

Re: Tailscale doesn't want your password

#264

Post by hooverd »

mynameisvlad wrote: post #64
d0mine wrote: post #51

Earlier quoted context omitted.

There is theory and there is practice. What grandparent comment says is the likely outcome in practice

... Unless you care about that and use a Yubikey or other physical security key. There is absolutely nothing stopping you from doing so as long as your Yubikey supports WebAuthN (the latest do). You are prompted to use another phone or physical security key if a resident key isn't found on your device, and even if it is, you are given the option of doing so instead of using the one found. This is not a hypothetical f…

Unless the website decides to enforce attestation and not allow that.

Re: Tailscale doesn't want your password

#265

Post by JohnFen »

n42 wrote: post #98
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

if you're someone who uses a password manager already, and is generating unique random passwords for every website, the only appreciable difference between a passkey and what you do today is: - the passkey is never transmitted anywhere when logging in, eliminating the largest attack vectors for stealing passwords - you can no longer manually type the passkey in on random devices that don't have your password manager…

> you can no longer manually type the passkey in on random devices that don't have your password manager on it

This is a huge problem, though. My password manager has no online component, and only runs on my phone. On purpose.

When I use it, the password manager shows me the password that I need, and I type it in manually.

I could change to a different method, but then I lose a lot of flexibility. I can no longer log into things from machines other than my own.

Things like Yubikey address some of this, but then I can no longer log into machines unless I have sufficient physical access to plug the key in.

To be clear, I'm not arguing that any of this means passkeys aren't desirable, but I am saying this to point out that passkeys are not functionally equivalent to passwords, and passkeys do restrict some kinds of use.

Re: Tailscale doesn't want your password

#266

Post by stavros »

zamadatix wrote: post #263
stavros wrote: post #251

Earlier quoted context omitted.

Well, I disagree. People aren't saying "I want to use this today and can't because X is missing", they're saying "I'm opposed to this technology because X will never be possible", when it will be. Look at this comment, as the first example I found: https://news.ycombinator.com/item?id=36237683 It basically says "Passkeys = USB keys", which is wrong. If you don't like the tradeoffs that specific authenticator makes, u…

While I do agree that thread is different, it'd make sense to reply to that thread about it instead of this one.

I don't think it is different. I mostly see people dismissing Passkeys as a technology because of X or Y thing that "they don't do", when that's either a mistaken assumption, or something they don't do right now.

Re: Tailscale doesn't want your password

#267

Post by piloto_ciego »

fps wrote: post #259

Modern password managers run into issues regularly that still require a user to copy/paste a password out of a secure location. I don't know what the solution is for these situations with passkeys, but I know I don't trust password managers to do it right. I've used iCloud, Google Chrome, Lastpass, and 1password, and they all break consistently in a few scenarios. Three that come to mind are: - SSO or other systems w…

I don’t know, I’ve found quite a few work arounds for stuff like this with BitWarden where the experience is pretty seamless and I routinely deal with all of these issues except SSO.

BitWarden has its problems but generally I find the experience pretty good - indeed far superior to the other services you mentioned. The ability to use “secure notes” and the convenient way that has been implemented in BW has allowed me to be fine in all the scenarios you’re mentioning.

Of course, you’re right, you still have to copy the password in somewhere, but ultimately I feel like that’s a lower threat if properly handled than what I used to do (shitty insecure passwords).

The other thing is I barely ever use the browser extension for the password manager. All of the browser extensions I’ve tried other than BitWarden have been janky and even that’s only ok. Still, try BW I like it way better than lastpass and 1password.

Re: Tailscale doesn't want your password

#268

Post by stavros »

JohnFen wrote: post #261
stavros wrote: post #203

Earlier quoted context omitted.

I don't understand the issue here. Passkeys are just a way for a site to ask your browser for credentials. If you don't like the current solutions, write your own, and it'll work with all Passkeys-enabled sites. Why do you need the standard to be different?

Writing your own is only an option as long as everyone ignores attestation. Which might be what everyone does -- but the standard absolutely supports attestation, so there's no guarantee.

I don't see attestation as such a big problem. If a site doesn't support your (perfectly compliant) client because of attestation, complain to that site so they know they lost a sale because of it. Companies aren't willing to lose customers for no reason.

Re: Tailscale doesn't want your password

#269

Post by drdaeman »

stavros wrote: post #203
drdaeman wrote: post #97

Earlier quoted context omitted.

Which is going to be a major pain in the ass. Every time you sign up for something you have to perform a complex rite: 1) sign up or add a portable authenticator (Yubikey or software token in something cross-platform like 1Password); and 2) run around the house, grabbing up all the different devices you have that aren't transparently synchronizing (so, something from Apple, something from Microsoft, something from Go…

I don't understand the issue here. Passkeys are just a way for a site to ask your browser for credentials. If you don't like the current solutions, write your own, and it'll work with all Passkeys-enabled sites. Why do you need the standard to be different?

> If you don't like the current solutions, write your own

Do you see all the large vendors cooperating on letting third party Passkey implementations seamlessly replace their own? I don't. Do you think it is realistically (and not theoretically) possible to implement a new solution that would provide the security properties as good as sum of all individual fragmented options? I'm not sure. And even if someone spends enormous resources and makes it all real, there's still that issue of a Yubikey in a safe.

Sorry, but if N implementations require that inconvenient process I've explicitly outlined, having N+1 option still won't fix it.

And it's the standard's fault, not "the implementations aren't there yet". The standard had not addressed this, even though it's pretty much obvious this is going to be an issue on the very first day someone who isn't an ideal customer (100% lifetime loyal to one single vendor) uses Passkeys.

When I'm setting up SSH keys on a host I can either give it a list of all my keys, or CA certificate to trust, but I don't have to grab all the individual devices. Here, I must.

Attestation is another potential issue, but it's not a problem today.

Re: Tailscale doesn't want your password

#270

Post by JohnFen »

vladharbuz wrote: post #151
ksajadi wrote: post #135

I have an honest question, but am afraid that I get downvoted for reasons that perhaps relate to my question: Why is this on top of HN? Is it a novel invention by Tailscale? Are they the first company who’ve done it? Are they used by so many people (like GitHub) that this will have other implications? Does the article go to technical details of their implementation that relates to the dev crowd? Please, educate me, t…

I don't really know anything about Tailscale. But I really dislike passwords — I think they're very frustrating for users to use, and it feels like we should have found a technological solution to this problem by now. Passkeys seem to be a solution to this problem, but it's up to people to adopt them. I upvoted this post so that others might see a company implementing passkeys, and that this might encourage them to i…

> maybe we might finally ditch passwords.

I sure hope not.

I am 100% in favor of alternative solutions for those who struggle with passwords, but I also want the option to continue to use passwords.

Post reply on HN