11–20 of 24 posts
Earlier quoted context omitted.
Yeah, they definitely need to spend 5 minutes to remove the spurious slides that don't actually provide any information.
This took me more than 5 minutes, but do you mean something like this? https://tailscale-dev-git-xe-no-fun-allowed-tailscale.vercel...
I see a lot of mention of folks of using tailscale for their friend group to access stuff.. but the free plan seems to max out at 3 users, with an exception for foss projects. What am I missing? How do I use tailscale for my 10ish friends and me to play minecraft without paying hundreds a year?
I see a lot of mention of folks of using tailscale for their friend group to access stuff.. but the free plan seems to max out at 3 users, with an exception for foss projects. What am I missing? How do I use tailscale for my 10ish friends and me to play minecraft without paying hundreds a year?
An interesting article overall, but I think authenticating a user based on their IP address is probably the worst security advice I've seen. It's probably ripe for attack with ARP poisoning, IP spoofing, etc.
It only authenticates it _after_ all the WireGuard bits. So it's not really auth by IP address, but auth by wireguard key identity, from which we know your identity. There's no IP spoofing possible. And ARP isn't even in the picture for an L3 protocol.
I see a lot of mention of folks of using tailscale for their friend group to access stuff.. but the free plan seems to max out at 3 users, with an exception for foss projects. What am I missing? How do I use tailscale for my 10ish friends and me to play minecraft without paying hundreds a year?
An interesting article overall, but I think authenticating a user based on their IP address is probably the worst security advice I've seen. It's probably ripe for attack with ARP poisoning, IP spoofing, etc.
(I work at Tailscale) It only authenticates it _after_ all the WireGuard bits. So it's not really auth by IP address, but auth by wireguard key identity, from which we know your identity. There's no IP spoofing possible. And ARP isn't even in the picture for an L3 protocol.
A malicious game on my phone can't ssh to my server if I do normal authentication, but with this IP/WG authentication it can...
Earlier quoted context omitted.
(I work at Tailscale) It only authenticates it _after_ all the WireGuard bits. So it's not really auth by IP address, but auth by wireguard key identity, from which we know your identity. There's no IP spoofing possible. And ARP isn't even in the picture for an L3 protocol.
How do you prevent other processes (or other apps on mobile) from connecting to the service? A malicious game on my phone can't ssh to my server if I do normal authentication, but with this IP/WG authentication it can...
Earlier quoted context omitted.
How do you prevent other processes (or other apps on mobile) from connecting to the service? A malicious game on my phone can't ssh to my server if I do normal authentication, but with this IP/WG authentication it can...
You can configure ACLs. By default devices that aren’t tagged with an ACL tag are available to other devices authenticated by the same user. If you tag a device, you have to write explicit ACLs to permit access from other users/devices.