Live data from Hacker News

How to use BeyondCorp to ditch VPN, improve security and go to the cloud

blog.google

101–110 of 163 posts

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#101

How is this different or more secure than let's say TLS client authentication with the private key on a smart card / Yubikey?

They also take into account the state of the machine you're working on. So locked bootloader and probably a client cert in TPM-like component, plus "device health". Client certs alone are good for authentication (don't work in HTTP/2 though) but they want to reach even better target - no malicious software running on your computer. That's from reading old papers, I don't know if anything changed now.

> Client certs alone are good for authentication (don't work in HTTP/2 though)

Um, what? Did client certs get removed from HTTP 2?

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#102

Sorry this will come off as a super dumb question. I use ssh. I can login, edit, develop, run, basically anything. What am I missing? I thought VPNs are for 'admin' types that need access to a MS Excel file.

"I use ssh. I can login, edit, develop, run, basically anything. What am I missing?"

You're not missing anything and you have an extremely efficient and secure workflow that runs laps around any of this.

The tradeoff is you work in a terminal and understand SSH, etc., which is too much to ask of many non-technical users.

If you wanted to obfuscate your traffic or the direct path to your remote host was blocked for some reason, a VPN might get you there, but you'd still run SSH over that VPN and your workflow should remain unaltered (albeit, higher latency).

To address a sibling posts comment, you can enjoy this very same workflow without exposing your sshd to the global Internet by placing it behind a "knock" with knockd. Highly recommended.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#103

Sorry this will come off as a super dumb question. I use ssh. I can login, edit, develop, run, basically anything. What am I missing? I thought VPNs are for 'admin' types that need access to a MS Excel file.

ssh can be used as a VPN - you can proxy ports and tunnel all sorts of things through it. You can easily drill a connection through to say an "internal" Windows or NFS file server and grab docs off it. There is file transfer built in as well eg sftp and scp, with easy rsync integration.

It doesn't really matter whether you use ssh, RDP or whatever for remote system access but you should be aware of the capabilities of your methods and the strengths and weaknesses of them.

If your username and password are reasonably hard to guess, and ideally you use passwordless logins, and you keep your system regularly patched, and you definitely don't allow remote root logins, and you cycle your passwords say 90 days or so, then you should be fine. Do not bother changing port 22 to say 2222 or requiring 20+ char passwords. You may want to disable some of sshd's functionality if you don't use it but that might be a step too far.

Also, reset your sshd's keys occasionally and get them into your local ~/.ssh/known_hosts as soon as possible and read up and understand why ssh warns you when the keys and names look odd - that could save you a MitM attack from a bored techy in a hotel with wifi or whatever.

To sum up: a well handled sshd and client can be a fairly decent VPN and remote access solution. However, a separate VPN eg OpenVPN and then ssh over that is better and need not be inconvenient.

You pays your money .... 8)

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#104
post #4

My ex-manager who left Google to another well established company once said the most missed thing from Google was the ability to work remotely right away on corp laptop with BeyondCorp. Disclaimer I work for Google not related to BeyondCorp.

Is logging into a VPN in 3 seconds and starting to work not "right away" enough?

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#105

Earlier quoted context omitted.

They also take into account the state of the machine you're working on. So locked bootloader and probably a client cert in TPM-like component, plus "device health". Client certs alone are good for authentication (don't work in HTTP/2 though) but they want to reach even better target - no malicious software running on your computer. That's from reading old papers, I don't know if anything changed now.

> Client certs alone are good for authentication (don't work in HTTP/2 though) Um, what? Did client certs get removed from HTTP 2?

Yes. As far as I understand, the problem was that the requirement for a certificate is a per-request thing, but HTTP 2 can have multiple requests in flight over the same TLS connection at the same time and thus can't just renegotiate the connection when it comes up. There have been proposals to fix this, but nothing has gained the necessary interest and traction.

Servers can ask the client to fall back to HTTP 1.1 instead, and then use client-certificates there.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#106
post #91

Earlier quoted context omitted.

Amazon or Google? One hour ago you posted that you're "a Director at Google". https://news.ycombinator.com/item?id=14597662

It's plausible that they changed jobs ;).

bingo

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#107
post #8

Earlier quoted context omitted.

I thought Google doesn't allow remote work?

Maybe you're confused with Yahoo? https://www.fastcompany.com/3020930/yahoo-says-that-killing-... They're very, very different companies/work culture :)

One is in the technology industry.

The other is managing its shares in Alibaba.

Very different needs.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#108

Earlier quoted context omitted.

That's correct. Previous papers touch on the inventory data pipeline and machine health, though without as much detail as I might like in your shoes. Our agents track a wide variety of things on client machines, and we use that inventory data to determine how trustworthy a machine could be. [I work at Google, and helped make these papers, and blog post, happen]

Interesting design. As far as I understood from old papers client certificates are used only to identify the device while user authentication is handled differently. Could you elaborate on the technical details on user authentication? (If that's not top-super-secret) I guess it's just like accounts.google.com for Enterprise with mandatory 2FA (username+password+U2F key?). Does it work the same on mobile/Android (U2F…

Android supports U2F via NFC and Bluetooth now, which is used for user authentication on Android devices. We've also released an (experimental?) iOS app to support U2F over Bluetooth.

https://itunes.apple.com/us/app/google-smart-lock/id11520663...

Post reply on HN