Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale doesn't want your password

tailscale.com

Post reply on HN
Print view View original

141–150 of 316 posts

Re: Tailscale doesn't want your password

#141

Post by ptman »

__MatrixMan__ wrote: post #67
doublepg23 wrote: post #25

Earlier quoted context omitted.

Yes you need to trust your operating system developer to some extent. If your threat model includes not trusting the company that writes the source code to your OS…don’t use computers I guess?

Suppose one does trust their OS developers. And they want to use some passkey-protected service. Does that service also have to trust the OS developers? Correct me if I'm wrong, but I'm under the impression that services can decide whose passkey implementations to trust. Seems like that should be up to the user, not the service.

The user picks the passkey, don't they? Android, Apple or Microsoft. Or Yubikey, or another token.

Re: Tailscale doesn't want your password

#142

Post by silisili »

borski wrote: post #138
ksajadi wrote: post #135

I have an honest question, but am afraid that I get downvoted for reasons that perhaps relate to my question: Why is this on top of HN? Is it a novel invention by Tailscale? Are they the first company who’ve done it? Are they used by so many people (like GitHub) that this will have other implications? Does the article go to technical details of their implementation that relates to the dev crowd? Please, educate me, t…

People love Tailscale, and passkeys are relatively new, so a major authentication improvement for a well-loved service that is based on a new authentication mechanism not lots of companies support yet is … interesting. I think it’s as simple as that.

I think it's 99% just the former.

I've seen a blog post describing a very elementary better way of storing IP addresses upvoted and praised.

I've seen people agree and fawn over the idea they were using a flat JSON file everywhere initially.

Then they somehow discovered a 20 year old DB, and some people treat it like the second coming of Christ.

None of this is to insult Tailscale, or their works, or their blogs. People love it and it's obviously a nice product.

The fandom here around them and what gets upvoted and praised just seems cultlike at times.

Re: Tailscale doesn't want your password

#143

Post by mdeeks »

ksajadi wrote: post #135

I have an honest question, but am afraid that I get downvoted for reasons that perhaps relate to my question: Why is this on top of HN? Is it a novel invention by Tailscale? Are they the first company who’ve done it? Are they used by so many people (like GitHub) that this will have other implications? Does the article go to technical details of their implementation that relates to the dev crowd? Please, educate me, t…

Mainly because Tailscale is popular with the HN crowd. Many people use it for their personal home networks, and some companies do to (we do at Instacart).

The nice thing about this is it means you can invite anyone into your network without requiring them to have a Google/Apple/Github account. They just need a phone. It also means you can be much more confident inviting these people because they are unlikely to get phished due to a crappy password.

One of the common complaints in HN comments about Tailscale is they don't want to trust Google/Apple/Github/etc for various reasons. This removes that need.

Re: Tailscale doesn't want your password

#144

Post by freitasm »

n42 wrote: post #100
decryption wrote: post #74

Earlier quoted context omitted.

You need to add multiple passkeys so if one breaks, you can still access the service. Ditto for Yubikeys (which can be added as a passkey), you need more than one so if you lose it you can still access.

no, this is false. this is different than 2FA. you can reset your passkey just like you can a password.

You can if there is a provision for that. As mentioned before it doesn't look like Taiscale allows you to either have more than one passkey or reset the passkey.

Re: Tailscale doesn't want your password

#145

Post by Double_a_92 »

I'm still sceptical of passkeys. Either there needs to be an easy way to generate multiple ones, e.g. having multiple devices that can login. Or it should be easy to export and import them. I don't want to my account to be bound to exactly one specific device of mine... or to need to rely on some cloud sync provider (like Apple or so).

Re: Tailscale doesn't want your password

#146

Post by Technotroll »

kahnclusions wrote: post #133
dfabulich wrote: post #88

Earlier quoted context omitted.

It's way simpler than you think. You reset your passkey the same way you'd reset your password. So, how do you reset your password when you forget it? Well, it depends. Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there. Som…

How do I access my e-mail to reset my passkey when it's also protected by passkey?

I had this problem with Dashlane after they suddenly changed their policies, though with a regular password. My solution? Out of frustration I developed my own password manager. Eventually I was able to recover the password from my email provider though. But at that point I had no more nails left.

Re: Tailscale doesn't want your password

#147

Post by kdklol »

n42 wrote: post #98
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

if you're someone who uses a password manager already, and is generating unique random passwords for every website, the only appreciable difference between a passkey and what you do today is: - the passkey is never transmitted anywhere when logging in, eliminating the largest attack vectors for stealing passwords - you can no longer manually type the passkey in on random devices that don't have your password manager…

No, it's not "just a long password". Here are the main benefits not mentioned, which a password cannot offer, regardless of how securely it is stored: - Phishing protection - passkey credential will be uniquely bound to a domain, so you cannot be phished - Keys cannot be exfiltrated from the hardware, so even if your password manager is compromised, your key would still protect you - Duplication protection - synced counters are stored on both the key and the server, so even if somebody does clone your key (very difficult), you'll know about it (unlike passwords)

Obviously, there are some necessary assumptions made, about security of the passkey implementation, DNS security and so on.

>if you are not already doing this, then it requires adaptation What doesn't?

>ironing out account recovery for the account the vault is associated with Agreed. This is currently the weakest point in web security in general.

I'd also like to mention (for everyone else reading this) that a unique set of credentials is generated per account, so this cannot be used to track you. Also, it's an open standard and open imolementations exist. It is bot reliant on google/yubico/"big tech". They're pushing it because it works.

Re: Tailscale doesn't want your password

#148

Post by Double_a_92 »

sgk284 wrote: post #102
rebeccaskinner wrote: post #91

Earlier quoted context omitted.

I see a lot of claims that passkeys are more secure than passwords with 2fa, but my understanding is that they are strictly less secure. As it stands right now, if someone wanted to compromise a service that I use 2fa with, they'd need to both obtain my physical device, and also get my password. Either one of those things may be relatively easy, but it's harder to do both- especially without my knowledge. With passke…

> if someone steals my physical device, then they have full access Apple protects passkeys via FaceID or TouchID. If you're satisfied with biometrics as a 2nd factor, then there is no regression in your scenario.

But that's an extra thing that Apple does to store the passkey locally. It's not an inherent property of the passkey system.

Also that then leads to the situation that your passkeys are completely locked inside Apples ecosystem! (Or Googles, or Microsoft, or whatever...)

Re: Tailscale doesn't want your password

#149

Post by Double_a_92 »

kccqzy wrote: post #4
marcrosoft wrote: post #2

I don’t understand why someone would want to store all their credentials with one of the large tech companies. It seems like this makes it really easy for law enforcement to grab access to all accounts easily.

When you use passkeys with either Apple's iCloud Keychain or Google Password Manager, the key material is end-to-end encrypted. Law enforcement cannot get your passkeys through these two big tech companies.

What is it encrypted by? Or asked differently, what does the user need to have to decrypt it on all their devices? And how can we know that Apple & Co. don't also have access to that? It's not like Law enforcement hacks into your connection, they just force the company to hand out your data.

Re: Tailscale doesn't want your password

#150

Post by nottorp »

kdklol wrote: post #147
n42 wrote: post #98

Earlier quoted context omitted.

if you're someone who uses a password manager already, and is generating unique random passwords for every website, the only appreciable difference between a passkey and what you do today is: - the passkey is never transmitted anywhere when logging in, eliminating the largest attack vectors for stealing passwords - you can no longer manually type the passkey in on random devices that don't have your password manager…

No, it's not "just a long password". Here are the main benefits not mentioned, which a password cannot offer, regardless of how securely it is stored: - Phishing protection - passkey credential will be uniquely bound to a domain, so you cannot be phished - Keys cannot be exfiltrated from the hardware, so even if your password manager is compromised, your key would still protect you - Duplication protection - synced c…

> Obviously, there are some necessary assumptions made, about security of the passkey implementation, DNS security and so on.

Basically you need to trust more vendors of security solutions than before, isn't it?

Plus you cannot access your accounts from any random device without an intricate security setup that eats at your time and messes with the device.

As in you cannot borrow your friend's laptop for 5 min to check your email any more. You have to set up your keys on said laptop and then remove them, which makes it a 2 hour affair?

Post reply on HN