Tailscale doesn't want your password • Hacker News Board

Re: Tailscale doesn't want your password

#171

Post by 63stack » Thu, Jun 08, 2023, 9:07 AM UTC

NolF wrote: post #154

YPPH wrote: post #22

My work uses Microsoft SSO for everything. Passkeys aren't enabled though. And management won't enable them on Azure AD. Instead, they enable the tried and tested and ultra secure method of SMS based 2FA with a password. (This is sarcasm.) The alternative is the Microsoft authenticator app with its associated risk of approval fatigue. I have already had several malicious login attempts. Fortunately I'm attuned enough…

My employer uses the MS Auth app. Now when logging in, it shows a number on the screen that you have to type on the app and then use the finger print. Before it used to be the fingerprint only. Seems like a relatively effective way to ensure people are not just approving everything prompted by the app.

Does anyone know what's the intention in doing this? The default behavior of OTP was afaik always to generate a code on the second device, and input that into the device you are trying to log in with.

I assume Microsoft felt the need to dumb this down so it's easier to just approve it with a click of a button, then after they realized this is bad (that pretty much anyone with a bit of security experience predicted) they now changed this to "input code on second device", instead of just reverting to the default behavior.

Why?

Re: Tailscale doesn't want your password

#172

Post by neurostimulant » Thu, Jun 08, 2023, 9:16 AM UTC

woodruffw wrote: post #85

croes wrote: post #75

Earlier quoted context omitted.

But Appel could deactivate E2E encryption without your knowledge to get all your keys. For instance on request of government agencies.

This is indistinguishable from the "I don't trust my computer" threat model. Apple could also surreptitiously scrape your screen or copy your processes' memory.

If your threat model includes getting hacked by the government, then your only choice of OS would be some hardened open source OS with fully reproducible builds and no proprietary driver blobs installed.

Re: Tailscale doesn't want your password

#173

Post by kdklol » Thu, Jun 08, 2023, 9:20 AM UTC

nottorp wrote: post #150

kdklol wrote: post #147

Earlier quoted context omitted.

No, it's not "just a long password". Here are the main benefits not mentioned, which a password cannot offer, regardless of how securely it is stored: - Phishing protection - passkey credential will be uniquely bound to a domain, so you cannot be phished - Keys cannot be exfiltrated from the hardware, so even if your password manager is compromised, your key would still protect you - Duplication protection - synced c…

> Obviously, there are some necessary assumptions made, about security of the passkey implementation, DNS security and so on. Basically you need to trust more vendors of security solutions than before, isn't it? Plus you cannot access your accounts from any random device without an intricate security setup that eats at your time and messes with the device. As in you cannot borrow your friend's laptop for 5 min to che…

I knew I should've explained myself in more detail. Sorry.

>Basically you need to trust more vendors of security solutions than before

Yes and no. You may have to trust the vendor of your hardware key, or you can get one that has open source firmware, like NitroKey.

Regarding the number of trusted parties - it depends. To have a account that use passwords, you must trust them to handle your password well. You can mitigate this trust need somewhat by using a password manager and strictly using unique passwords (and ideally usernames and emails too!), but this now requires trust in your password manager. Again, OSS solutions like BitWarden, KeePass and pass make this less of an issue. My point is, if you are handleing your passwords well (ie you are using a password manager), you are not really required to trust more parties, only change which ones. Furthermore, WebAuthn is stabdardized, so unlike with password managers, there's less room for "creative" programmers to make mistakes (like lastpass did).

Regarding DNS security,

I meant that highjacking a company's domain, be it trough compromising their account with their registrar or by non-validated or even non-existant DNSSEC can enable attacks. This is true of other forms of identifocatin though. I just want to be fair and not oversell this tech as a silver bullet. If all things are done right however (like they must be with other forms of id.), this does significantly increase security.

>borrow your friend's laptop for 5 min to check your email any more

In general, no. Assuming they run a reasonably recent version of Chrome and Windows/Linux/Android* (I don't have apple so idk), it will work driverlessly.

You may be surprised to know this, but it's fundamentally a fairly old technology at this point. Hardware keys have been supported in some capacity by systems for over 10 years now, and WebAuthn essentially just standardised what was already there. It was a fairly easy adjustment. At this point in time, I don't know of any hardware key being sold that does not support this nor any common OS (again, besides Apple stuff, they should supported but I cannot test it.)

*Ah, yes, Android is a wierd one. Technically it's not yet in android, but it's been in the Google Play services for years now. But thechnically, there are android devices without those (like mine).

Re: Tailscale doesn't want your password

#174

Post by n42 » Thu, Jun 08, 2023, 9:20 AM UTC

ksajadi wrote: post #135

I have an honest question, but am afraid that I get downvoted for reasons that perhaps relate to my question: Why is this on top of HN? Is it a novel invention by Tailscale? Are they the first company who’ve done it? Are they used by so many people (like GitHub) that this will have other implications? Does the article go to technical details of their implementation that relates to the dev crowd? Please, educate me, t…

personally, I've been wanting to try passkeys and this is the first provider I'm aware of that will let me, so that is newsworthy to me

Re: Tailscale doesn't want your password

#175

Post by kdklol » Thu, Jun 08, 2023, 9:29 AM UTC

n42 wrote: post #166

kdklol wrote: post #147

Earlier quoted context omitted.

No, it's not "just a long password". Here are the main benefits not mentioned, which a password cannot offer, regardless of how securely it is stored: - Phishing protection - passkey credential will be uniquely bound to a domain, so you cannot be phished - Keys cannot be exfiltrated from the hardware, so even if your password manager is compromised, your key would still protect you - Duplication protection - synced c…

I was speaking about the experience of a user who doesn't care about the details :)

I understand. In that case I still think it's a bit of an understatement to call it a password, since especially inexpirienced users are more vulnerable to phishing, and this does protect against it, unlike a long password (even paired with other MFA methods!) Also there's nothing to remember or to install, so again, more normie-friendly. Sorry if I came of as too agressive, maybe I should've put in some smiley faceses too :)

Re: Tailscale doesn't want your password

#176

Post by junon » Thu, Jun 08, 2023, 9:32 AM UTC

systemvoltage wrote: post #155

aetch wrote: post #139

Earlier quoted context omitted.

The passkey people won’t give you a straightforward answer because you won’t like the answer. If the passkey is truly secure, you don’t get your key bak if you lose the passkey. If you make a copy of the passkey, the passkey purists will say it’s not “secure”. If you lose your phone and delete your existing login cookies you don’t get access again. If email or sms is the recovery method, you might not be able to logi…

> The passkey people won’t give you a straightforward answer because you won’t like the answer. Well, then this culture needs to be condemned strongly.

Why? Security isn't an opinion, it's a science and art. It doesn't care about what you think of it.

Perfect security leaves no room for user friendliness. The most secure system allows no users to use it. Only by reducing security do you gain user friendliness. The most user friendly (as in, triviality of use) system requires no security.

The art comes in when trying to create more usability whilst giving up less security, of course.

Passkeys are more secure than passwords. Thus, it's only natural they are less user friendly. If you don't "like" that, then stick to passwords. There's nothing to condemn, however.

Re: Tailscale doesn't want your password

#177

Post by borski » Thu, Jun 08, 2023, 9:44 AM UTC

silisili wrote: post #142

borski wrote: post #138

Earlier quoted context omitted.

People love Tailscale, and passkeys are relatively new, so a major authentication improvement for a well-loved service that is based on a new authentication mechanism not lots of companies support yet is … interesting. I think it’s as simple as that.

I think it's 99% just the former. I've seen a blog post describing a very elementary better way of storing IP addresses upvoted and praised. I've seen people agree and fawn over the idea they were using a flat JSON file everywhere initially. Then they somehow discovered a 20 year old DB, and some people treat it like the second coming of Christ. None of this is to insult Tailscale, or their works, or their blogs. Peo…

I dno; people used to say that about Dropbox in the early days. Clearly people like what Tailscale is doing, and find it interesting. The upvotes are about what’s interesting to the community, so seems fine and not cult-like to me.

Re: Tailscale doesn't want your password

#178

Post by PeterisP » Thu, Jun 08, 2023, 9:46 AM UTC

junon wrote: post #176

systemvoltage wrote: post #155

Earlier quoted context omitted.

> The passkey people won’t give you a straightforward answer because you won’t like the answer. Well, then this culture needs to be condemned strongly.

Why? Security isn't an opinion, it's a science and art. It doesn't care about what you think of it. Perfect security leaves no room for user friendliness. The most secure system allows no users to use it. Only by reducing security do you gain user friendliness. The most user friendly (as in, triviality of use) system requires no security. The art comes in when trying to create more usability whilst giving up less sec…

Availability is a major part of security (confidentiality-integrity-availability etc), so a process that has significant risks to availability can not be considered secure.

Re: Tailscale doesn't want your password

#179

Post by ayewo » Thu, Jun 08, 2023, 9:55 AM UTC

Technotroll wrote: post #146

kahnclusions wrote: post #133

Earlier quoted context omitted.

How do I access my e-mail to reset my passkey when it's also protected by passkey?

I had this problem with Dashlane after they suddenly changed their policies, though with a regular password. My solution? Out of frustration I developed my own password manager. Eventually I was able to recover the password from my email provider though. But at that point I had no more nails left.

> I had this problem with Dashlane after they suddenly changed their policies,

This is a bit hard to know what to search on. Where can I read more about the policy changes?

Re: Tailscale doesn't want your password

#180

Post by pcthrowaway » Thu, Jun 08, 2023, 9:57 AM UTC

n0zmer wrote: post #65

pcthrowaway wrote: post #35

Earlier quoted context omitted.

Regardless of how much you trust them, the fact that they can force a decryption of these keys (and selectively, per-user, no less) means that you are not in custody of your own authentication identity. Add to that, they can be legally compelled to take such a measure (and I'm sure they will in due time). Compared to using, say, KeepassXC with a unique, secure password per vault. Now you can sync on iCloud or google…

KeepassXC has a ways to go still before I can trust it. I just attempted to use it again, after a few years, and syncing the DB across google drive randomly caused all of my entries to be erased. No recovery, nothing. just opened the DB one day and all of my saved notes and passwords went poof. It's a know bug, but the fact that it still exists really shows how much the devs care about making it a really rock solid a…

Oh for sure, KeepassXC has some UI issues. And in this case, a glaring bug, thank you for making me aware of it! It looks like there are workarounds, though I'm not sure how much I like them.

I've already been doing manual backups. In addition, there is a feature to make a copy of the database before writing that I've just turned on. And the "Use alternative saving method -> Directly write to database file (dangerous)" option is supposed to prevent this issue from happening with cloud storage.

I wasn't in any way arguing KeepassXC is a layperson-friendly way to manage authentication credentials, just that it gives you the most security from the big identity providers (Apple, Google) selling you out for political or selfish reasons.

Of course, there's probably only so much I can do here. Apple could presumable ship an update to their OS that allows them to access a user's database while it's unlocked, or to keylog the master password.

A yubikey might be the only thing that can really protect you here.