Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale doesn't want your password

tailscale.com

Post reply on HN
Print view View original

191–200 of 316 posts

Re: Tailscale doesn't want your password

#191

Post by kdklol »

nottorp wrote: post #186
kdklol wrote: post #173

Earlier quoted context omitted.

I knew I should've explained myself in more detail. Sorry. >Basically you need to trust more vendors of security solutions than before Yes and no. You may have to trust the vendor of your hardware key, or you can get one that has open source firmware, like NitroKey. Regarding the number of trusted parties - it depends. To have a account that use passwords, you must trust them to handle your password well. You can mit…

> In general, no. Assuming they run a reasonably recent version of Chrome and Windows/Linux/Android* (I don't have apple so idk), it will work driverlessly. What will work driverlessly? The generating of new keys that still will take an hour? Also excuse me, but did you just say Chrome? I should send Google my browsing so I can use passkeys? Edit: forgot to mention their AI bans with no appeal process. Do you really…

>What will work driverlessly?

WebAuthn. So, registration and authentization. I'm not exactly sure if which standard deals with changing PIN, but it worked everywhere I tried it out of the box.

>OMG did you say CHROME??!!!

Yes, how dare I... It was an example. I don't use Chrome either, but not many people do use other stuff, so that's why I mentioned Chrome specifically.

Currently, the support is best in Chrome and some other Chromium-based browsers. I personally tried Brave, which worked flawlessly everywhere. Firefox (which I personally use) works with standard WebAuthn, but some big players (Google) seem to have older implementations predating the standard, so it doesn't work with some clients (Firefox) yet. I've watched a conference some time ago where they said they're working on it™.

If you want to know how exactly it stuff works, Mozilla has a nice and easy to comprehend description on their developer site. It's one search away (in your preffered search engine).

>The generating of new keys that still will take an hour?

Are you trolling? No. Also, only nonces are generated for each new _credential_, so you don't need to store so much data on the key. You should be more worried about how long it will take to do the authentization exchange, which takes under a second from my experience.

Please just read the Mozilla website.

Re: Tailscale doesn't want your password

#192

Post by hartator »

dfabulich wrote: post #88
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

It's way simpler than you think. You reset your passkey the same way you'd reset your password. So, how do you reset your password when you forget it? Well, it depends. Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there. Som…

> Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there.

Sounds like email based login with extra steps then.

Re: Tailscale doesn't want your password

#193

Post by Technotroll »

ayewo wrote: post #179
Technotroll wrote: post #146

Earlier quoted context omitted.

I had this problem with Dashlane after they suddenly changed their policies, though with a regular password. My solution? Out of frustration I developed my own password manager. Eventually I was able to recover the password from my email provider though. But at that point I had no more nails left.

> I had this problem with Dashlane after they suddenly changed their policies, This is a bit hard to know what to search on. Where can I read more about the policy changes?

Sorry, I can't remember. They suddenly lowered the amount of clients a few years ago. This locked me out of my e-mail client. Since 2FA updates were sent to my e-mail it lead to a bit of tail-biting. Pretty much the same problem can happen with a passkey. Either way this blew away a lot of the trust I used to have in password managers, so out of frustration I coded my own as a backup that can digest Dashlane output so I never need to rely only on them ever again.

Re: Tailscale doesn't want your password

#194

Post by megous »

Aaron2222 wrote: post #61
benatkin wrote: post #50

TL;DR Google, Microsoft, GitHub, Apple, Apple’s macOS and iOS, Google Chrome and Android, as well as 1Password, Yubikey Yay. https://indieweb.org/NASCAR_problem

Passkeys are just a standard protocol, i.e. there'd just be a single "Use Passkey" button.

There's no "passkeys" protocol. If there is, it's well hidden behind marketing bullshit. :)

> In marketing material, the terms passkey or Passkeys are preferred over related terms such as FIDO or WebAuthn, because they are less likely to cause confusion.

Yeah. Nowhere does it say what it actually is or how it's related to the other standards. Not confusing at all.

Re: Tailscale doesn't want your password

#195

Post by tough »

martin-adams wrote: post #105
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

I replaced my iPhone in-store and they transferred all my data. All my data except my Google Authenticator codes. I lost access to at least one account as a result and had to submit identity documents to recover the account. I now make sure I have backup codes stored somewhere. Interestingly, in the past couple of weeks, Google Authenticator can now back up to your Google account.

Authy is a nice alternative to google's Authenticator

Was bought by Twilio, but still rocking.

I love the plugin for raycast.app for it

You set a master password and can login back with your phone number/master password in any device

Much easier to not fuck up 2FA with it when changing phones

Re: Tailscale doesn't want your password

#196

Post by newscracker »

neurostimulant wrote: post #172
woodruffw wrote: post #85

Earlier quoted context omitted.

This is indistinguishable from the "I don't trust my computer" threat model. Apple could also surreptitiously scrape your screen or copy your processes' memory.

If your threat model includes getting hacked by the government, then your only choice of OS would be some hardened open source OS with fully reproducible builds and no proprietary driver blobs installed.

And in which you have personally audited every line of code for extra confidence. /s

Re: Tailscale doesn't want your password

#197

Post by nottorp »

kdklol wrote: post #191
nottorp wrote: post #186

Earlier quoted context omitted.

> In general, no. Assuming they run a reasonably recent version of Chrome and Windows/Linux/Android* (I don't have apple so idk), it will work driverlessly. What will work driverlessly? The generating of new keys that still will take an hour? Also excuse me, but did you just say Chrome? I should send Google my browsing so I can use passkeys? Edit: forgot to mention their AI bans with no appeal process. Do you really…

>What will work driverlessly? WebAuthn. So, registration and authentization. I'm not exactly sure if which standard deals with changing PIN, but it worked everywhere I tried it out of the box. >OMG did you say CHROME??!!! Yes, how dare I... It was an example. I don't use Chrome either, but not many people do use other stuff, so that's why I mentioned Chrome specifically. Currently, the support is best in Chrome and s…

> Are you trolling? No. Also, only nonces are generated for each new _credential_, so you don't need to store so much data on the key. You should be more worried about how long it will take to do the authentization exchange, which takes under a second from my experience.

I'm not talking about the CPU time needed to generate the bits...

Aren't the keys device specific so you need to generate new keys on a new device? It's being touted as a security feature. I'm guesstimating that at 1 hour of the user clicking through various interfaces.

But anyway, my concern is passkeys are adding too many dependencies on devices/providers. Giving me a list of possible devices/providers does not address my concern.

Re: Tailscale doesn't want your password

#198

Post by ziml77 »

YPPH wrote: post #22

My work uses Microsoft SSO for everything. Passkeys aren't enabled though. And management won't enable them on Azure AD. Instead, they enable the tried and tested and ultra secure method of SMS based 2FA with a password. (This is sarcasm.) The alternative is the Microsoft authenticator app with its associated risk of approval fatigue. I have already had several malicious login attempts. Fortunately I'm attuned enough…

Authenticator has options that avoid approval fatigue. There's a setting that causes it to show a number on screen, and then an option between providing a list of 3 numbers you have to pick from or showing a textbox that you have to type the displayed number into. If it's set up for textbox entry it's unlikely that someone is going to approve a random request.

Re: Tailscale doesn't want your password

#199

Post by dicytea »

Technotroll wrote: post #146
kahnclusions wrote: post #133

Earlier quoted context omitted.

How do I access my e-mail to reset my passkey when it's also protected by passkey?

I had this problem with Dashlane after they suddenly changed their policies, though with a regular password. My solution? Out of frustration I developed my own password manager. Eventually I was able to recover the password from my email provider though. But at that point I had no more nails left.

I had the same issue with LastPass a few years ago. When I reinstalled my OS they decided to lock me out of my account because they thought I was a different person. The only way through is e-mail verification. Guess where that email's password was stored in?

Lost everything. Been using Bitwarden ever since.

Re: Tailscale doesn't want your password

#200

Post by ziml77 »

63stack wrote: post #171
NolF wrote: post #154

Earlier quoted context omitted.

My employer uses the MS Auth app. Now when logging in, it shows a number on the screen that you have to type on the app and then use the finger print. Before it used to be the fingerprint only. Seems like a relatively effective way to ensure people are not just approving everything prompted by the app.

Does anyone know what's the intention in doing this? The default behavior of OTP was afaik always to generate a code on the second device, and input that into the device you are trying to log in with. I assume Microsoft felt the need to dumb this down so it's easier to just approve it with a click of a button, then after they realized this is bad (that pretty much anyone with a bit of security experience predicted) t…

All of these are options that your company chooses from. It's possible to have it just show an approve button, to have it show a selection of 3 numbers, or to show the number entry box. Whether or not you are prompted for your password on the device you're logging into is also a decision that your company makes.
Post reply on HN