Tailscale doesn't want your password • Hacker News Board

Re: Tailscale doesn't want your password

#311

Post by tptacek » Mon, Jun 12, 2023, 10:49 PM UTC

kdklol wrote: post #310

tptacek wrote: post #286

Earlier quoted context omitted.

You say "even non-existant DNSSEC" here, but, as a reminder: virtually none of the most popular/important/commercial/whatever-ranking-you-like zones on the Internet are signed. DNSSEC signing is not the norm.

Not quite true, many popular services do have it. Especially the big ones. The thing is, I was mentioning DNSSEC as a "full disclosure". Any attack enabled by non-validated DNSSEC on passkey applies to any other form of verification too. I just wanted to make sure I'm not overselling the technology, it's not a silver bullet, but it's orders of magnitude better than anything else.

Name the popular services that have it. Here's a start: collect a list of popular domain names --- any of them will do --- and write a bash script that loops `dig ds $domainname +short` over all of them. You'll find that I'm not exaggerating, and that my summary of the state of play was in fact accurate.

There is no value to DNSSEC, which is why virtually nobody seriously uses it.

Re: Tailscale doesn't want your password

#312

Post by perryizgr8 » Tue, Jun 13, 2023, 7:42 AM UTC

stavros wrote: post #229

perryizgr8 wrote: post #228

Earlier quoted context omitted.

> You can do this with Passkeys. Maybe in theory. In practice, I couldn't even look at the passkey Google has created on my android phone. So you absolutely cannot write it down.

If you don't like Google's implementation, you should use another one. It doesn't make much sense to say "I can't do X with my thing, therefore I can't do it with anything". The fact remains that, if you want a Passkey you can write down, you can do that.

> If you don't like Google's implementation, you should use another one.

Once more, maybe this is possible in theory. In reality, I can't find any way to use apple's passkey implementation on my android phone.

Re: Tailscale doesn't want your password

#313

Post by stavros » Tue, Jun 13, 2023, 7:44 AM UTC

perryizgr8 wrote: post #312

stavros wrote: post #229

Earlier quoted context omitted.

If you don't like Google's implementation, you should use another one. It doesn't make much sense to say "I can't do X with my thing, therefore I can't do it with anything". The fact remains that, if you want a Passkey you can write down, you can do that.

> If you don't like Google's implementation, you should use another one. Once more, maybe this is possible in theory. In reality, I can't find any way to use apple's passkey implementation on my android phone.

Can you point me to a site? I've had no issue using Google's Passkeys without actually using a Passkey.

Re: Tailscale doesn't want your password

#314

Post by [deleted] » Tue, Jun 13, 2023, 10:54 PM UTC

tptacek wrote: post #311

kdklol wrote: post #310

Earlier quoted context omitted.

Not quite true, many popular services do have it. Especially the big ones. The thing is, I was mentioning DNSSEC as a "full disclosure". Any attack enabled by non-validated DNSSEC on passkey applies to any other form of verification too. I just wanted to make sure I'm not overselling the technology, it's not a silver bullet, but it's orders of magnitude better than anything else.

Name the popular services that have it. Here's a start: collect a list of popular domain names --- any of them will do --- and write a bash script that loops `dig ds $domainname +short` over all of them. You'll find that I'm not exaggerating, and that my summary of the state of play was in fact accurate. There is no value to DNSSEC, which is why virtually nobody seriously uses it.

[deleted]

Re: Tailscale doesn't want your password

#315

Post by systemvoltage » Wed, Jun 14, 2023, 9:24 PM UTC

junon wrote: post #176

systemvoltage wrote: post #155

Earlier quoted context omitted.

> The passkey people won’t give you a straightforward answer because you won’t like the answer. Well, then this culture needs to be condemned strongly.

Why? Security isn't an opinion, it's a science and art. It doesn't care about what you think of it. Perfect security leaves no room for user friendliness. The most secure system allows no users to use it. Only by reducing security do you gain user friendliness. The most user friendly (as in, triviality of use) system requires no security. The art comes in when trying to create more usability whilst giving up less sec…

God help us if people here think "Security is art".

We are screwed.

Re: Tailscale doesn't want your password

#316

Post by jabbany » Thu, Jun 15, 2023, 4:46 AM UTC

recursive_loops wrote: post #253

jabbany wrote: post #42

Earlier quoted context omitted.

Recovery code system? Like 2FA today, generate a special bootstrap key you can print and save. This isn't that uncommon. Things like disk encryption also do this (e.g. bitlocker)

> generate a special bootstrap key you can print and save So ... a password? Also in this scenario you've been robbed. It's quite possible that either they took your printed out passkey also since it was in your wallet, or you're not at home where you can get the pass key from your file cabinet or safe.

Not really. A password is meant to be memorized and reproduced correctly regularlt, whereas a recovery key doesn't need that and can be very long and complicated since it is rarely used.