Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 90 posts

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#61

Post by tptacek »

nmadden wrote: post #57
PLG88 wrote: post #41

Earlier quoted context omitted.

I would add, doing Zero Trust Networking properly means deny by default (VPNs are open by default), service based access (not whole host or network), microsegmentation (not whole network), and least privilege. You should also use posture checks to ensure the end device is compliant and personally I prefer 'authenticate before connect' with outbound only connections from source and destination. Note, I am biased thoug…

I took tptacek’s comment as implying that ZTNA solutions do do microsegmentation. Otherwise, if I get a shell in one app and have access to the entire network then what was the point of any of it? Are you saying they don’t do microsegmentation?

Yes: "microsegmentation" is a good way to describe one strategy (the most popular one) for retrofitting a notion of OMB-style "Zero Trust" onto existing networks. It's the selling point of things like this.

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#62

Post by nmadden »

gargan wrote: post #59
nmadden wrote: post #13

I don’t really get the threat model of these “zero trust” appliances and how they are really different from a VPN. Can someone explain it to me? It still looks very much like a perimeter.

Zero trust actually goes way beyond traditional VPNs. A key difference is granular access control and continuous verification. With zero trust, you're not only punching a hole through a firewall - you're creating dynamic, context-aware access policies for each user and device. This helps contain breaches and lateral movement much better than VPNs. Plus, it plays nice with cloud and hybrid environments where tradition…

Sure, zero trust implies those things, but I was asking specifically about these kinds of all-in-one “zero trust appliances”. For me, as an AppSec specialist, I’d say ZT is primarily about making sure all your apps enforce authN/Z regardless of whether the users are on an internal network or not.

One way to do that is to stick a simple reverse proxy in front of every app that does OIDC to your central IdP, and then arrange your network so that you cannot bypass that (eg using (micro)segmentation or something like IAP’s signed headers). My impression from reading Zscaler’s docs was that it was really just an over-complicated version of this without even doing the segmentation for you, but it sounds like it does do that bit too.

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#63

Post by aborsy »

taekwondo123 wrote: post #38

The concern I have with these types of solutions (meaning Tailscale, Firezone, etc.), is that I need to trust the provider not to mess up or maliciously exchange keys with rouge devices. Is this the case with Firezone as well? I see that tailscale addresses this now somewhat: https://tailscale.com/kb/1226/tailnet-lock

Why somewhat? The client has to sign the key, and Tailscale can’t add public keys to the network.

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#65

Post by PLG88 »

nmadden wrote: post #57
PLG88 wrote: post #41

Earlier quoted context omitted.

I would add, doing Zero Trust Networking properly means deny by default (VPNs are open by default), service based access (not whole host or network), microsegmentation (not whole network), and least privilege. You should also use posture checks to ensure the end device is compliant and personally I prefer 'authenticate before connect' with outbound only connections from source and destination. Note, I am biased thoug…

I took tptacek’s comment as implying that ZTNA solutions do do microsegmentation. Otherwise, if I get a shell in one app and have access to the entire network then what was the point of any of it? Are you saying they don’t do microsegmentation?

Agreed. My point was that ZTNA requires more than just micro segmentation, it should also include deny by default, service based access, least privilege, endpoint posture checks etc.

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#66

Post by PLG88 »

nmadden wrote: post #62
gargan wrote: post #59

Earlier quoted context omitted.

Zero trust actually goes way beyond traditional VPNs. A key difference is granular access control and continuous verification. With zero trust, you're not only punching a hole through a firewall - you're creating dynamic, context-aware access policies for each user and device. This helps contain breaches and lateral movement much better than VPNs. Plus, it plays nice with cloud and hybrid environments where tradition…

Sure, zero trust implies those things, but I was asking specifically about these kinds of all-in-one “zero trust appliances”. For me, as an AppSec specialist, I’d say ZT is primarily about making sure all your apps enforce authN/Z regardless of whether the users are on an internal network or not. One way to do that is to stick a simple reverse proxy in front of every app that does OIDC to your central IdP, and then a…

The idea of “zero trust appliances” is that you can reduce the attack surface from the external network, that is how Zscaler positions it, to make you apps 'dark'. IMHO though, the logical conclusion is to give every application, as part of the software development lifecycle its own private network, which implements zero trust principles - least privilege, microsegmentation, default deny, strong identity, device authentication, and more.

The beauty of this approach is that you eliminate a whole class of vulnerabilities (see 'secure by default from CISA), that is, network/IP attacks, without changing the users experience (they just access the app).

Another key aspect is that this approach should be applied to every use case, not just client to server. All of this is possible on the open source project I work on, OpenZiti - https://openziti.io/.

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#67

Post by PLG88 »

hardwaresofton wrote: post #45
PLG88 wrote: post #39

Earlier quoted context omitted.

Through OpenZiti into the mix too - https://openziti.io/ . Its open source and was designed from the ground up with zero trust, SDN, and deny-by-default principles. It also includes SDKs to allow developers to embed ZTN as part of the SDLC. We also built zrok ( https://zrok.io/ ) on top of it, as a demonstration of a 'ziti-native' app, and being a better Ngrok.

OpenZiti looks so enticing but it is certainly a completely different world. Are there many big installations of it? With the vast majority of stuff being written for regular networks I do wonder if the amount of proxies/sidecars becomes unreasonable. Probably not though

The biggest installation is a cyber security unicorn who whitelabels the commercial version of OpenZiti (NetFoundry) which they are selling to many large enterprises. They have hundreds of thousands of endpoints deployed. There is also a massive OT ICS OEM is embedding NetFoundry into its industrial routers, PLCs, etc for all types of connectivity, including machine to machine in factories. The same technology is being used for tactical military networks, with drones connecting to servers. Its being deployed in critical grid infrastructure. A hyperscaler is adopting it to replace hundreds of thousands of VPNs as well as build a multi-cloud zero trust offering for server to server workloads.

So we have not finished our job to make OpenZiti the equivalent to Linux in that every just uses it by default, but we will get there ;)

You raise an interesting point. We provide flexibility for ingress/egress... do not like proxies/sidecars, go in either opposite direction, (1) ZTAA, Zero Trust App access with SDK app embedded via SDLC, (2) ZTNA, Zero Trust Network Access via appliance deployments in DMZ/VP/VNET etc (the one you mention is ZTHA, Host Access). Each of ZTNA/HA/AA have different pros and cons based on your requirements and use case.

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#68

Post by hardwaresofton »

PLG88 wrote: post #67
hardwaresofton wrote: post #45

Earlier quoted context omitted.

OpenZiti looks so enticing but it is certainly a completely different world. Are there many big installations of it? With the vast majority of stuff being written for regular networks I do wonder if the amount of proxies/sidecars becomes unreasonable. Probably not though

The biggest installation is a cyber security unicorn who whitelabels the commercial version of OpenZiti (NetFoundry) which they are selling to many large enterprises. They have hundreds of thousands of endpoints deployed. There is also a massive OT ICS OEM is embedding NetFoundry into its industrial routers, PLCs, etc for all types of connectivity, including machine to machine in factories. The same technology is bei…

> A hyperscaler is adopting it to replace hundreds of thousands of VPNs as well as build a multi-cloud zero trust offering for server to server workloads.

This one is the most compelling to me! A while back I was building a small cloud provider and this was the use case I was looking really closely at OpenZiti for.

Thanks for sharing!

>You raise an interesting point. We provide flexibility for ingress/egress... do not like proxies/sidecars, go in either opposite direction, (1) ZTAA, Zero Trust App access with SDK app embedded via SDLC, (2) ZTNA, Zero Trust Network Access via appliance deployments in DMZ/VP/VNET etc (the one you mention is ZTHA, Host Access). Each of ZTNA/HA/AA have different pros and cons based on your requirements and use case.

Ah so this would work if:

1) all the apps were my own

2) I was sitting on top of a major cloud/managed colo (I'm just sitting on top of infra providers like hetzner)

The project I was working on is not so active right now but it's still chugging along (I use it)... I was looking at things like OpenZiti as a k8s CNI provider, or used along with something like Cilium/Calico (but then they'd both promise network security in-between workloads and overlap)

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#69

Post by PLG88 »

hardwaresofton wrote: post #68
PLG88 wrote: post #67

Earlier quoted context omitted.

The biggest installation is a cyber security unicorn who whitelabels the commercial version of OpenZiti (NetFoundry) which they are selling to many large enterprises. They have hundreds of thousands of endpoints deployed. There is also a massive OT ICS OEM is embedding NetFoundry into its industrial routers, PLCs, etc for all types of connectivity, including machine to machine in factories. The same technology is bei…

> A hyperscaler is adopting it to replace hundreds of thousands of VPNs as well as build a multi-cloud zero trust offering for server to server workloads. This one is the most compelling to me! A while back I was building a small cloud provider and this was the use case I was looking really closely at OpenZiti for. Thanks for sharing! >You raise an interesting point. We provide flexibility for ingress/egress... do no…

You could use OpenZiti together with Cilium/Calico, there are some distros, eg., https://kubezt.com/ which do that (though in truth, KubeZT has moved to Istio for E-W, uses OpenZiti for N-S. OpenZiti does a lot of things that service mesh technologies do not, for example, extending outside of the cluster (incl. to non-K8S workloads), allowing closing of inbound FW ports, providing a private DNS outside of cluster, removing the need for VPNs, L4 loadbalancers, MPLS, SDWAN, public DNS etc.

Yes, OpenZiti very much focus on private apps, whether COTS or inhouse developed.

Oh, I should note too, while we have a bunch of ways to deploy OpenZiti on K8S today, we are in the process of building/releasing an admission controller and an ingress controller for OpenZiti.

Whats the project you work on?

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#70

Post by nmadden »

PLG88 wrote: post #66
nmadden wrote: post #62

Earlier quoted context omitted.

Sure, zero trust implies those things, but I was asking specifically about these kinds of all-in-one “zero trust appliances”. For me, as an AppSec specialist, I’d say ZT is primarily about making sure all your apps enforce authN/Z regardless of whether the users are on an internal network or not. One way to do that is to stick a simple reverse proxy in front of every app that does OIDC to your central IdP, and then a…

The idea of “zero trust appliances” is that you can reduce the attack surface from the external network, that is how Zscaler positions it, to make you apps 'dark'. IMHO though, the logical conclusion is to give every application, as part of the software development lifecycle its own private network, which implements zero trust principles - least privilege, microsegmentation, default deny, strong identity, device auth…

But a simple gateway/ELB can protect your apps from the public internet. (But unless you’re pushing a root CA cert to all client devices then those apps aren’t “dark” in any sense due to CT logs). Zscalar’s ZPA docs say:

> [ZPA] mitigates lateral threat movement through advanced segmentation

https://www.zscaler.com/products/zscaler-private-access

So it must be doing some segmentation at the network level, otherwise what does that statement mean?

Post reply on HN