Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to use BeyondCorp to ditch VPN, improve security and go to the cloud

blog.google

Post reply on HN
Print view View original

81–90 of 163 posts

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#81

Post by DorothySim »

maxsaltonstall wrote: post #64
DorothySim wrote: post #52

Earlier quoted context omitted.

I think the only restriction is working on Google approved hardware so no BYOD there. (Disclosure: not a Google employee).

Bring Your Own Device is fine for ChromeOS and Mobile. You might not get the full amount of trust as a Google-issued device (for mobile/tablet). To achieve the highest levels of access in the BeyondCorp model you need a machine with Google's management agents, so we can evaluate device state accurately and pull information from our inventory management system.

But if you don't provision the device yourself how can you be sure it hasn't been tampered with in a way that just displays "bootloader OK, everything good" but in the mean time it was rooted? Or is that a risk calculated in the "no full amount of trust"?

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#82

Post by zxv »

Part 3 [0] discusses "Wrapping SSH traffic in HTTP over TLS." Can one comfortably do coding over a good cellular (LTE) connection over this?

I ask because, I find it relatively comfortable to do coding on a chromebook over a 'mosh' session over LTE.

[0] https://static.googleusercontent.com/media/research.google.c...

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#83

Post by yegle »

izacus wrote: post #8
yegle wrote: post #4

My ex-manager who left Google to another well established company once said the most missed thing from Google was the ability to work remotely right away on corp laptop with BeyondCorp. Disclaimer I work for Google not related to BeyondCorp.

I thought Google doesn't allow remote work?

This is for an SRE role who would need to work during on call, or for whatever reason decide to WFH.

I think pure remote role is still allowed but that's not what I mean.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#84

Post by ariwilson »

DorothySim wrote: post #81
maxsaltonstall wrote: post #64

Earlier quoted context omitted.

Bring Your Own Device is fine for ChromeOS and Mobile. You might not get the full amount of trust as a Google-issued device (for mobile/tablet). To achieve the highest levels of access in the BeyondCorp model you need a machine with Google's management agents, so we can evaluate device state accurately and pull information from our inventory management system.

But if you don't provision the device yourself how can you be sure it hasn't been tampered with in a way that just displays "bootloader OK, everything good" but in the mean time it was rooted? Or is that a risk calculated in the "no full amount of trust"?

https://www.chromium.org/chromium-os/chromiumos-design-docs/...

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#85

Post by mikeash »

euyyn wrote: post #80
bitmapbrother wrote: post #21

Earlier quoted context omitted.

One of the more interesting insights from the comments (which I agree with) was that the Amazon patent was for defensive purposes in order to prevent other companies from trying to implement such an idea in their stores. I have never given much thought to the idea of defensive patents, but if this is truly the intent of Amazon's patent then it's brilliant.

Not a lawyer, but wouldn't that be challengeable in court? I see the ethics of it, but maybe legally it falls in the same bucket as patent trolls that hold on a patent with no intention of ever commercializing it.

I thought the whole problem with patent trolls was that holding a patent with no intent of commercializing it was perfectly legal.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#86

Post by dylz »

com2kid wrote: post #31

With productivity apps being cloud hosted (Office 365, Google Docs, Tableau, PowerBI, etc) and with source code and team management services being hosted (Github, Visual Studio Online, Gitlab, etc) huge percent of people's day to day work can seemingly happens without a VPN. The largest notable exceptions seem to be internal file shares, and remote connections to machines that need to be behind a firewall. I guess th…

GH/Gitlab are usually behind VPN for non-startups

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#87

Post by JoshMnem »

milesward wrote: post #49
JoshMnem wrote: post #7

Yesterday, I saw an article[1] about Amazon's plans to block websites in their stores (a very bad thing) and was wondering when a company like Google was going to launch a VPN service. I wonder if these things will meet in the long term. If companies that control the network try to limit access to information about their competitors, then their competitors might try to liberate that information. [1] http://gizmodo.co…

I'm the one who wrote that patent (sorry).

Amazon or Google? One hour ago you posted that you're "a Director at Google". https://news.ycombinator.com/item?id=14597662

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#88

Post by JoshMnem »

bitmapbrother wrote: post #21
JoshMnem wrote: post #7

Yesterday, I saw an article[1] about Amazon's plans to block websites in their stores (a very bad thing) and was wondering when a company like Google was going to launch a VPN service. I wonder if these things will meet in the long term. If companies that control the network try to limit access to information about their competitors, then their competitors might try to liberate that information. [1] http://gizmodo.co…

One of the more interesting insights from the comments (which I agree with) was that the Amazon patent was for defensive purposes in order to prevent other companies from trying to implement such an idea in their stores. I have never given much thought to the idea of defensive patents, but if this is truly the intent of Amazon's patent then it's brilliant.

Maybe a combination of defensive and opportunistic.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#89

Post by JoshMnem »

Aloha wrote: post #13
JoshMnem wrote: post #10

Earlier quoted context omitted.

I know -- that's why I used the phrase "long-term". :) I probably shouldn't have used the word "plans" though, since I don't know for sure if they will implement it.

They very well could have patented it to prevent anyone else from doing it - which seems more likely.

It's probably a combination of defensive and opportunistic. Companies stake out positions and then watch how the winds blow.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#90

Post by londons_explore »

zxv wrote: post #82

Part 3 [0] discusses "Wrapping SSH traffic in HTTP over TLS." Can one comfortably do coding over a good cellular (LTE) connection over this? I ask because, I find it relatively comfortable to do coding on a chromebook over a 'mosh' session over LTE. [0] https://static.googleusercontent.com/media/research.google.c...

To get good performance, one would need a BeyondCorp enabled mosh proxy.

With plain SSH over HTTP over TLS, performance is satisfactory but not great. 4G is just about usable for vim, but you'd probably be best off using sshfs over http over tls and running vim locally, then compiling and running remotely.

Post reply on HN