News for hackers. Stuff that matters.

A comment on Add ability to choose a custom coordination server. Parent comment

Re:Add ability to choose a custom coordination server by moontear on Monday August 15, 2022 @11:05AM (#32470613)
"allowing them access into my personal network"

In what form? The private keys never leave the nodes, hence there shouldn't by any access per se (see https://tailscale.com/security/). Of course TS has insights into your networks, i.e. what servers it is installed on, what you connect to - so metadata.

[ Parent | on HN ]
Re:Add ability to choose a custom coordination server by stavros on Monday August 15, 2022 @11:08AM (#32470655)
They can add a node and connect to whatever other node they want.
[ Parent | on HN ]
Re:Add ability to choose a custom coordination server by moontear on Monday August 15, 2022 @06:34PM (#32476370)
Haven't thought about that and this should certainly be addressed - especially if I'd use Tailscale for business.
[ Parent | on HN ]
Re:Add ability to choose a custom coordination server by ec109685 on Monday August 15, 2022 @02:33PM (#32473497)
This seems solvable. They talk about that here: https://tailscale.com/kb/1099/device-authorization/

But it still seems like they could flip that feature off if they got compromised. To remedy that, feels like they could support a preshared secret that they don't control / see being shared as a first step: https://tailscale.com/kb/1099/device-authorization/#generate...

[ Parent | on HN ]
Re:Add ability to choose a custom coordination server by yencabulator on Monday August 15, 2022 @07:18PM (#32476830)
I think the Tailscale part that actually knows what auth keys look like is proprietary, but at least for Headscale they seem to be just unguessable database row identifiers: https://github.com/juanfont/headscale/blob/ade4e23e149e7846b...

Nothing in the Tailscale design has ever pointed to features that would guard your infrastructure from them.

[ Parent | on HN ]
Re:Add ability to choose a custom coordination server by stavros on Monday August 15, 2022 @02:35PM (#32473526)
Yeah, they control this setting so they can just disable it, or override it.

Since Headscale exists, though, this problem is solved quite neatly.

[ Parent | on HN ]
Re:Add ability to choose a custom coordination server by yencabulator on Monday August 15, 2022 @04:36PM (#32475027)
You can't generate a secret with a webapp they control without them controlling the secret too.
[ Parent | on HN ]
Re:Add ability to choose a custom coordination server by stavros on Monday August 15, 2022 @06:44PM (#32476488)
I assume the notion was that the nodes will all know the secret but the control server won't.
[ Parent | on HN ]
Re:Add ability to choose a custom coordination server by ec109685 on Monday August 15, 2022 @11:06PM (#32478781)
Exactly. Pre-shared secret out of band.
[ Parent | on HN ]