Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

Re:Launch HN: Firezone (YC W22) – Zero-trust access platform... by taekwondo123 on Wednesday August 07, 2024 @05:11AM (#41179540)

The concern I have with these types of solutions (meaning Tailscale, Firezone, etc.), is that I need to trust the provider not to mess up or maliciously exchange keys with rouge devices. Is this the case with Firezone as well?

I see that tailscale addresses this now somewhat: https://tailscale.com/kb/1226/tailnet-lock

[ Parent | on HN ]

Re:Launch HN: Firezone (YC W22) – Zero-trust access platform... by psd1 on Wednesday August 07, 2024 @07:11AM (#41180148)

> maliciously exchange keys with rouge devices

Companies are slow to respond to the growing threat from adversarial make-up brushes.

[ Parent | on HN ]

Re:Launch HN: Firezone (YC W22) – Zero-trust access platform... by RsmFz on Wednesday August 07, 2024 @10:04AM (#41181602)

I live by but two rules, private keys stay on the storage device they're first saved to, and makeup stays with the first person to use it.

[ Parent | on HN ]

Re:Launch HN: Firezone (YC W22) – Zero-trust access platform... by RsmFz on Wednesday August 07, 2024 @10:03AM (#41181596)

Firezone employee here. I believe we have an idea to let customers sign their keys so that they don't need to trust our portal not to rewrite keys. This is probably the same idea Tailscale hit on.

(I can't find this idea in the issue tracker and I don't think it's on the roadmap yet, but we've discussed it.)

Unfortunately there is a big convenience-security tradeoff, managing your own keys and certs is a lot of work.

[ Parent | on HN ]

Re:Launch HN: Firezone (YC W22) – Zero-trust access platform... by aborsy on Wednesday August 07, 2024 @03:47PM (#41184674)

Why somewhat? The client has to sign the key, and Tailscale can’t add public keys to the network.

[ Parent | on HN ]