4 ms·
With services such as Tailscale, you need to trust the authentication servers that they run. In principle, they could access your network. It’s a start up with
by aborsy 5y ago
With services such as Tailscale, you need to trust the authentication servers that they run. In principle, they could access your network.
It’s a start up with limited resources. I worry about their AS getting compromised at some point.
For that reason, I don’t feel comfortable using it, and rather use a basic Wireguard concentrator.
Otherwise, it’s a great layer around Wireguard.
The set up is very easy, keys are rotated automatically, SSO is a good idea, and NAT traversal is very good.
They will probably benefit from more relays around the world.
I heard they have recently provided an option for running your own AS. I am not sure how easy it is to run, secure and maintain that.
- barsonme 5y agoThis is true for pretty much any VPN provider, though. Like, somebody could compromise your company and start forging OpenVPN client certificates.
- gnufx 5y agoAnd we've noticed compromises of multiple "Enterprise VPNs" reported recently.
- gnufx 5y agoThere's a free software self-hostable server called "Headscale" somewhere on Github (not that I've used it). I saw a comment somewhere that Tailscale approved of it. I wonder whether a smaller company of experts(?) whose business is focussed on this is any more vulnerable than an established one with huge resources.