14 ms·

I was going to try TailScale but then it seemed the only option to do so as an individual was to login with a 3rd party cloud provider, which I in no way want t

by arsome 4y ago

I was going to try TailScale but then it seemed the only option to do so as an individual was to login with a 3rd party cloud provider, which I in no way want tied into my networks. I gave up and just setup wireguard directly instead, I don't trust Tailscale either if that's their attitude towards privacy, it's permanently marred my vision of their product.

Saris 4y ago
Yeah that's the biggest hangup I have, it just seems strange to rely on a third party login to be able to access something as important as a VPN. If my google account or whatever gets shut off for any reason I'd be pretty hosed.
- ignoramous 4y ago
  Avery, co-founder at Tailscale, has some strong opinions about why SSO is sufficient for their product. They wrote a bit about their thought process: Factors in authentication (2019), https://apenwarr.ca/log/20190114 https://apenwarr.ca/log/20190114 > It seems to me that the above successful enrollment patterns all use one or more of the following techniques: > A human authenticates you and issues you a token (usually in person). > A short-distance, physical link (proximity-based authentication) like a biometric sensor, or USB or bluetooth connection. > Delegation to an existing authenticator [SSO]... > What people tend to miss... is that enrollment is necessary whether or not you send a push notification to the phone during login. The push notification is only secure if this specific browser instance is enrolled; but if this browser is enrolled, then the push notification adds no extra security... The enrollment was the security. Fully expect them to ship u2f authenticators or sell them at tsCare shops!
aftbit 4y ago
Same, I abandoned Tailscale sign up for this reason as well. Perhaps consider https://github.com/juanfont/headscale https://github.com/juanfont/headscale ?
JeremyNT 4y ago
Indeed, this is why I won't use it either. I settled on Slack's Nebula [0] instead of wireguard because it handles direct p2p communication between nodes automatically. There also exists an open source implementation of the tailscale control server [1] that you could self host. [0] https://github.com/slackhq/nebula https://github.com/slackhq/nebula [1] https://github.com/juanfont/headscale https://github.com/juanfont/headscale
- rhuber 4y ago
  (Nebula coauthor here) People sometimes ask me to describe the differences between Nebula and Tailscale. One of the most important relates to performance and scale. Nebula can handle the amount of internal network traffic and scalability of nodes (100k+ nodes, constant churn) required on a large network like Slack's, but Tailscale cannot. Tailscale's performance is fine for many situations, but not suitable for infrastructure. It is just a fundamentally different set of goals. Nebula was created and open sourced before Tailscale was offering their product, but their architecture is similar to older offerings in the market, and is something we purposely avoided when creating Nebula. Fwiw, I even recommend Tailscale to friends who want to do things like connect to their Plex server or Synology or [other thing] at home remotely. It simplifies this kind of thing greatly and doesn't require you to set up any infrastructure you control directly, which can be a headache for folks who just want to reach a handful of computers/devices.
  - crawshaw 4y ago
    Tailscalar here. Tailscale can handle 100k+ nodes with lots of churn just fine.
    - rhuber 4y ago
      Fair enough. I am sure the key distribution is fast and all that, but not needing peer key distribution at all was a goal and the overhead associated is less scalable than just not doing it at all. Regardless, very cool that you can handle that many nodes, which is a hard problem. I assume you do just-in-time key distribution or something, because (n-1) distribution of peer keys would be ... less than ideal. Anywho, the more important bit is my point about performance. Nebula is significantly faster than userspace Wireguard, and plain userspace Wireguard is (last I checked) a bit faster than Tailscale, due to the additional code needed for things like your ACLs. At gigabit type scale it is probably fine and not noticeable, but at Slack, we needed to scale to 10G+ on links, while ensuring we didn't take a significant hit on CPU resources. Again, I think Tailscale is very good for its target use case as a VPN replacement, and congrats on raising these funds!
Pr0ject217 4y ago
Interesting. That's a non-starter for me as well.
nsm 4y ago
I’m curious. Why not create a new google account that is not used for anything but Tailscale and use that?
aborsy 4y ago
I don’t understand why these mesh VPN companies don’t take themselves out of the trust loop? For example, by supporting Wireguard preshared keys (if that makes sense). In light of the recent incidence at Okta, the risk of the VPN company or the identity provider getting compromised, or provided with a gag order by the government, should be accounted for.
- PLG88 4y ago
  You should checkout the opensource project OpenZiti (https://openziti.github.io/ https://openziti.github.io/). It has its own internal PKI system so you dont need to (but can) like to an external 3rd party. It also allows you to close all inbound ports and link listeners (as every endpoint has embedded identity so makes outbound only connections) and can be embedded directly into apps with SDKs as well as deploy on any popular OS or as a virtual appliance. Our opinion of zero trust is that you should not have to trust us. Thats why we made is open source and with its own internal identity system. The only things you need to trust are the controller (which uses your CA/PKI) and the code (which you can audit).
web007 4y ago
Your personal dislike of cloud SSO is not the same as "their attitude towards privacy". Before you do anything "permanently" you should read their reasoning behind that decision: https://tailscale.com/kb/1013/sso-providers/ https://tailscale.com/kb/1013/sso-providers/ > Tailscale works on top of the SSO/IDP/IAM identity provider you or your company already use. > We don’t support sign-up with email addresses. By design, Tailscale is not an identity provider: there are no Tailscale passwords. > Using an identity provider is not only more secure than email and password, but it allow us to automatically rotate connection encryption keys, follow security policies set by your team (e.g., 2FA), and more. You can BYO SAML provider if you like, you'll just have to pay for it: https://tailscale.com/kb/1119/sso-saml-oidc https://tailscale.com/kb/1119/sso-saml-oidc
- lupire 4y ago
  I can't afford Enterprise "contact us" pricing for personal use or small team. They don't even give the option to try to debug my own identity provider. aka the BYO SAML feature does not exist for personal or small team/business users. But maybe that's the point? TailScale's product is actually an identity integration layer for Wireguard? If you don't need an identity provider, Tailscale doesn't add value over Wireguard?
- SahAssar 4y ago
  Requiring you to disclose info to google, microsoft, okta or onelogin can very clearly be an "attitude towards privacy", right?
  - yawaramin 4y ago
    Not necessarily. It's possible to create a new Google account (e.g.) just for Tailscale, and not use it for anything else. That way the only thing Google can know about it is that it's used to log in somewhere.
    - SahAssar 4y ago
      Google requires a phone number to sign up these days, and you'd need to isolate google & tailscale in a private window or a firefox privacy container. If you use chrome you'd also get auto-logged in to chrome with your google account. IMO there is no real way to use google in a privacy-protecting way.
paxys 4y ago
Not sure why everyone is hung up on this. You don't have to use a third party provider for auth. They support SAML and OIDC, and it is pretty easy to set up your own auth server. There are enough open source implementations out there you can use.
- ptomato 4y ago
  only with an enterprise subscription.
jupp0r 4y ago
What’s your concern, specifically? To me it sounds like understanding in detail how oauth works would make you feel much better about this.
colordrops 4y ago
Agreed, if you have no need to bust a NAT, just set up wireguard directly yourself, and avoid closed source products from corporations managing your most secure and private data.

by arsome 4y ago

Saris 4y ago

Yeah that's the biggest hangup I have, it just seems strange to rely on a third party login to be able to access something as important as a VPN. If my google account or whatever gets shut off for any reason I'd be pretty hosed.

ignoramous 4y ago
Avery, co-founder at Tailscale, has some strong opinions about why SSO is sufficient for their product. They wrote a bit about their thought process: Factors in authentication (2019), https://apenwarr.ca/log/20190114 https://apenwarr.ca/log/20190114 > It seems to me that the above successful enrollment patterns all use one or more of the following techniques: > A human authenticates you and issues you a token (usually in person). > A short-distance, physical link (proximity-based authentication) like a biometric sensor, or USB or bluetooth connection. > Delegation to an existing authenticator [SSO]... > What people tend to miss... is that enrollment is necessary whether or not you send a push notification to the phone during login. The push notification is only secure if this specific browser instance is enrolled; but if this browser is enrolled, then the push notification adds no extra security... The enrollment was the security. Fully expect them to ship u2f authenticators or sell them at tsCare shops!

aftbit 4y ago

Same, I abandoned Tailscale sign up for this reason as well. Perhaps consider https://github.com/juanfont/headscale https://github.com/juanfont/headscale ?

JeremyNT 4y ago

Indeed, this is why I won't use it either. I settled on Slack's Nebula [0] instead of wireguard because it handles direct p2p communication between nodes automatically. There also exists an open source implementation of the tailscale control server [1] that you could self host. [0] https://github.com/slackhq/nebula https://github.com/slackhq/nebula [1] https://github.com/juanfont/headscale https://github.com/juanfont/headscale

rhuber 4y ago
(Nebula coauthor here) People sometimes ask me to describe the differences between Nebula and Tailscale. One of the most important relates to performance and scale. Nebula can handle the amount of internal network traffic and scalability of nodes (100k+ nodes, constant churn) required on a large network like Slack's, but Tailscale cannot. Tailscale's performance is fine for many situations, but not suitable for infrastructure. It is just a fundamentally different set of goals. Nebula was created and open sourced before Tailscale was offering their product, but their architecture is similar to older offerings in the market, and is something we purposely avoided when creating Nebula. Fwiw, I even recommend Tailscale to friends who want to do things like connect to their Plex server or Synology or [other thing] at home remotely. It simplifies this kind of thing greatly and doesn't require you to set up any infrastructure you control directly, which can be a headache for folks who just want to reach a handful of computers/devices.
- crawshaw 4y ago
  Tailscalar here. Tailscale can handle 100k+ nodes with lots of churn just fine.
  - rhuber 4y ago
    Fair enough. I am sure the key distribution is fast and all that, but not needing peer key distribution at all was a goal and the overhead associated is less scalable than just not doing it at all. Regardless, very cool that you can handle that many nodes, which is a hard problem. I assume you do just-in-time key distribution or something, because (n-1) distribution of peer keys would be ... less than ideal. Anywho, the more important bit is my point about performance. Nebula is significantly faster than userspace Wireguard, and plain userspace Wireguard is (last I checked) a bit faster than Tailscale, due to the additional code needed for things like your ACLs. At gigabit type scale it is probably fine and not noticeable, but at Slack, we needed to scale to 10G+ on links, while ensuring we didn't take a significant hit on CPU resources. Again, I think Tailscale is very good for its target use case as a VPN replacement, and congrats on raising these funds!

Pr0ject217 4y ago

Interesting. That's a non-starter for me as well.

nsm 4y ago

I’m curious. Why not create a new google account that is not used for anything but Tailscale and use that?

aborsy 4y ago

I don’t understand why these mesh VPN companies don’t take themselves out of the trust loop? For example, by supporting Wireguard preshared keys (if that makes sense). In light of the recent incidence at Okta, the risk of the VPN company or the identity provider getting compromised, or provided with a gag order by the government, should be accounted for.

PLG88 4y ago
You should checkout the opensource project OpenZiti (https://openziti.github.io/ https://openziti.github.io/). It has its own internal PKI system so you dont need to (but can) like to an external 3rd party. It also allows you to close all inbound ports and link listeners (as every endpoint has embedded identity so makes outbound only connections) and can be embedded directly into apps with SDKs as well as deploy on any popular OS or as a virtual appliance. Our opinion of zero trust is that you should not have to trust us. Thats why we made is open source and with its own internal identity system. The only things you need to trust are the controller (which uses your CA/PKI) and the code (which you can audit).

web007 4y ago

Your personal dislike of cloud SSO is not the same as "their attitude towards privacy". Before you do anything "permanently" you should read their reasoning behind that decision: https://tailscale.com/kb/1013/sso-providers/ https://tailscale.com/kb/1013/sso-providers/ > Tailscale works on top of the SSO/IDP/IAM identity provider you or your company already use. > We don’t support sign-up with email addresses. By design, Tailscale is not an identity provider: there are no Tailscale passwords. > Using an identity provider is not only more secure than email and password, but it allow us to automatically rotate connection encryption keys, follow security policies set by your team (e.g., 2FA), and more. You can BYO SAML provider if you like, you'll just have to pay for it: https://tailscale.com/kb/1119/sso-saml-oidc https://tailscale.com/kb/1119/sso-saml-oidc

lupire 4y ago
I can't afford Enterprise "contact us" pricing for personal use or small team. They don't even give the option to try to debug my own identity provider. aka the BYO SAML feature does not exist for personal or small team/business users. But maybe that's the point? TailScale's product is actually an identity integration layer for Wireguard? If you don't need an identity provider, Tailscale doesn't add value over Wireguard?
SahAssar 4y ago
Requiring you to disclose info to google, microsoft, okta or onelogin can very clearly be an "attitude towards privacy", right?
- yawaramin 4y ago
  Not necessarily. It's possible to create a new Google account (e.g.) just for Tailscale, and not use it for anything else. That way the only thing Google can know about it is that it's used to log in somewhere.
  - SahAssar 4y ago
    Google requires a phone number to sign up these days, and you'd need to isolate google & tailscale in a private window or a firefox privacy container. If you use chrome you'd also get auto-logged in to chrome with your google account. IMO there is no real way to use google in a privacy-protecting way.

paxys 4y ago

Not sure why everyone is hung up on this. You don't have to use a third party provider for auth. They support SAML and OIDC, and it is pretty easy to set up your own auth server. There are enough open source implementations out there you can use.

ptomato 4y ago
only with an enterprise subscription.

jupp0r 4y ago

What’s your concern, specifically? To me it sounds like understanding in detail how oauth works would make you feel much better about this.

colordrops 4y ago

Agreed, if you have no need to bust a NAT, just set up wireguard directly yourself, and avoid closed source products from corporations managing your most secure and private data.