4 ms·
> The coordination server has ultimate control, and a malicious one could easily insert their own clients, hijack DNS or even just passively monitor devices. T
by db48x 4y ago
> The coordination server has ultimate control, and a malicious one could easily insert their own clients, hijack DNS or even just passively monitor devices.
This is true, but I feel that it is important to say that with Tailscale the traffic between your machines doesn’t travel through any central server. Machine A and machine B send encrypted traffic directly to each other. The coordination server just authenticates them and tells them each other’s public keys, so that the machines can encrypt traffic going to the other and decrypt traffic arriving from the other. You can absolutely monitor that encrypted traffic to ensure that it is not being sent somewhere unexpected. If you want to route traffic from your phone to the wider internet you will have to provide an exit node of your own, so Tailscale doesn’t even have to deal with that headache either. It’s a really nice design.
- operator-name 4y agoYes, under normal circumstances (you trust the coordinator) its a really elegant system. I've not enumerated it all, but there's a _lot_ that a compromised coordinator can do. > You can absolutely monitor that encrypted traffic to ensure that it is not being sent somewhere unexpected. By the point that you do this at scale with your whole fleet, you'd almost be better off just setting up the tunnels yourself. This is also assuming your devices don't need to do NAT traversal (which is honestly one of my favourite parts of Tailscale). There's a lot more a malicious actor in control of the coordinator could do, even for preexisting connections.
- db48x 4y ago> By the point that you do this at scale with your whole fleet, you'd almost be better off just setting up the tunnels yourself. I suppose you are correct, if you regularly have traffic between every pair of nodes in the network. But I suspect that most companies have a lot of laptops that only talk to some datacenter/office via the VPN plus Gmail/O365/whatever via HTTPS. Monitoring in that situation is very easy.
- chipsa 4y agoIf you're paranoid enough to think about the coordinator getting hijacked, you can also have each of the clients send up their logs to your splunk or whatever server, and correlate them together (double entry logging, anything that doesn't have a match is probably wrong). Should be able to do the same for DNS: anything that's not a ts.net domain getting queried against the tailscale coordinator server isn't right, etc.