3 ms·

This new service allows them (or if they’re hacked - anyone)… to MitM your connections - they state themselves they could ssl terminate the connections as they

• ignoramous 4y ago
  > This new service allows them (or if they’re hacked - anyone)… to MitM your connections... TFA mentions that the immutable certificate logs reveal if something spooky is going on. Not enough of a guarantee since the tailscale client may siphon off certs from a local device to its servers anyway. But that's us being extremely paranoid about tailscale (in which case, why use it?). Second, most services are run behind reverse-proxying load balancers which invariably are setup to "MiTM" aka terminate TLS. The providers running those load balancers control IPs + DNS records too, for good measure. I guess, supporting a dizzying array of functionality makes Tailscale a decentralised cloud service provider themselves.