Tailscale raises $100M

I thought that Tailscale was pretty interesting.

Avery Pennarun, its CTO, is somebody whose judgment I am used to trusting.

Then I learned that to use it, I would be dependent on authenticating using a login on one of the unaccountable internet behemoths who could take away my account for any random reason or no expressed reason at all.

No, thank you.

I agree, GitHub is awful.

If you use an identity provider like Okta or OneLogin, then you're not tied to any "contentful" services like GitHub or a Google account that "historically" seem to have more problems of this type.

As far as threat models go, I can't really say I understand this one too much.

Google does that, Microsoft doesn't. Microsoft will ban you from a particular service if you egregiously violate the terms of service for a particular application of theirs, but never the whole account.

Google will throw you on your ass in the blink of an eye.

Oh, that is a shame. I can see why they do it like this for businesses, but for personal accounts I refuse to use SSO. Been bitten by that a few times too many.

I _could_ use my github account, but I don't trust them at all anymore. And I'm not going to setup an account with some other service just to use this. So that is a hard pass for personal use.

For a company it makes sense to have to use whatever sso provider you are already using i guess

As an example: shortly after Russia invaded Ukraine, Namecheap cancelled all accounts of all of its customers who were located in Russia. This was done regardless of what content if any was hosted by the account, whether or not the person in question supported the war, or whether the person in question was actively fleeing Russia and may have been relying on technical infrastructure they had previously set up to help them do so.

Just because a service you sign up for is not contentful, does not mean that they won't choose to boot you off for some reason completely unrelated to anything you control or anything you chose to do.

Yes. If they can’t build basic auth and make sure it’s secure, it sends quite the message.

Super annoying and borderline unacceptable.

Okta and OneLogin are both private corporations that have each existed for 13 years. Does your threat model include an estimate for how long they will stay in business? What if one of them puts the other out of business? Does your threat model choose a winner in that fight?

As far as paid services the possibility also is there that someday _you_ run out of money and have to stop paying them. They tend to shut down your access when that happens. Another financial threat you have to model.

These things don't happen when you use public key authentication.

Is there anything in there TOS that states it or has this just been their practice so far?

Does it matter? Whether they say they will do it, or just do it without saying they will, the experience is the same.

What matters most is if they can. Then, if they ever have done. What I want is that they can't.

Is that generally true? A third-party authentication servive is needed just to get it going, or is that needed for specific use cases?

Apparently the third-party authentication service is needed just to get it going. If you get an "enterprise license" you can choose among more authentication services, but not yourself.

Some people suggest trying Nebula instead.

Avery Pennarun is CEO.

David Crawshaw is CTO.

I am corrected.

This is a strange example to pick given that (1) it's a war, and (2) a significant percentage (majority?) of Namecheap's employees and offices are in Ukraine.

If we (the US) decided to invade Canada tomorrow, you can be certain that the maple syrup would stop flowing.

Edit: According to their website[1], the overwhelming majority of their employees are in Ukraine. Two of the three cities they have offices in are on the current combat front.

[1]: https://www.namecheap.com/careers/ukraine

For enterprise, sure, using a separate IDM provider works, but last I checked, neither Okta nor OneLogin cater to individuals and their personal accounts. So as far as threat models go, I understand why people view this requirement from Tailscale as utter garbage for personal accounts.

you want a free service written, maintained, and hosted by others that they don't control. Am I understanding you?

No. I would be happy to pay for service, but they offer no choice but to rely on somebody else's authentication, regardless.

They don't want to build basic auth. They probably could, but it gives them more headaches and customer service touch points compared to delegating that out. Like: what if the user forgets their password? Or what if they lose their 2FA device?

Yes, welcome to operating a SaaS.

read harder next time. https://tailscale.com/kb/1119/sso-saml-oidc/

I don't think parent is saying it's unexpected, but rather that having a third-party identity provider (especially a corporation) is an unwarrented and/or unwanted political dependency. I deeply empathize with this sentiment but also recognize why many companies choose to rely on them (identity is very difficult).

What precisely are the consequences of the third-party auth? Is it, they get an IP ping each time a device connects or does anything? Or, does that only happen once, but they can revoke access at any time? *Surely* they aren't granted access to the content? That would be mindboggling.

This isn't a very nice comment (from my reading anyway).

> Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community.

> Comments should get more thoughtful and substantive, not less, as a topic gets more divisive.

Thank you. It is hard to interpret what this might mean, for me.

You should checkout the opensource project OpenZiti (https://openziti.github.io/). It has its own internal PKI system so you dont need to (but can) like to an external 3rd party. It also allows you to close all inbound ports and link listeners (as every endpoint has embedded identity so makes outbound only connections) and can be embedded directly into apps with SDKs as well as deploy on any popular OS or as a virtual appliance.

If you're that concerned with 3rd party auth, I'm surprised you're not more concerned about trusting your virtual network to a SaaS platform (who could definitely decrypt the traffic). For those more privacy minded, they'd probably wanna go with one of the self-hosted alternatives, of which there are now a few.