Hacker News Reader

Comment by mtlynch | Hacker News Reader

It's good that they fixed it, but this sounds like it would have been difficult to exploit:

>A malicious individual who knew a target node’s database ID could generate and accept a sharing invite for that node without being an admin of the target node’s tailnet...as long as the individual knew the target’s node ID.

...

>The node ID is an integer used in the admin panel’s database, and is not related to the node "StableID" that is visible to Tailscale clients... IDs are not sequential or otherwise easily guessable.

I guess it depends on the search space of the IDs. If they're 64-bit integers, very hard to guess a valid ID. If they're only 32-bit integers, then you could have guessed, but it would be pretty obvious in Tailscale's logs.

View on HN

(bulletin co-author) Yeah that bit could have been spelled out more. It's a random 64-bit int.

What about the insider risk prospective? A random int64 isn't that hard to guess if you can easily look at a database.

If you're looking at a database, you're not guessing. Otherwise: a random int64 is in fact difficult to guess.

Exactly - which is why I was asking what is the nature of the insider threat risk if someone did not have to guess.

In a prod deployment who has the rights to see this info without raising too many flags?

The database that gives you all the random 64 bit IDs for devices: that's another vulnerability.

(reporter) I spent _a long time_ trying to derive how this value was generated :’)

Did you spend any time trying to see if you could steal the values from somewhere else? Given the other breaks in Tailscale, I'd bet there's an info leak somewhere. Deriving it from first principles is hard. Stealing it from somewhere should be easier.

I had a good look for usable info leaks, some GitHub dorking for how the IDs might’ve been generated, but came up naught in the end

I guess this could be mitigated by not trusting the coordination server? https://tailscale.com/blog/tailnet-lock/

I just tried to set this up and couldn't. Seems like it's invite only with a waitlist :/

Yeah, we're adding people slowly because decentralized authorities like the one that tailnet lock implements can have nasty failure modes, e.g. some bug that prevents any new addition to the tailnet at all and forces manual recovery on each of your devices separately. So, we're putting miles on it with a little care, and making sure folks who sign up are aware of the current limitations and risks.

Oh is that all the problem is?

Anyone with automated deployments and self provisioning should be fine with that risk. I thought it was a lot more premature than this.

Good ops is more than automated deployments. Complex systems have complex failure modes.

If you're excited about tailnet lock and want to get on the alpha sooner rather than later, feel free to drop me an email. As Dave mentioned we are slowly crunching through the waitlist to get some miles in, but I'm also happy to take on enthusiastic testers ahead of that!

You can email me at tom@ (tailscale dot com)

Reply on news.ycombinator.com