Nostr Web Client

Not true, or not entirely true

The control plane can be self hosted (headscale), and they have a mitigation for mitm or attack surface in the control plane - tailscale lock.

It's FOSS, on their clients, if their control plane is FULLY compromised, literally completely taken over, they can still not add new machines, nor access them, at best they can shut you out of derp (can't even prevent your already logged in machines to connect because holepunch)

https://tailscale.com/kb/1230/tailnet-lock-whitepaper

xiangcai 2mo ago

now i probably need nostr:nprofile1qqs99d9qw67th0wr5xh05de4s9k0wjvnkxudkgptq8yg83vtulad30gpp4mhxue69uhkummn9ekx7mqpzpmhxue69uhkummnw3ezumrpdejqx0sfxm to explain because I'm 5 and retarded

Reply to this note

Please Login to reply.

Discussion

semisol 2mo ago

basically tailscale does direct connections between nodes, yes, and it is encrypted

but these nodes at the start don’t know each other, they ask the tailscale control plane “what nodes are there”

if the control plane lies and inserts fake/impersonating nodes, it could pretend to be your trusted laptop for example

jb55 2mo ago

this makes no sense. if they couldn't add machines then how do they add your machines? something has to coordinate everything.

jb55 2mo ago

i meant to reply to nostr:note1sv9hnywxw9hkq9qtxpzmr2zv9hmfmtzqd6rlm3yruj0uyu6wldeqzk2e77

not sure how that happened

Danny, the cyber guy 2mo ago

With lock, YOU are the one coordinating. After a machine gets added it can't do anything until YOU sign a lock message. (I.e. sign its pubkey and publish that)

Danny, the cyber guy 2mo ago

It's true without tailscale lock, please look into that feature