Hacker News Reader

See their blog post about this from last week.

https://tailscale.com/blog/tailscale-privacy-anonymity

# What Tailscale isn't: an anonymity service

Tailscale is a secure connectivity tool that puts the highest value on the privacy of your packets. But we made an intentional choice from day one that we weren't going to try to be an anonymity tool. Quite the opposite in fact! We're an identity-centric network.

Anonymity tools, like Tor, need to be architected very differently. They trade away speed to reduce traceability. They are hard to inspect and diagnose and debug, as a feature. They make enemies, both political and corporate. They are inherently hard to audit and control, by design. In short, they are the exact opposite of what you want your corporate (or even homelab) network to be.

We believe anonymity tools are essential to safe network infrastructure and a free society. But, those tools are made by other people.

…

But if you’re looking for complete anonymity online, Tailscale is not the tool for you. Y'all, we're an identity-centric network with a centralized control plane. You should assume law enforcement can easily find out that you use Tailscale. Tailscale packets are pretty easy to detect, so you can assume they could know, through ISP logs, the shape and size of data you send between different nodes in different places (albeit without knowing the decrypted packet contents). You should assume they can correlate that flow metadata with your login identity.

Open and Close events are not related to identity or anonymity, so that post isn't in itself relevant. It does show that the team is very pragmatic, though.

I get why they capture this data, and by doing so they managed to build an exceptionally great service. But I also understand why one would be uncomfortable with exposing this data.

This isn't relevant to what you were replying to. Parent comment is complaining that there are logs being sent out about what is happening on his private network, he's not expecting anonymity on the internet like Tor (which is what your link describes).

The parent was talking about metadata, which is that same type of data mentioned.

The similarities stop there, both are "metadata".

The issue parent is complaining about is that tailscale sends data about communication data in your _private_ network to their servers. The reply to that is a blog post that clarifies that tailscale is not Tor. Irrelevant, nobody is comparing it to Tor.

That section of the policy simply describes how the system works. It's very valuable information for enterprise customers who are effectively their entire market revenue-wise. Think access logs, intrusion detection, and so on. I do not interpret their policies such that they are processing the information you added emphasis to beyond what is necessary to serve the customer. What evidence do you have to the contrary?

The irony of your post, which brings up Fear Uncertainty and Doubt, is certainly not lost on me. I'm also sure you could just ask apenwarr directly for clarification.

> I do not interpret their policies such that they are processing the information you added emphasis to beyond what is necessary to serve the customer. What evidence do you have to the contrary?

Respectfully, you are failing to appreciate the full scope of the problem. It doesn't matter what Tailscale do with the data. The log contents don't matter at all, only the fact that a network connection was made. Every network connection you make creates metadata about you, and the Internet itself — the path between me and Tailscale's logging endpoint — is always listening.

Think what conclusions can be drawn about a person's behavior from a log of their network connections. Encryption doesn't matter, because we're just talking about metadata; each connection's timestamp, source, destination, and port. Think about the way each additional thing-which-makes-network-requests increases the surveillance value of all the others.

Straight away, many people's NTP client tells the network what OS they use: `time.windows.com`? Probably a Windows user. `time.apple.com`? Probably Mac or iOS. `time.google.com`? You get the idea. Yeah, anyone can configure an NTP client to use any of those hosts, but the vast vast majority of people are taking the default and probably don't even know what NTP is.

Add a metadata point: somebody makes a connection to one of the well-known Wi-Fi captive portal detection hosts around 4PM on a weekday? Maybe somebody just got home from school. Captive portal detection at 6PM on a weekday? Maybe somebody just got home from work. Your machines are all doing this any time they reconnect to a saved Wi-Fi network: https://en.wikipedia.org/wiki/Captive_portal#Detection

Add a metadata point: somebody makes a network connection to their OS's default weather-widget API right after the captive-portal test, and then another weather-API connection exactly $(DEFAULT_INTERVAL} minutes later? That person who got home is probably still home.

Anyway, you get the point that this stuff adds up! The problem with Tailscale is that its default behavior exposes metadata about entire additional classes of traffic in addition to all the examples I just mentioned that my devices were already leaking. Tailscale would have me start telling the Internet “hey I'm here and doin' stuff!” every time I read or write any file on my NAS, every time I use Steam Link remote play over LAN, every time I SSH or RDP into any of my other machines.

The free “Personal” tier is limited to only 3 users but 100 devices, so it's normal and expected to set it up the client on any and every computer you own: https://tailscale.com/kb/1154/free-plans-discounts#personal-...

My behavior would be exposed to every layer of service provider along the way: my ISP, my ISP's ISPs, the cloud provider Tailscale use to host their surveillance endpoint, Tailscale themselves if they so choose, whatever creepy secret spy implants we're not allowed to know about. No thanks! If you want to be private, you must be silent.

> My behavior would be exposed to every layer of service provider along the way: my ISP, my ISP's ISPs, the cloud provider Tailscale use to host their surveillance endpoint,

Maybe I'm missing something here but I'd guess that data is encrypted and not a free for all of open data that any old ISP could snoop on. If not that'd be a serious issue.

Not to say that you don't have some good points. Even just the pattern and timings of that data being sent could be exploited. Also TS would still have that full data.

Though I'd have to study the details. Do they aggregate and then send it at regular intervals, etc? In the end would it be that much worse than what Apple, Google, Microsoft collect?

> Maybe I'm missing something here but I'd guess that data is encrypted and not a free for all of open data that any old ISP could snoop on.

Yes, you are missing the entire point. You are talking about data. I am talking about metadata — data about data. The contents of each log request are a total red herring. Just pretend that the encrypted log messages are a single bit, just a way to increase a counter that “something has happened” on a person's Tailnet.

The encrypted log message structure does tell Tailscale “this particular machine on the Tailnet talked to this other particular machine on the Tailnet at this time”, and one should assume Tailscale decrypt and interpret those details, but what I'm talking about is the ability for any part of the network path to interpret those log connections without decrypting them as “somebody is using their Tailnet right now in any capacity”, and when, and from where, and the ability to combine that new class of metadata with all the other metadata our modern OSes are constantly generating.

> Do they aggregate and then send it at regular intervals, etc?

This is already addressed in my original comment. Again, see KB1011: https://tailscale.com/kb/1011/log-mesh-traffic

“Each Tailscale agent in your distributed network streams its logs to a central log server (at log.tailscale.com). This includes real-time events for open and close events for every inter-machine connection (TCP or UDP) on your network.”

“This includes real-time events for open and close events for every inter-machine connection (TCP or UDP) on your network.”

“real-time events”!!

e: Recommended reading:

- https://kieranhealy.org/blog/archives/2013/06/09/using-metad...

- https://abcnews.go.com/blogs/headlines/2014/05/ex-nsa-chief-...

Eh, as a network administrator you want the netlogs on by default and you very clearly onboard everyone to the network with a memorable warning to do their personal browsing over some other interface. You've usually got at least some minimal audit requirement on any network with high value stuff on it.

It's probably not great that someone trying to use the free sample product lands in the same netlogging regime as the work network default, but I suspect thats more about allocation of attention and priority which understandably goes to the companies that make up approximately all of their business. Keeping the free sample product around after its long bern clear "this is for work computers" is just one of those things. The "no support" suffix on a setting is not to me the smoking gun you make it out to be, and I'm pretty hardcore in my attitudes about surveilance.

I agree it's the wrong default for a purely personal user, but TailScale has enough "good faith actor" points with me that I'll give them the benefit of the doubt on malicious/evil dragnet surveilance ambitions. What could they possibly want with the data of a group of people who are by construction not spending money on a VPN? They'd be storing it at a loss.

> What could they possibly want with the data of a group of people who are by construction not spending money on a VPN? They'd be storing it at a loss.

This is the exact point where our conclusions diverge.

Why are they sending themselves so much "useless" data-intensive logs by default, from their non-paying clients that accounts for roughly ~95% of the userbase and from a profitable business perspective, largely ineligible for troubleshooting support? For me, the only logical conclusion is that the data is valuable to them.

As someone who also cares about privacy, hear are a few things that IMO suggest that free customers' logs are a part of their business model:

* Their documentation has plenty of references to security, but no references to privacy outside of the privacy policy.

* They have all but eliminated any revenue stream from average user when they made an unsolicted announcement that they upgraded their free plan to allow 100 devices and 5 users.

* The content they sponsor for marketing/advertising seems targeted for consumers instead of networking professionals. I don't see Cisco and Palo Alto Networks sponsoring every Linux/self-hosting podcast or YouTube channels for example.

* Even the flag-name for turning off logging is mild deterrent based on what you will lose (`--no-support`) as opposed to being neutral '--no-logging' or truly descriptive like most FOSS companies that are not pushing an ulterior motive such as '--no-analytics'.

* logs cannot be disabled for phones

* In my experience, disabling logs was perhaps the only thing that was not configurable through the GUI

I'm into privacy and still relatively new on the networking scene thanks to setting up OpenWrt on my router. Am I correct that when tailscale updates/hijacked resolv.conf, subsequent DNS resolution is passed onto them on visited websites even when tailscale is not being used? No, they can't "read" your traffic, but if I understand things right, they know every website you visited and for how long, which is more than enough data for a rich marketing profile. That was my takeaway before I jumped ship for a self-hosted solution.

My understanding is that they have the holy grail of data because they are getting all of your LAN, WAN and mobile network traffic. I'm not aware of (m)any companies whose business model allows access to all three? It's like if your ISP and your Mobile Network had a baby on your local server, and that baby reports every website you visit.

> Am I correct that when tailscale updates/hijacked resolv.conf, subsequent DNS resolution is passed onto them on visited websites even when tailscale is not being used?

I think you're incorrect in the default settings, even when tailscale is active.

From the docs, last paragraph under Global nameservers https://tailscale.com/kb/1054/dns#global-nameservers

By default, your tailnet's devices use their local DNS settings for all queries. To force clients to always use the nameservers you define, you can enable the Override DNS servers toggle.

> I think you're incorrect in the default settings

What mac-attack is correct about is that by default, `tailscaled` sets itself as the only DNS resolver and proxies all DNS requests to your non-Tailscale nameservers. Citations:

- https://tailscale.com/kb/1381/what-is-quad100#dns-resolver

“`100.100.100.100` or Quad100 is a special Tailscale IP address […] that provides essential local services. It operates similarly to the localhost address (`127.0.0.1`) but serves only Tailscale-specific services. These services include a DNS resolver.”

“One of the services provided by Quad100 is a DNS resolver running on port 53 (1100.100.100.100:531). A DNS resolver is a service that translates IP addresses to hostnames like `google.com` or `macbook.tailnetname.ts.net`. Quad100 is a stub resolver, similar to systemd-resolved, except with extra features.”

- https://tailscale.com/blog/sisyphean-dns-client-linux

“The upcoming Tailscale 1.8 release implements all of the above [other DNS managers], which should hopefully make DNS on Linux just work, no matter how your machine is choosing to do it.”

- https://tailscale.com/kb/1235/resolv-conf

“Tailscale overwrites `/etc/resolv.conf` when MagicDNS is enabled in the tailnet”

“Tailscale tries to interoperate with a number of other DNS managers before resorting to overwriting `/etc/resolv.conf`.”

- https://tailscale.com/kb/1081/magicdns

“Tailnets created on or after October 20, 2022 have MagicDNS enabled by default.”

It does say “While Quad100's DNS resolver operates locally without logging, forwarded requests might be logged by configured nameservers.”, but the fact remains that the Tailscale software is very aggressive about taking over all DNS resolution on your system. Once that is done, the option of whether or not `tailscaled` overrides your default nameservers can be configured remotely without you knowing it's happening!

https://tailscale.com/kb/1054/dns#tailscale-dns-settings

I'm split on this. According to your links, it tries to cooperate with the system resolver. If it can't find a way to do it, then yeah, it kinda has to replace it.

Of course, they could put this much more front and center in the docs, so that if you're running some funky setup and know what you're doing, you should be able to easily do it - which you probably can with the `--disable-dns thing`. But putting it in a prominent spot in the docs could help to not overlook this.

I've just checked the setup on a machine running systemd-networkd and resolved, and resolv.conf wasn't touched. It only added a specific dns setup for the tailscale0 interface, which only covers my tailnet name and ips. It doens't even show as a fallback or whatever in the global section.

> the option of whether or not `tailscaled` overrides your default nameservers can be configured remotely without you knowing it's happening!

I mean, there's two situations. Either we're talking about a "pro" environment, where corp vpns taking over your local network config, as much as I hate it, isn't exactly news. Then there's the personal plans users, in which case, if the DNS changes without you knowing, you probably have way bigger problems.

> In my experience, disabling logs was perhaps the only thing that was not configurable through the GUI

A lot is not configurable from the GUI. Announcing routes for instance (out of my head, there are other switches I set on tailscale) Or exit nodes

Logging everyones network data/metadata would likely be illegal under employment law in Norways. Other European countries may have same/similar rules. GDPR may also apply. So be careful with how broadly you apply that default.

This comment should really be much higher.

You do get support if you're a free user, it's just best effort and via e-mail only.