News for hackers. Stuff that matters.

A comment on Tailscale state file encryption no longer enabled by default. Parent comment

Re:Tailscale state file encryption no longer enabled by default by abtinf on Wednesday January 07, 2026 @03:48PM (#46532455)
>> This could happen when the TPM device is reset or replaced.

Isn’t that exactly the desired behavior to defend against physical attacks?

[ Parent | on HN ]
Re:Tailscale state file encryption no longer enabled by default by horsawlarway on Wednesday January 07, 2026 @04:01PM (#46532677)
Sure, but most users probably don't actually want this level of defense.

For the same reason that most folks don't use bank vault doors on their house.

Ex - even reasonably technical people hit this footgun in lots of edge cases... like updating their bios, changing the host of a vm running the tool, or having a k8s pod get scheduled on a different node.

I'm surprised this was "default on" at all.

[ Parent | on HN ]
Re:Tailscale state file encryption no longer enabled by default by SchemaLoad on Wednesday January 07, 2026 @05:11PM (#46533828)
Yes, but it turns out the TPM gets reset quite often on shitty hardware.
[ Parent | on HN ]