News for hackers. Stuff that matters.

A comment on Tailscale state file encryption no longer enabled by default. Parent comment

Re:Tailscale state file encryption no longer enabled by default by nottorp on Wednesday January 07, 2026 @04:03PM (#46532719)
So it protects you from an attacker who already has local root?
[ Parent | on HN ]
Re:Tailscale state file encryption no longer enabled by default by cronos on Wednesday January 07, 2026 @06:58PM (#46535081)
Not even that. An attacker with local root can just extract the wireguard keys from process memory, or use the TPM to decrypt the state file like Tailscale would.

The only scenario where it helps is a local attacker who can read the state file on disk, but is not full root. Kinda unlikely on Linux, but could happen on Windows.

[ Parent | on HN ]
Re:Tailscale state file encryption no longer enabled by default by nottorp on Thursday January 08, 2026 @03:07AM (#46538558)
> An attacker with local root can just extract the wireguard keys from process memory, or use the TPM to decrypt the state file like Tailscale would.

That was my point :)

[ Parent | on HN ]