News for hackers. Stuff that matters.

A comment on Tailscale state file encryption no longer enabled by default. Parent comment

Re:Tailscale state file encryption no longer enabled by default by bmandale on Wednesday January 07, 2026 @04:09PM (#46532829)
If windows is encrypted with keys from the TPM anyways, then tailscale doesn't need to encrypt a second time.

Windows also bit me in the ass with this feature, but tailscale not enabling encryption wouldn't have helped one iota.

[ Parent | on HN ]
Re:Tailscale state file encryption no longer enabled by default by oktoberpaard on Wednesday January 07, 2026 @04:47PM (#46533466)
Local software could be stealing plaintext secrets from your encrypted disk. Physical access is not the only attack vector.
[ Parent | on HN ]
Re:Tailscale state file encryption no longer enabled by default by bmandale on Thursday January 08, 2026 @01:27AM (#46537891)
The only way to protect against that is if a secure application boundary is enforced by the operating system. You can make it harder for other programs to uncover secrets by encrypting them, but any other application can reverse the encryption. I don't believe using the tpm meaningfully changes that situation.
[ Parent | on HN ]