Tailscale state file encryption no longer enabled by default

Re:Tailscale state file encryption no longer enabled by default by plagiarist on Wednesday January 07, 2026 @05:00PM (#46533652)

TPMs are basically storing the hashes of various pieces of software, then deterministically generating a key from those. Since the BIOS software changed, that hash changed, and the key it generates is completely new.

If someone had messed with your BIOS maliciously, that's desirable. Unfortunately you messing with your BIOS intentionally also makes the original key pretty much unrecoverable.

[ Parent | on HN ]

Re:Tailscale state file encryption no longer enabled by default by cronos on Wednesday January 07, 2026 @07:01PM (#46535118)

IIUC, it's a bit more nuanced: TPM stores hashes of various things like firmware in PCRs, and when creating keys in the TPM you can optionally bind the key to specific PCR values. But you also don't have to (and Tailscale doesn't), in which case keys survive firmware updates for example.

[ Parent | on HN ]