Re:Tailscale state file encryption no longer enabled by default
by PunchyHamster on Thursday January 08, 2026 @04:24AM
(#46539028)
That is also required for any kind of key rotation to work, you're getting new key for a key, because alternative of using key directly would mean re-encrypting the whole drive when it changes and of course only having single one instead of multiple
Re:Tailscale state file encryption no longer enabled by default
by nottorp on Thursday January 08, 2026 @05:11AM
(#46539330)
So if you’re using the TPM based encryption you’d better have a working backup system.
How many home users have that? How many stories of personal data loss are we going to hear as windows 11 ready PCs start to die?
Re:Tailscale state file encryption no longer enabled by default
by PunchyHamster on Friday January 09, 2026 @12:45PM
(#46556603)
don't worry, ms pushes users to just put data on onedrive, they will start losing data far before machines actually die. We already had plenty of stories of that mess.
https://boingboing.net/2026/01/05/everyone-hates-onedrive-mi...
Re:Tailscale state file encryption no longer enabled by default
by db48x on Saturday January 10, 2026 @12:50PM
(#46568064)
Working backups are important regardless, but if you use a TPM then you’d better have your recovery keys somewhere convenient. I’m sure you can print them out and keep them in your wallet or something.
The reason it's done this way is to allow multiple methods of accessing the disk, to allow the encryption password to be changed without having to rewrite every single sector of the disk, etc, etc. You can even “erase” the disk in one swift operation by simply erasing all copies of the key.