News for hackers. Stuff that matters.

A comment on Tailscale state file encryption no longer enabled by default. Parent comment

Re:Tailscale state file encryption no longer enabled by default by nottorp on Thursday January 08, 2026 @03:09AM (#46538564)
Iirc the original idea was that passkeys should be device specific. Of course that's impractical so now they're morphing to a long password that a human can't process.

In a few years someone will post "how about a long human retainable passphrase?" as a new and improved discovery.

[ Parent | on HN ]
Re:Tailscale state file encryption no longer enabled by default by SchemaLoad on Thursday January 08, 2026 @06:55PM (#46548239)
They are still different to a password in that the service you are logging in to never gets the private key. So in the case the database gets compromised, if the service provider ensures no edits were made / restores a backup, there is no need to change your passkey since it was never exposed.
[ Parent | on HN ]
Re:Tailscale state file encryption no longer enabled by default by yencabulator on Tuesday January 13, 2026 @12:12PM (#46604034)
That was possible before passkeys.

https://www.rfc-editor.org/rfc/rfc9807.html

https://en.wikipedia.org/wiki/Password-authenticated_key_agr...

[ Parent | on HN ]