4 ms·

Still can't wrap my head around that TS does not allow to signup with your custom email/password combination but forces you to use bigtech (GitHub, Apple, Meta

Still can't wrap my head around that TS does not allow to signup with your custom email/password combination but forces you to use bigtech (GitHub, Apple, Meta etc.) to login. Running your custom OIDC provider as a small, private person does not make any sense either.

dijit 2y ago
I think that's quite smart, and OIDC is an open standard at least. Securing usernames/passwords and handling second factors etc; is already done so well and it's hard to do. Having a clear 'this is where we can be secure' stances is what makes me want to trust them more.
- littlecranky67 2y ago
  > and OIDC is an open standard at least But what kind of argument is that, if you are a single individual who wants to signup, I am not going to setup my OIDC servers. That is like saying it is a good idea to run a dedicated linux server in a datacenter under your own management, when all you want is a small static website for your mom+pop store. Sure, you can run your own server and it is all open source, but just overkill. > already done so well and it's hard to do. So hard that literally all other websites in the world with a login have implemented it. And tailscale is a VPN-like technology company - if they can't manage to implement a login because it is hard, then I would definitely not accept their offerings.
- guappa 2y ago
  It's an open standard, but would they allow me to use my OIDC?
  - dijit 2y ago
    Yes, they allow that.
- lo0dot0 2y ago
  Why is that smart? I signed up for a Microsoft Account with my email and I can use Microsoft Account to log in to Tail scale but I can't use the email directly? How does the middle man bring anything to the table?
  - dijit 2y ago
    Because then tailscale doesn’t store a username and password for you, so unless microsoft is hacked you won’t be- theoretically.
    - littlecranky67 2y ago
      but at the same time, now Microsoft knows you are using Tailscale (and they use this data in their tracking + analytics). And all the other products. They get a very good insight of your online habbit, because they have a list of all other products and apps you use where you sign in with your microsoft account. And due to the way token refresh works, they even have a good idea how frequently you use each individual one. And if you for whatever reason get locked out of your microsoft account (and I say this as someone who had this happen with a Google account) your are basically locked out of your online life. I own my own domain for my email address (xxxx@mydomain.com). As long as I can set the MX record of that domain freely, I can always restore access to my email adress no matter what any email provider decides to do or block me for.
      - dijit 2y ago
        sure, then spin up a keycloak. Its not hard. If you don’t feel comfortable doing so: maybe that is telling.
        lo0dot0 2y ago
        What are you on about. For years logging in with email was possible even on the most amateurish projects. Now that's not possible for tailscale? Why
depr 2y ago
For a single user, email signup is easy. But if they were to offer it they would also need to offer it to business customers. That means they have to build a role system and link that to AD etc. That is why they don't have it. (Their CEO discusses this in a recent interview).

dijit 2y ago

I think that's quite smart, and OIDC is an open standard at least. Securing usernames/passwords and handling second factors etc; is already done so well and it's hard to do. Having a clear 'this is where we can be secure' stances is what makes me want to trust them more.

littlecranky67 2y ago
> and OIDC is an open standard at least But what kind of argument is that, if you are a single individual who wants to signup, I am not going to setup my OIDC servers. That is like saying it is a good idea to run a dedicated linux server in a datacenter under your own management, when all you want is a small static website for your mom+pop store. Sure, you can run your own server and it is all open source, but just overkill. > already done so well and it's hard to do. So hard that literally all other websites in the world with a login have implemented it. And tailscale is a VPN-like technology company - if they can't manage to implement a login because it is hard, then I would definitely not accept their offerings.
guappa 2y ago
It's an open standard, but would they allow me to use my OIDC?
- dijit 2y ago
  Yes, they allow that.
lo0dot0 2y ago
Why is that smart? I signed up for a Microsoft Account with my email and I can use Microsoft Account to log in to Tail scale but I can't use the email directly? How does the middle man bring anything to the table?
- dijit 2y ago
  Because then tailscale doesn’t store a username and password for you, so unless microsoft is hacked you won’t be- theoretically.
  - littlecranky67 2y ago
    but at the same time, now Microsoft knows you are using Tailscale (and they use this data in their tracking + analytics). And all the other products. They get a very good insight of your online habbit, because they have a list of all other products and apps you use where you sign in with your microsoft account. And due to the way token refresh works, they even have a good idea how frequently you use each individual one. And if you for whatever reason get locked out of your microsoft account (and I say this as someone who had this happen with a Google account) your are basically locked out of your online life. I own my own domain for my email address (xxxx@mydomain.com). As long as I can set the MX record of that domain freely, I can always restore access to my email adress no matter what any email provider decides to do or block me for.
    - dijit 2y ago
      sure, then spin up a keycloak. Its not hard. If you don’t feel comfortable doing so: maybe that is telling.
      - lo0dot0 2y ago
        What are you on about. For years logging in with email was possible even on the most amateurish projects. Now that's not possible for tailscale? Why

depr 2y ago

For a single user, email signup is easy. But if they were to offer it they would also need to offer it to business customers. That means they have to build a role system and link that to AD etc. That is why they don't have it. (Their CEO discusses this in a recent interview).