4 ms·

I’ve actually started ignoring services where that’s the only login possibility. Sorry even if your platform is the greatest thing ever, but I’ll find a differ

by msdz 2mo ago

I’ve actually started ignoring services where that’s the only login possibility. Sorry even if your platform is the greatest thing ever, but I’ll find a different tool. I’ve read one too many stories about Google (or Apple!) closing the entire account over some bullshit unnecessary reason like “fraudulent” gift card issues or whatever. I’m certain the affected people would’ve preferred to just pay back the amount in question instead of losing their entire Google Drive, or their 20 years of iCloud Photos or whatever.

n6242 2mo ago
It's the only reason I want to replace Tailscale with something else or look into self-host when have a bit of time during my vacation. They only allow login through a third party, which is a big no for me.
- aidos 2mo ago
  I think you can use a passkey now.
  - stavros 2mo ago
    Only for people invited to the Tailnet. To create your own account, you still need a third party.
    - eddythompson80 2mo ago
      You can host your own identity provider. Authentik, Keycloak, authelia or Zitadel work. I don’t fully agree with tailscale’s decision to not want to be an identity provider but I understand it on some level. It simplifies their service greatly and the amount of asks for that will essentially have them build a full enterprise Entra-like solution that would be a constant maintain headache and they are not interested in that.
      - dolmen 2mo ago
        Beyond simplifying their service, it allows Tailscale to have reduced responsibilities (because of reduced collection of sensible data), and makes them a less interesting target for people wanting access to the data (wether illagally by hacking, or legally from government agencies). This probably makes them less attractive as targets for censorship.
- corney91 2mo ago
  Tbf to Tailscale they allow any OIDC provider[1]. I wish this was more normalised, then we could have one login everywhere regardless of who hosts it (even if it's yourself). [1] https://tailscale.com/docs/integrations/identity/custom-oidc https://tailscale.com/docs/integrations/identity/custom-oidc
- noduerme 2mo ago
  This is what headscale does, right? Manage private logins and keys for your tailnet from a vps? I haven't played with it but seems straightforward
- zalebz 2mo ago
  I created my own AWS Cognito userpool just for tailscale. I recall the webfinger redirect was frustrating to get right but I refused to use Google/Apple as a gatekeeper to my own network so I had all the motivation to get it working.
- dolmen 2mo ago
  While that isn't convenient is you don't want to use the public identity providers, it should make you think about what makes your identity on the Internet, and consider to have your own identity provider on a DNS domain you control.

by msdz 2mo ago

n6242 2mo ago

It's the only reason I want to replace Tailscale with something else or look into self-host when have a bit of time during my vacation. They only allow login through a third party, which is a big no for me.

aidos 2mo ago
I think you can use a passkey now.
- stavros 2mo ago
  Only for people invited to the Tailnet. To create your own account, you still need a third party.
  - eddythompson80 2mo ago
    You can host your own identity provider. Authentik, Keycloak, authelia or Zitadel work. I don’t fully agree with tailscale’s decision to not want to be an identity provider but I understand it on some level. It simplifies their service greatly and the amount of asks for that will essentially have them build a full enterprise Entra-like solution that would be a constant maintain headache and they are not interested in that.
    - dolmen 2mo ago
      Beyond simplifying their service, it allows Tailscale to have reduced responsibilities (because of reduced collection of sensible data), and makes them a less interesting target for people wanting access to the data (wether illagally by hacking, or legally from government agencies). This probably makes them less attractive as targets for censorship.
corney91 2mo ago
Tbf to Tailscale they allow any OIDC provider[1]. I wish this was more normalised, then we could have one login everywhere regardless of who hosts it (even if it's yourself). [1] https://tailscale.com/docs/integrations/identity/custom-oidc https://tailscale.com/docs/integrations/identity/custom-oidc
noduerme 2mo ago
This is what headscale does, right? Manage private logins and keys for your tailnet from a vps? I haven't played with it but seems straightforward
zalebz 2mo ago
I created my own AWS Cognito userpool just for tailscale. I recall the webfinger redirect was frustrating to get right but I refused to use Google/Apple as a gatekeeper to my own network so I had all the motivation to get it working.
dolmen 2mo ago
While that isn't convenient is you don't want to use the public identity providers, it should make you think about what makes your identity on the Internet, and consider to have your own identity provider on a DNS domain you control.