The design choices of the open source tailscale and headscale software have created an environment ripe for risk, while marketing security as its design and purpose. Choices have been made to move away from security-in-depth, removing layers of authentication, and replacing daemons such as OpenSSH which employ privilege-separation with a highly-privileged process. Other findings include broader-than-advertised network security boundaries, which seems to be legitimate bugs, but the missing security and isolation is precisely what users are advertised by these tools.
Tailscale SSH: Findings and fixes
Tailscale SSH vulnerabilities from the Tailworm report: Findings, response timeline, security bulletins, and fixes in Tailscale v1.104.4.
Tailscale Services
Securely connect to and manage access to your internal resources using Tailscale Services.
How we built a lightweight identity provider using Tailscale's tools
How tsnet, application security grants, and Funnel combined to build a secure authorization app.
Tailscale | Secure Connectivity for AI, IoT & Multi-Cloud
The connectivity platform for devs, IT, and security teams. Zero Trust identity-based access that deploys in minutes and scales to every resource. Start free.
Workload identity federation: better infra and CI/CD auth with Tailscale
Securely authenticate systems to Tailscale without managing long-lived API keys, auth keys, or OAuth clients.
The Tailscale node you mail to your parents
Securely connect to anything on the internet with Tailscale. Built on WireGuard®️, Tailscale enables you to make finely configurable connections, secured end-to-end according to zero trust principles, between any resources on any infrastructure.
Tailscale Funnel
Securely route internet traffic to local services using Tailscale Funnel.
Build a flexible AI stack with Aperture
Securely connect to anything on the internet with Tailscale. Built on WireGuard®️, Tailscale enables you to make finely configurable connections, secured end-to-end according to zero trust principles, between any resources on any infrastructure.
Open source at Tailscale · Tailscale
Read about Tailscale’s open source projects and commitment. Learn how Headscale helps Tailscale users.
Goodbye SSO Tax: How Tailscale Made SSO Free for Everyone
Tailscale eliminates the SSO tax, making all OIDC-compliant SSO identity providers free across every plan. Learn why security shouldn’t be a luxury and how this change aligns with Tailscale’s mission to build a secure internet for everyone.
Tailscale in the Hugging Face intrusion: The good news and the bad news
An AI agent used a stolen Tailscale auth key at Hugging Face. Workload identity federation, flow logs, and safer defaults could have reduced the risk.
Digging into how Tailscale encrypts its state file on Windows, Apple, and Linux
Tailscale's latest version encrypts more data at rest, making it harder for attackers to potentially clone your nodes. Here's how it works.
We're getting close! atlogin.net is a start on the identity side, and we just launched declarative node sharing which lets you share groups of devices with arbitrary outside identities (without them joining your tailnet). tailscale.com/docs/features/declarative-nod…
ATLogin - OIDC for ATProto/Bluesky
atlogin.net