I was recently forced to sign up for something called Tailscale in order to access a client’s server. I’d never heard of this shit before and was already grumpy they wouldn’t just give me a regular SSH login. But whatever, this will only be the 9,012,348th thing I’ve had to sign up for to use one time for one client, never to be touched again. I’ll throw a disposable email at it. Or so I thought.
I go to sign up, only to discover Tailscale DOES NOT ACCEPT EMAIL/PASSWORD AS AN OPTION! The ONLY options are linking a 3rd-party service: Google, Microsoft, GitHub, Apple, or something called OIDC (another thing I’d never heard of, but I’ll come back to that in a minute). WHO THE FUCK RUNS A WEBSITE IN 2026 THAT DOESN’T LET YOU SIGN UP WITH AN EMAIL ADDRESS?!?!?!?!?!
First of all, linking your login to a 3rd-party “identity provider” is a TERRIBLE IDEA, for many reasons. Someday I’ll write a blog post specifically about this topic, but suffice to say I’ve been screwed over from every angle:
- As a user, if you ever lose access to that Google/Microsoft/Whatever account (and there are lots of ways this can happen), you lose everything else linked to that account!
- As a developer running a website/SaaS, outsourcing user authentication to 3rd-party providers means you give those providers CONTROL over you. If one day they randomly decide your Privacy Policy doesn’t have quite the exact verbiage they want to see, they can shut you down and lock out your users until you comply. (And I’m not exaggerating — Facebook did this to me once with one of my SaaS’s. I realized very quickly that a lot of my paying customers, who had registered their accounts via Facebook auth, could not access my app and there wasn’t a damn thing I could do about it. My only choice was to do whatever Facebook wanted, or lose a lot of money. Let me tell you that is not a great place to be.)
- As a business owner, if you ever need to remove someone’s access to things (say, a terminated employee), no matter how many places you go to remove their little connections to things, there is always ONE CRITICAL THING tied to their personal Facebook (again with Facebook, sheesh) that you definitely deleted their access to but due to some unknown glitch they actually still have access and randomly do some vindictive damage with it months down the line. (Whereas if it had been linked to their work email, which I control, I could have just gone in and reset the password and permanently locked them out, no questions asked. But I digress.)
Secondly, handing over your access to the big tech co’s is terrible from a privacy standpoint. I absolutely DO NOT WANT Google or Microsoft or whoever having any more access to my life than they already do (and I try really really hard to keep it to a bare minimum). I don’t want Google training their AI on the contents of my gmail account, thank you very much.
If Tailscale’s attitude towards privacy is “not our problem… just outsource it to some 3rd party… who cares”, which seems to be the case here, that is REALLY REALLY BAD.
So now what?
If I weren’t forced to use this Tailscale crap thanks to my client, I would have bailed the instant I saw the lack of email signup. But I’ve got a client I otherwise like, and money to be made, so I’ve got to figure something out.
I do have accounts at Google/Microsoft/etc., but giving these fuckers access to a real account of mine is completely out of the question. I suppose I could sign up a new account somewhere specifically for use with Tailscale and never use it anywhere else. But I’m not thrilled by that idea.
I’d never heard of OIDC before, so I look that up. Turns out to be some open source protocol for running your own authentication server. That seemed like the least bad option of the shitty options before me. So off I go, googling like mad how to setup an OIDC server. I end up installing something called Dex on one of my servers. After a couple of hours of fucking around I finally get the damn thing to work with Tailscale. Fine.
Here’s the hilarious part though… now when I go to login to Tailscale, it redirects me to Dex (on my server), where I… you guessed it… ENTER AN EMAIL/PASSWORD COMBO, which then redirects me back to Tailscale. After jumping through all these hoops, the net result is instead of storing my email/pass on THEIR server, we’re storing it on MY server. (Well, technically Tailscale still has my email either way, since they got it through the account linking process. They already put me on their damned mailing list. The ONLY thing they don’t know is my password.) WHAT IS THE FUCKING BENEFIT OF THAT?
Maybe Tailscale thinks they’re “secure” because they don’t store any passwords, therefore there are no passwords to be exposed if they ever get hacked/breached? Okay, but they ARE storing a lot of OAuth tokens tied to people’s Google/Microsoft/whatever accounts which could be hacked/breached, so how is that a win for the end user?
Bottom line, this whole thing stinks. All Tailscale has managed to accomplish here is make the signup process painful and time-consuming… unless you just really don’t give a shit about privacy.
Fuck you Tailscale.