Post

between passkeys and webp i’m starting to think that software consumers just hate good things

i think it would go a lot better if they tried explaining them instead of user-hostile flows like i’ve seen where it basically just demands you add a passkey without any context (amazon does this)

like users do hate good things but the passkey rollout has not been executed well at all lol webp is different that’s just client apps not catching up to a format that’s been around for a decade for no reason (including bluesky, as i found out accidentally getting a webp in my profile record)

also some websites let you make multiple passkeys (good, theyre device specific), but then with tailscale i am pretty sure my account is locked to One passkey, i can’t add any more, no options to fix this, so it’s stuck in my single password manager. fun shit

yeah this is specific to tailscale refusing to be an identity provider, which is understandable but very annoying. the official docs recommend a ludicrous workaround

this is so fucking insane and i hate it. i’d mind it less if it wasn’t locking me to my current password manager, but im pretty sure they’re not portable????

no idea why this is the case, cc @apenwarr.ca

The trick is if you added a passkey to your main Tailscale account you could use it to bypass your OIDC login — two separate ways to get phished. Tailscale considers each passkey to be a separate identity that you can give admin rights, or not.