C.W.K.
Stream
Lesson 04 of 05 · published

The Lost-Device Story — Tailscale's Achilles Heel

~15 min · lost-device, key-expiry, device-approval

Level 0Greenhorn
0 XP0/53 lessons0/14 achievements
0/100 XP to next level100 XP to go0% complete

Tailscale's biggest weakness for solo devs is also its UX strength: each device gets a long-lived key, and that key is valid until you revoke it. There is no automatic time-out. There is no "your phone hasn't moved in 30 minutes, are you sure?"

The three defenses you must set

DefenseWhat it doesWhere
Key expiryForces re-auth after N days (default 180 days, can be set as low as 1 day)Admin → Settings → Keys
Device approvalNew devices must be manually approved before joiningAdmin → Settings → Device Approval
Lock screen on phoneTailscale app inherits OS lock; if phone PIN is on, an attacker can't open the Tailscale UIPhone settings

What to actually do when a phone disappears

  1. Revoke the device in Tailscale admin. Login at login.tailscale.com from any other device, find the phone, click "Remove". Within seconds it is out of the mesh.
  2. Trigger Find My / equivalent. Lock or wipe the device.
  3. Revoke app sessions inside the tailnet. This is where Track 7's killswitch comes in: even before Tailscale revoke completes, your PIN-auth admin dashboard can DELETE FROM security_sessions for every active row. Two layers, one click each.
  4. Rotate downstream secrets. Anything the phone had cached (1Password vault, Gmail session, GitHub PAT) gets rotated separately.

External links

Exercise

Two settings to fix today: (1) Tailscale admin → Settings → Device Approval → ON. (2) Tailscale admin → Settings → Keys → set key expiry to 90 days for all users. Both are 30-second changes that make the lost-phone window survivable. Then schedule a calendar reminder for the first re-auth date.

Progress

Progress is local-only — sign in to sync across devices.
Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)
Sign inPlease sign in to comment.

No comments yet — be the first.