Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Wag, MFA and Enrollment for WireGuard

github.com

Post reply on HN
Print view View original

1–10 of 68 posts

Show HN: Wag, MFA and Enrollment for WireGuard

#1

Post by Nullence »

Howdy folk,

I've been building this project as both a side project and my job for a little while now. The rationale behind it is while wireguard is a fantastic protocol cryptographically it leaves a lot to be desired when it comes to enrollment and end user device security.

Obviously instead of using an off the shelf solution like tailscale, I decided to reinvent the wheel which has honestly been quite fun with learning about eBPF, and recently clustering and HA with etcd!

The most recent version (in the docker container) contains about 6 months of very new work bringing it all from sqlite3 to etcd. So please be forgiving if it does some weird things!

Hope you all enjoy!

P.s Im not a web developer and any tips on that front to make it less teeth pullingly awful are welcome!

Show HN: Wag, MFA and Enrollment for WireGuard
github.com

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#3

Post by d-z-m »

Do you protect against bruteforcing the TOTP code? I.e. via rate-limiting or a set amount of retries? I took a quick glance at the code and couldn't find anything to this effect.

The scenario I'm imagining is: someone opens the TOTP entry UI in their browser, opens devtools, and starts to loop through all possible TOTP codes.

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#6

Post by Avicebron »

d-z-m wrote: post #3

Do you protect against bruteforcing the TOTP code? I.e. via rate-limiting or a set amount of retries? I took a quick glance at the code and couldn't find anything to this effect. The scenario I'm imagining is: someone opens the TOTP entry UI in their browser, opens devtools, and starts to loop through all possible TOTP codes.

I can't speak to the specifics of this particular implementation but usually if someone has the login (username + password) to get to totp that user has already been compromised..

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#7

Post by stavros »

helloooooooo wrote: post #5
aragilar wrote: post #4

[flagged]

You know people can just do these things for fun right? It doesn’t have to be intended as any form of competitor.

This is one of my pet peeves about HN. It's Entrepreneur News, not Hacker News. A hacker's first response would be "this is cool!" whereas here it's "what's the business case for this?".

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#8

Post by 8organicbits »

d-z-m wrote: post #3

Do you protect against bruteforcing the TOTP code? I.e. via rate-limiting or a set amount of retries? I took a quick glance at the code and couldn't find anything to this effect. The scenario I'm imagining is: someone opens the TOTP entry UI in their browser, opens devtools, and starts to loop through all possible TOTP codes.

I think thats here:

https://github.com/NHAS/wag/blob/cdbdbec3393fa86bf6c823117c8...

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#9

Post by asimops »

Have you tackled the issue of session management or are you planning to do so? Essentially wireguard key are just eternal session keys.

I would expect software that implements the wireguard transport layer to implement session management to be called a working VPN server solution. This means a second channel to the server for periodically rotating session keys, terminating sessions, changing IP addresses, configuring new routes and repeating authentication if necessary.

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#10

Post by asimops »

Avicebron wrote: post #6
d-z-m wrote: post #3

Do you protect against bruteforcing the TOTP code? I.e. via rate-limiting or a set amount of retries? I took a quick glance at the code and couldn't find anything to this effect. The scenario I'm imagining is: someone opens the TOTP entry UI in their browser, opens devtools, and starts to loop through all possible TOTP codes.

I can't speak to the specifics of this particular implementation but usually if someone has the login (username + password) to get to totp that user has already been compromised..

But MFA is there to prevent this compromise from affecting the service and alert users/admins to the compromise, right?

If you have username and password and are able to force the TOTP in the 60s window, the TOTP would be useless imho.

Post reply on HN