81–88 of 88 posts
Earlier quoted context omitted.
Based on what evidence?
I just think being cautious is wise, given how new WG is. And, AFAIK it is userland only, like OpenVpn, not in linux kernel, think performance.
Use Wireguard. It is wonderful and the community is friendly. `wg-quick` is easy to use but if you need it, I believe Streisand supports automatically provisioning a wireguard setup.
Wireguard is awesome, but the kernel module is so far a mess. If you're paranoid I wouldn't rely on it until the code has been cleaned up and perhaps audited.
OpenVPN is a mess. IPSEC and basically all implementations thereof are messes.
(As a personal anecdote, have you ever tried to get OpenVPN to do anything remotely sensible with MTUs or MTU-related ICMP errors? You can’t, because every possible configuration gets it at least partially wrong [0]. Wireguard get it entirely correct AFAICT.)
It’s worth mentioning that it is not, nor does TrailOfBits pretend, that the goal of this project is privacy; it is security. Algo doesn’t and couldn’t care less about your privacy once you reach the endpoint, only about securing the tunnel. You shouldn’t use Algo if you are concerned about surveillance from corporations/governments, you should use Algo if you are concerned about surveillance/attacks from your local…
The real quality to discuss is threat models. Even using a public-mix VPN is not going to protect against Klein-style wholesale tapping (due to packet correlation). Using your own VPN to exit will not protect against legal attacks (subscriber info will still be subpoenaed). But either will protect against revealing (to every service you connect to) your roaming between access networks - eg the discovery of who is friends from their connecting to the same WiFi.
(Also, distinguishing between "government" and "commercial" surveillance is a bit of a red herring as well. Much government surveillance is done by the "private" sector, which the government at least then buys fulls access to, if it doesn't constitute a de facto government on its own - eg credit bureaus in the US)
Question - are there any guides available to help set up a home-brew router to route all outbound connections through an Algo VPN with exceptions for Netflix/etc.? Something like this (this is for OpenVPN): https://arstechnica.com/gadgets/2017/05/how-to-build-your-ow... I currently have a pfSense router set up with Algo, but I have to disable the IPSec policy whenever I want to use Netflix. (Discussion here: https://…
Try OPNsense Here is detailed tutorial https://forum.opnsense.org/index.php?topic=4979.0
Earlier quoted context omitted.
Perhaps? If you’re using a VPN to protect your internet traffic from being sold to ad companies, probably. The VPN industry has become a racket full of affiliate schemes that push people towards plans and services that don’t necessarily act in the user’s best interest. Figuring out the food from the bad can be difficult. And I’ve seen some services that when audited use outdated or insecure stacks. Of course, if you’…
I've been using VPN services for over a decade. In my opinion, the most privacy friendly are AirVPN, Insorg, IVPN, Mullvad, Private Internet Access and Riseup. To my knowledge, HideMyAss, EarthVPN, IPVanish, PureVPN and WANSecurity have violated their users' privacy. For the most part, by sharing logs with investigators. Prudent providers make damn sure not to have any logs that could be seized.
I once wanted to write an Ansible playbook to install VPN on a server but found out that you cannot just pass parameters via command line like ansible setup-vpn 1.2.3.4 Ansible expects you to write host address into a file in /etc. So inconvenient. Also, Ansible doesn't support Windows and Cygwin. It turned out it was easier to write instructions into a Bash program. Sadly, it is non-portable and works only with a sp…
Are there any specific VPS hosts you would recommend in Europe?
I recommend checking what VPS technology is used. If it is OpenVZ or similar then you won't be able to edit iptables config, load kernel modules, setup ipsec. Because OpenVZ is more like a userspace container rather than a virtual machine. KVM, XEN, VMWare work fine.
I once wanted to write an Ansible playbook to install VPN on a server but found out that you cannot just pass parameters via command line like ansible setup-vpn 1.2.3.4 Ansible expects you to write host address into a file in /etc. So inconvenient. Also, Ansible doesn't support Windows and Cygwin. It turned out it was easier to write instructions into a Bash program. Sadly, it is non-portable and works only with a sp…
Ansible works on Windows https://www.ansible.com/integrations/infrastructure/windows I don’t get the Ansible hate, it’s great.
Not enough people have heard of Outline. https://getoutline.org/ It is a shadowsocks client and even non-technical users can provision VPNs on cloud hosting providers.
Outline is a security disaster, and I strongly recommend against using it. - Shadowsocks is not a VPN, it's a per-application SOCKS proxy. What has Jigsaw done to ensure that packets don't leak outside of the tunnel? All UDP traffic leaks, so it looks like they did nothing! https://github.com/shadowsocks/shadowsocks-rust/issues/78 - Shadowsocks is dangerously full of bad configuration options to avoid. Did Jigsaw avo…
UDP seems to work properly with Outline without any issues. SOCKS proxies does allow UDP to be proxied.
>Shadowsocks is dangerously full of bad configuration options to avoid. Did Jigsaw avoid all of them when it built Outline? Their copy of shadowsocks appears to use an unauthenticated CFB mode by default (https://github.com/Jigsaw-Code/outline-server/blob/d8cb1575d...), but then this setting is overridden elsewhere. Good luck checking all the rest.
How can CBF mode by "unauthenticated"? What does that even mean?
>They enabled an automated update system they called "Watchtower." Is this safe to use? Who controls the keys? When are updates pushed out? How would it react to a subpoena?
Not sure about this one
>Is shadowsocks safe? It's a giant pile of C that was purpose-built to evade censorship by the Chinese Great Firewall, nothing more. It wasn't written or designed by an expert in secure communications and it was not even intended for that purpose. It's had a bunch of bugs before (https://x41-dsec.de/lab/advisories/x41-2017-008-shadowsocks/) and none of the crypto makes sense (https://crypto.stackexchange.com/questions/39776/evaluatung-...)!
Shadowsocks is/was written in Python. The CVEs you have linked affect the Python version only. There is however a much cleaner C version. If you'd read the spec, the crypto makes perfect sense, as pointed out by the stack exchange post, the lack of a PDF on the password is probably the only weakpoint.
>The setup process is bonkers. Outline has an Electron app that builds a cloud server, authenticates to it over a random port, then somehow bootstraps encrypted communication with a self-signed certificate. I haven't had time to review the process in all its detail but what the hell? The certificate does not even appear pinned correctly: https://github.com/Jigsaw-Code/outline-server/blob/d8cb1575d....
>Jigsaw did not pay for a reputable security review of the code. This security review is one of the worst, possibly THE worst, that I have ever read. It looks like shadowsocks was in scope at first, but then eliminated from scope. There's some weird fascination with parsing bugs in local configuration files. I don't know what's going on here, but it's a waste of paper: https://s3.amazonaws.com/outline-vpn/static_downloads/ros-re....
>Jigsaw is advertising this as a method to keep high-risk journalists safe and it's likely to get someone killed (https://medium.com/jigsaw/introducing-outline-making-it-safe...). They are conflating two different use cases: Outline may be acceptable for bypassing censorship (low-risk, where success is immediately visible), but it is wholly unacceptable for protecting the safety or anonymity of speech online (which carries the risk of an invisible and potentially fatal failure in a hundred different ways if traffic can be inspected or even just attributed to a person).
In a reply to a thread where it's about a easy to set up VPN, I think it is perfectly acceptable.
>tl;dr Outline is a flaming pile of garbage. Stop recommending it.
Outline is a fine iOS app that let's you connect to a shadowsocks server as a easy to use VPN. I can't speak for anything else.