111–120 of 140 posts
Earlier quoted context omitted.
> WireGuard .. is practically bulletproof in terms of keeping connections alive Try switching between IPv4 and IPv6 networks, or reaching a peer on non-default/primary network on Windows. Not denying it would usually have better connectivity than TCP based ssh.
Where do you encounter IPv6 in the wild?
Earlier quoted context omitted.
I could be wrong, but it’s superseded by FIPS140-3. Anyway, compliance doesn’t necessarily imply security.
Unless you are purposely trying to pedantic, one should know that FIPS140-3 just came out. You can't even search the Cryptographic Module Validation Program (CMVP) tool for FIPS140-3 standard level yet. FIPS140-2 for all practical purposes is the current standard to measure against. And if you really are negating FIPS140-X and what it means to large organizations and government entities... you should do some reading…
Earlier quoted context omitted.
Problem #1: they are closed source. Good luck verifying their security. Problem #2: it is in the best interest of nation states to be able to break the VPNs and it's in the best interest of large vendors to quietly cooperate with the government.
If you are worried about your secrets being revealed to a nation state, then chances are you shouldn’t be putting any of them over the public internet - VPN or not.
Corporate espionage backed by nation state actors is a real thing, and there is nothing wrong with wanting to secure yourself against it while running a normal business.
Earlier quoted context omitted.
Yes. WireGuard is cryptographically superior to SSH, attaches at a network layer without fussy interactions with a Unix shell (that then also needs to be accounted for in a security model), has higher performance, is practically bulletproof in terms of keeping connections alive, and gets you direct access to whatever resources you've provisioned the network to provide. I wouldn't ding someone using SSH tunnels (caref…
Wireguard does not have better performance or is faster verses Openvpn in any independent Benchmark released up to now.
You wouldn't have an independent benchmark comparing a GTR and a semi truck.
Earlier quoted context omitted.
Yes. WireGuard is cryptographically superior to SSH, attaches at a network layer without fussy interactions with a Unix shell (that then also needs to be accounted for in a security model), has higher performance, is practically bulletproof in terms of keeping connections alive, and gets you direct access to whatever resources you've provisioned the network to provide. I wouldn't ding someone using SSH tunnels (caref…
Wireguard does not have better performance or is faster verses Openvpn in any independent Benchmark released up to now.
Also see the endless discussions on how to deliver 100 Mbit/s for single connections on OpenVPN. It is absolutely insane, you have to spend many hundreds of dollars on hardware to have a fighting chance. And even if you get hardware acceleration that doesn't help nearly as much as you'd expect. And aside from cost the power consumption required for such hardware is very prohibitive for most.
Meanwhile my phone (first gen. Pixel (so three generations behind)), over wifi, gets at least 60 mbit/s over wireguard to a weak home router and then out to internet.
Earlier quoted context omitted.
> The gold standard, as ever, is Wireguard. Not disagreeing with you about the state of commercial VPN products, but regarding WG specifically. Something I don't see in the other replies just yet is that Wireguard doesn't yet have an ecosystem around it, but is designed for that in a good way. By which I mean, it follows the Unix philosophy of focusing on one specific task and doing it very well, and it has succeeded…
Last I checked it did not have a a Windows client, so I'm still using OpenVPN. CLI clients are of course next to useless for Windows users. I would really like to use WG instead.
Earlier quoted context omitted.
> The gold standard, as ever, is Wireguard. Not disagreeing with you about the state of commercial VPN products, but regarding WG specifically. Something I don't see in the other replies just yet is that Wireguard doesn't yet have an ecosystem around it, but is designed for that in a good way. By which I mean, it follows the Unix philosophy of focusing on one specific task and doing it very well, and it has succeeded…
Last I checked it did not have a a Windows client, so I'm still using OpenVPN. CLI clients are of course next to useless for Windows users. I would really like to use WG instead.
Some client from WG directly is also in the works.