131–140 of 208 posts
Earlier quoted context omitted.
On Android this can be easily achieved by Tasker. Personally I have the luxury of running the VPN server at home, so I can just always leave it on.
Why does this allow you to allows leave it on?
Anyone know if there has been any recent work on making wireguard cover this use case? I'm not really worried about security as I treat this overlay network as just as insecure as any other (running ssh over it) and mitigate exploits by running the tinc daemon as a normal user. But it would still be nice to get more performance and security from an in-kernel quality solution like wireguard.
Earlier quoted context omitted.
Humor me: What would prevent DJB's crypto from being certified by FIPS?
Bureaucratic inertia. I've been hoping for years that it'll be certified. They've talked about Curve25519 and Curve448 for a while but no movement so far. My insider sources tell me there's opposition, but I have no clue why... either the NSA prefers weaker crypto or (more likely) industry wants the status quo because they fear competition from open source superior products like WireGuard among many others.
Industry prefers FIPS 140-2 because cryptographic expertise is extremely scarce and, prior to AES, commercial products were choc-a-bloc with broken hand-rolled cryptography. It's a rational decision to delegate selection of primitives to NIST.
I think FIPS 140-2 is aging poorly, but I think that's in part because all cryptographic standards are aging poorly; like, the whole concept: top-down standardization efforts with whole cryptosystems designed by committee have a very poor track record, and probably aren't the right vehicle to improve cryptographic soundness in the industry.
Earlier quoted context omitted.
The built-in "on-demand activation" is quite good. Can set it to specific SSIDs (white or blacklist) or cellular. I've it on for everything except my home SSID. Edit: I'm talking about the iOS version, not sure what platform you're using.
What iOS client are you using? I am using the Wireguard one (the the twisty snake/dragon) and don't see any of these options. Is this stuff that is done in the config files? Sorry, all new to me.
I recently started using OpenVPN (My router comes with it pre-installed). Does anyone know how this compares with OpenVPN? Is is worth setting up my own wiregaurd machine?
Depending on just how our of date it is, that could be an issue: https://openvpn.net/security-advisories/
Earlier quoted context omitted.
> Second: it's easy. To give you some perspective, it's so easy that my four year old knows how to turn it on when we're traveling and she wants to watch PBS Kids.
At the terminal with wg-quick, in NetworkManager, on a phone? Just wondering how impressive your kid is.
Earlier quoted context omitted.
Why does this allow you to allows leave it on?
Presumably minimal latency from phone on home wifi to server on home wifi. I actually have no idea if this is true, or how I'd evaluate it. Does anyone understand how the internet and wireguard works well enough to know if this is true?
I've been using tinc[1] as a way to get a mesh VPN on all my machines that works even if some of them are behind restrictive firewalls. It works really well and I've automated the setup with puppet so I just deploy it automatically any time I bring up a machine. Highly recommended. Anyone know if there has been any recent work on making wireguard cover this use case? I'm not really worried about security as I treat t…
Earlier quoted context omitted.
Well, to be fair, it was already pretty straight-forward to run WireGuard in production (if your distribution of choice has a WireGuard DKMS package). What I'm more excited about is more people building products on top of WireGuard, thus making it more accessible for the non-sysadmins out there.
This is what we ( https://tailscale.com ) are working on! WireGuard is incredible, but adding some key management (that integrates with your IAM system) and NAT traversal really helps to round things out. I'd love to hear suggestions and feedback on what we're building.
I'm essentially worthless as a user: I'm a college student and would be unwilling to pay much; I might possibly convert to a serious customer but that would be years and years down the line when everything is different.
I'd also be massively underutilizing it to connect a handful of devices and max two or three users.
I put my email address in your system, and am crossing my fingers.
This is a big step forward! I'm hoping that the 1.0 release will prompt Netgate to consider inclusion in pfSense.
pfSense is a FreeBSD downstream, right? First you'd have to port Wireguard to FreeBSD. Or you could run the userspace server, but expect poor performance.