WireGuard Gives Linux a Faster, More Secure VPN • Hacker News Board

Re: WireGuard Gives Linux a Faster, More Secure VPN

#71

Post by vsareto » Mon, Mar 02, 2020, 4:52 PM UTC

0xbadcafebee wrote: post #60

What I don't like about WireGuard: - Basically no real user or admin-oriented docs. There's some example configs and some getting started guides, and then some crypto-nerd look-how-secure-our-algorithms-are docs, but no real guidance on how to set up a reasonably simple network of hosts. - Authentication/authorization is just IP addresses and public keys? What about users and service accounts that you want to rotate…

>Basically no real user or admin-oriented docs. There's some example configs and some getting started guides, and then some crypto-nerd look-how-secure-our-algorithms-are docs, but no real guidance on how to set up a reasonably simple network of hosts.

It wasn't really in release mode until it was merged to the kernel, so that's pretty understandable. I had no networking knowledge aside from pentesting and I was able to get a tunnel working.

I don't think Wireguard was ever going to be like those other things. It sounds like you should wait for products to be built on top of Wireguard. Judging a fish's ability to climb a tree and all that.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#72

Post by slim » Mon, Mar 02, 2020, 4:53 PM UTC

slim wrote: post #68

aeyes wrote: post #65

Are there any official plans for 2FA in Wireguard?

there is no authentication that would need a second factor in wireguard. in wireguard you authenticate the host, not a user

actually there is no athentication in wireguard. only identification

Re: WireGuard Gives Linux a Faster, More Secure VPN

#73

Post by tptacek » Mon, Mar 02, 2020, 4:53 PM UTC

nif2ee wrote: post #20

ahnick wrote: post #7

Earlier quoted context omitted.

Tailscale looks promising. ( https://tailscale.com/ )

I am sick of people shilling to this thing here. Stop exploiting HN for free advertising. Every Wireguard post here has become a free ad for this company. EDIT: Stop supporting parasites repackaging and rebranding open source and selling it while leaving the author who single handedly made this entire thing possible begging for donations on Patreon

Last time I talked to him about it, Jason Donenfeld was not upset about Tailscale. You'll have to find someone else to be vicariously outraged for.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#74

Post by thenewnewguy » Mon, Mar 02, 2020, 4:55 PM UTC

eleitl wrote: post #57

dragonsh wrote: post #4

I hope WireGuard can come to feature parity with TincVPN will be nice. Especially automatic routing and mesh VPN formation, it can really help our multi-cloud container clusters connected using TincVPN to be bit more performant. The difference is WireGuard is part of Linux kernel so speed of processing packets is faster than TincVPN. Still experimenting with WireGuard and manually creating peer to peer mesh.

k8s already uses Wireguard for the service mesh internally. For a globally routed overlay mesh, have a look at https://yggdrasil-network.github.io/ The latest version actually uses the Wireguard TUN library https://yggdrasil-network.github.io/2020/02/21/release-v0-3-...

> k8s already uses Wireguard for the service mesh internally.

Kubernetes does not use anything for the service mesh internally - as it does not provide a service mesh.

By this I can only assume you mean some popular CNI provider uses wireguard, but out of the ones I know of (flannel, weave, calico, canal, romana) I don't believe any use wireguard.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#75

Post by mindslight » Mon, Mar 02, 2020, 4:57 PM UTC

eximius wrote: post #19

dragonsh wrote: post #4

I hope WireGuard can come to feature parity with TincVPN will be nice. Especially automatic routing and mesh VPN formation, it can really help our multi-cloud container clusters connected using TincVPN to be bit more performant. The difference is WireGuard is part of Linux kernel so speed of processing packets is faster than TincVPN. Still experimenting with WireGuard and manually creating peer to peer mesh.

I am not saying I don't want those features, but I do hope that a VPN in the kernel with one of its primary features being small, lean, auditable code, will think twice about adding a bunch of stuff. Have you considered Nebula?

Most of tinc's functionality could be implemented in userspace using the wireguard kernel module, and so wireguard itself won't really need to grow.

The one thing I wish wireguard had was overlapping AllowedIPs with 'ip route via' to distinguish (although this isn't a tinc feature either, unless you run it as an ethernet segment). The same result can be achieved using a separate interface for every peer and 0/0 at each end, but it's a bit unwieldy.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#76

Post by [deleted] » Mon, Mar 02, 2020, 4:57 PM UTC

fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

[deleted]

Re: WireGuard Gives Linux a Faster, More Secure VPN

#77

Post by tptacek » Mon, Mar 02, 2020, 4:57 PM UTC

293984j29384 wrote: post #33

What makes Wireguard more secure? The article appears to make some weak claims about a smaller codebase and less configuration options but I don't think that translate directly into it being more secure?

* It uses a single set of well-trusted modern primitives and so avoids the attack surface of negotiation.

* Those primitives are used for a Noise construction, and Noise is itself reasonably well studied and increasingly formalized; we can be somewhat confident WireGuard is skipping over the 2 generations of protocol vulnerabilities SSL/TLS faced.

* Perhaps most importantly, the codebase is tiny and designed to minimize its attack surface; for instance, the protocol itself is designed to be implementable without dynamic memory allocation.

* WireGuard is itself minimal and doesn't implement higher-level features like user management, which means that those features aren't coupled and entangled into the core engine, and can be implemented straightforwardly through a clear interface.

In general, and contra this article, "smaller codebase" usually does mean "more secure".

Re: WireGuard Gives Linux a Faster, More Secure VPN

#78

Post by _pmf_ » Mon, Mar 02, 2020, 4:57 PM UTC

fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

> As a developer I’m a huge proponent of simpler, more opinionated frameworks

Until you run into the limits, of course. If you control both sides, you can use what you want, but as soon as you implement just one side ...

Re: WireGuard Gives Linux a Faster, More Secure VPN

#79

Post by lazyier » Mon, Mar 02, 2020, 5:03 PM UTC

fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

> Could this be a positive change?

It's normal and expected evolution of protocols and software.

Generation 1: New idea, new implementation. As people become comfortable with the new idea it gains in acceptance and hype. Try to keep it simple and fast, but it's a exercise in exploration and it gains technical debt faster then it gains new features.

Generation 2: Widespread acceptance and commercialization. Groups inside large corporations, and sometimes entire businesses, spring up around the new idea. They re-implement the idea to reduce technical debt and add flexibility. Features are piled on to make it marketable. Eventually becomes heavy and unwieldy.

Generation 3: Hype train dies down and people have learned what really matters and what really should be focused on. Third generation is lean, fast, and 'correct'. It becomes ubiquitous, people stop caring about it and people stop paying for it. It becomes just something that is always there and ends up little more then a building block for the next new idea.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#80

Post by qzx_pierri » Mon, Mar 02, 2020, 5:05 PM UTC

293984j29384 wrote: post #33

What makes Wireguard more secure? The article appears to make some weak claims about a smaller codebase and less configuration options but I don't think that translate directly into it being more secure?

The article says the smaller codebase doesn’t make Wireguard more secure, but it only makes it easier to audit.