In case anyone wants some user-facing Wireguard docs with examples and further reading, I've compiled some here:
WireGuard Gives Linux a Faster, More Secure VPN
191–200 of 306 posts
Re: WireGuard Gives Linux a Faster, More Secure VPN
#192Check out Algo [0] if you're interested in setting up a personal WireGuard VPN server. It's simple and hassle-free, especially if you are not familiar with server administration and don't want to be bogged down by details. I have one deployed on Digital Ocean ($5/mo droplet). All you need to do is run the setup script, answer a few yes/no questions (optional features), paste in your API key, and update the firewall s…
+1 for Algo, it's better than Streissand imo.
Re: WireGuard Gives Linux a Faster, More Secure VPN
#193What are the options right now for open source user/access management around WireGuard? I don’t love the idea of manually writing down keys in a config file. I’m thinking of writing something to template out configs for short term keys (and automatically reload) based on an OIDC authentication, but seems inelegant.
Could create something where you authenticate to vpn.yourdomain.com in your browser using your preferred method that creates a temporary key and starts your wg client for you.
Yeah that’s what I’m thinking, creating the temporary key by manipulating the config feels inelegant though.
Re: WireGuard Gives Linux a Faster, More Secure VPN
#194Check out Algo [0] if you're interested in setting up a personal WireGuard VPN server. It's simple and hassle-free, especially if you are not familiar with server administration and don't want to be bogged down by details. I have one deployed on Digital Ocean ($5/mo droplet). All you need to do is run the setup script, answer a few yes/no questions (optional features), paste in your API key, and update the firewall s…
I honestly had no idea that DigitalOcean has a ”built-in” firewall. That’s awesome. Thank you!
Re: WireGuard Gives Linux a Faster, More Secure VPN
#195Recentish negative article about Wireguard: * https://blog.ipfire.org/post/why-not-wireguard
> Is WireGuard faster than other VPN solutions?
> ChaCha20 is a stream cipher which are easier to implement in software. They encrypt one bit at a time. Block ciphers like AES encrypt a block of 128 bits at a time. ..
Wow. I'm avoiding wireguard for other reasons, but there is a lot of FUD in that article.
Re: WireGuard Gives Linux a Faster, More Secure VPN
#196Earlier quoted context omitted.
Every time I see a product or project that describes itself as "opinionated", what it really means is the developer implemented the subset of functionality that they require and turn away suggestions and PRs from people who need additional functionality, even if the changes would have no material impact on the author's usage. There's probably some really interesting psychological research that could be done here, but…
> turn away suggestions and PRs from people who need additional functionality, even if the changes would have no material impact on the author's usage. Whether it impacts a specific use case is usually here nor there - it’s usually about maintainability. And while finding contributors for open source projects can be difficult, finding people who want to do the thankless work of maintaining code long-term is much hard…
I guess my point was that "opinionated" generally seems to imply maintainability at the (explicit and very intentional) expense of utility.
Re: WireGuard Gives Linux a Faster, More Secure VPN
#197Earlier quoted context omitted.
Most required upgrades do not involve anything "busted". Weaknesses are often noticed long before any practical attacks are available. If you want to upgrade, say, Wireguard in such a case you would have to switch over the endpoints in pairs. Obviously that is going to be impossible in practice so the system will get backward compatibility grafted on in a fragile and dangerous way. OpenPGP is an example of a case whe…
You can straight up google 'pgp' and 'downgrade attack' so maybe that's not that great an example.
Do you have an actual example? Normally when people talk about a downgrade attack on OpenPGP they just assume it is somehow possible without actually checking that it is.
Note that I am only claiming that downgrade attacks are technically impossible for OpenPGP due to the way that it works. To break the protection against downgrades means that you have to break the root cryptography. That might not be true for other stuff... Makes for a great example though...
Re: WireGuard Gives Linux a Faster, More Secure VPN
#198Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…
TLS has shown how the quest for backwards compatibility has the unintended consequence of downgrade attacks. Wireguard's lack of cryptographic agility is a feature, not a bug. Sure, it means everyone has to upgrade when a new version of the protocol comes out, but the entire point of a VPN is security. That said, OpenBSD's OpenIKEd is just as simple and efficient, and thanks to standard compliance (IPsec, IKEv2 and M…
> Sure, it means everyone has to upgrade when a new version of the protocol comes out,
It will be interesting to see what happens when (or if) large enterprises and hardware vendors adopt it.
Re: WireGuard Gives Linux a Faster, More Secure VPN
#199Recentish negative article about Wireguard: * https://blog.ipfire.org/post/why-not-wireguard
Very interesting read.
Re: WireGuard Gives Linux a Faster, More Secure VPN
#200I really like wireguard, but one thing that bugs me is the fact that it's layer 3 (an ip tunnel) and has no code to support layer 2 (ethernet MAC tunnel). The downside for me is that you have to manage static ips in the configurations (specifically it's not compatible with ipv6 slaac and NDP). There is https://git.zx2c4.com/wg-dynamic but it's very experimental at the moment. The level 3-only tunnel is motivated as "…
Out of curiosity, what is the use case for doing VPN at layer 2?
Also icmp, ipv6 brings a lot of new things to the table in that realm. I already said it above, but the neighbor discovery protocol is quite useful to do dynamic in-band configuration. icmp is over ip, but it's not useful if the ip link is already managed by the tunnel protocol.