Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard Gives Linux a Faster, More Secure VPN

wired.com

Post reply on HN
Print view View original

211–220 of 306 posts

Re: WireGuard Gives Linux a Faster, More Secure VPN

#211

Post by tptacek »

wahern wrote: post #168
Avamander wrote: post #157

Earlier quoted context omitted.

This is why I abandoned using it, knowing the average quality of an online article I couldn't trust that the configuration was secure and there were no official very secure templates.

This is a problem with the IKE implementation. A secure IPSec configuration on OpenBSD is a single line, and you can copy+paste it from the excellent man page. Part of what makes WireGuard "simple" is that it doesn't support any kind of key management--i.e. PKI. Instead you're expected to copy keys around manually. IKE is the most complex part of the IPSec software stack but in many ways the most important part. Iron…

People say complicated PKIs are the most important parts of systems because they are complicated and hard to work with and people get invested in them and all the time they've sunk into them. But in reality, far more people have been secured by SSH keys than by IPSEC keys, and by Signal than by S/MIME.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#212

Post by AceJohnny2 »

api wrote: post #165
lapinot wrote: post #142

I really like wireguard, but one thing that bugs me is the fact that it's layer 3 (an ip tunnel) and has no code to support layer 2 (ethernet MAC tunnel). The downside for me is that you have to manage static ips in the configurations (specifically it's not compatible with ipv6 slaac and NDP). There is https://git.zx2c4.com/wg-dynamic but it's very experimental at the moment. The level 3-only tunnel is motivated as "…

Substituting MAC for IP address is exactly what ZeroTier does. MACs can't be spoofed, though nodes can be designated as bridges and that allows them to impersonate MACs. There's still the issue of authenticating IPv4 IPs though, which are too small to embed anything useful into. ZeroTier has a certificate system for that but it requires the use of the rules engine to enable it.

> MACs can't be spoofed

lol

20 years ago, in college, some folks in the dorm had fun fucking with others at the Ethernet level. Most of us only had experience with the IP level, so couldn't understand what was going on.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#213

Post by nightfly »

alanpca wrote: post #210
api wrote: post #165

Earlier quoted context omitted.

Substituting MAC for IP address is exactly what ZeroTier does. MACs can't be spoofed, though nodes can be designated as bridges and that allows them to impersonate MACs. There's still the issue of authenticating IPv4 IPs though, which are too small to embed anything useful into. ZeroTier has a certificate system for that but it requires the use of the rules engine to enable it.

Can you not set your MAC to whatever you want on many platforms?

I think they're implying that MACs are authenticated the same way IP addresses are authenticated with Wireguard (you can say "only 52:54:00:7a:cc:dd can talk over this connection").

Re: WireGuard Gives Linux a Faster, More Secure VPN

#214

Post by GekkePrutser »

autarch wrote: post #63
GekkePrutser wrote: post #42

Earlier quoted context omitted.

Wow, 10k$/month is a lot more than a 'sustainable full-time job' would pay :) At least here in Europe. But of course what he's getting now ($1212) is nowhere near that.

That's quite a bit less than someone with his skillset could earn in the US. He could easily earn 2-3x that amount in Silicon Valley, and possibly quite a bit more.

Ok I didn't know that. I heard IT wages in the US were good but I didn't think they were that good. Here in Spain you're doing well with $2200 and that's a senior position at a big multinational.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#215

Post by wahern »

tptacek wrote: post #211
wahern wrote: post #168

Earlier quoted context omitted.

This is a problem with the IKE implementation. A secure IPSec configuration on OpenBSD is a single line, and you can copy+paste it from the excellent man page. Part of what makes WireGuard "simple" is that it doesn't support any kind of key management--i.e. PKI. Instead you're expected to copy keys around manually. IKE is the most complex part of the IPSec software stack but in many ways the most important part. Iron…

People say complicated PKIs are the most important parts of systems because they are complicated and hard to work with and people get invested in them and all the time they've sunk into them. But in reality, far more people have been secured by SSH keys than by IPSEC keys, and by Signal than by S/MIME.

Yet Web PKI trounces all of them combined.

Signal isn't an apposite comparison as Signal implements key signing and key exchange with Signal as the sole certificate authority. Who do you think attests to the authenticity of phone numbers, and how do you think they do so? Indeed, Signal exemplifies exactly what I was saying: key management is crucial, key management is hard. Secure, trusted key management is like 90% of Signal's value-add.

At large organizations SSH is often used with signed X.509 certificates. OpenSSH resisted the feature request for years, but the demand was overwhelming. The rise of products like Teleport and ScaleFT are perhaps best characterized as extremely convoluted combination key management and VPN solutions.

You say "complicated PKI", but my point is that WireGuard has no PKI. In any event PKI is intrinsically complicated. Take WireGuard and add the simplest possible trusted authority scheme on top and you've doubled the conceptual complexity by 2-3x, and possibly the SLoC, too.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#217

Post by kseifried »

sbradford26 wrote: post #53
Hello71 wrote: post #40

Earlier quoted context omitted.

this cisco anyconnect system? https://www.cvedetails.com/vulnerability-list/vendor_id-16/p... doesn't seem very secure to me.

CVEs mean that a company can take action to mitigate a vulnerability. Wireguard is not mature enough to have something like that. A known vulnerability is bad, but not nearly as bad as an unknown vulnerability. This is not a knock on Wireguard, I use wireguard and love it. It just has several hoops to jump through before it is ready for widespread adoption. Like NIST approving it to be used instead of IPsec or OpenVP…

Sorry but... no. You are wrong. Completely wrong.

CVE is just an identifier for a security vulnerability.

"Common Vulnerabilities and Exposures"

CVE generally covers released software, hardware and (in the process or being added officially) services. It also covers beta software (https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=beta).

The reason Wireguard doesn't have CVEs is nobody has bothered to request them.

For more details on CVE there's a bunch of episodes covering it: https://www.opensourcesecuritypodcast.com/search?q=cve

Re: WireGuard Gives Linux a Faster, More Secure VPN

#218

Post by Havoc »

fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

>heavily opinionated foundational tools

Opinionated isn't the right phrase here. For something like webdev there are 200 "right" ways to do things. For encryption "throw out all the legacy crap and focus on 1 known strong tech" isn't opinionated...it's common sense.

...if you have the luxury of a fresh start. Which mainline kernel has granted wireguard.

Monoculture...maybe...but I reckon the tons of legacy stuff in openvpn is way more dangerous. Especially because it kind forces mass adoption of weaker cyphers due to compatability BS.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#219

Post by kseifried »

jlgaddis wrote: post #130
Hello71 wrote: post #99

Earlier quoted context omitted.

my point is that it would appear that "Anyconnect Secure Mobility Client" has a shitton of vulnerabilities. sure, wireguard may have some vulnerabilities, but you don't need a formal audit to tell the difference between "this might have some issues" and "holy fuck this is a fucking dumpster fire". you need an audit to tell if "this might have some issues" is "this has some issues" or "this is actually pretty good". i…

I'm sure you know this but, for the benefit of others... With this exception, WireGuard does not CVEs because it is (for now) still considered pre-release software and not recommended for production use.

CVE does cover "pre-release" software, part of the argument being you can't simply label something as "beta" and escape CVE coverage especially if millions of people are using it (Google's Chrome web browser was a good example of this). For example:

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=prereleases

Re: WireGuard Gives Linux a Faster, More Secure VPN

#220

Post by upofadown »

dsr_ wrote: post #159
upofadown wrote: post #128

Earlier quoted context omitted.

Which ones? How do they suggest that cryptographic upgrades occur?

Something like this: We introduce wireguard2, which is not wire-protocol-compatible with original wireguard. The same configuration files can be used, but you must generate new keys as part of your switch over. We strongly advise you to stop using original wireguard if there is any possibility of a wealthy, organized, determined attacker intercepting your communications. (See CVE2021-x. and forthcoming paper "64 qubi…

So at midnight July 23 2026 everyone upgrades to wireguard2 all at once? Perhaps I am not getting what you are proposing here...
Post reply on HN