Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard Gives Linux a Faster, More Secure VPN

wired.com

Post reply on HN
Print view View original

271–280 of 306 posts

Re: WireGuard Gives Linux a Faster, More Secure VPN

#271

Post by zhte415 »

rcxdude wrote: post #151
zhte415 wrote: post #144

Earlier quoted context omitted.

What would the point of 2FA be? Interested as a use-case I don't quite follow.

If you are using a VPN to access a sensitive network (home or office), you want to make it harder for an attacker to steal keys or passwords to the network (especially since any roaming devices are more vulnerable to evil maid attacks). 2FA through a token or phone apps means they now need to compromise two devices instead of one.

OK, I get you. I think we're coming from different angles. You're concerned about getting into a network, I'm concerned on not identifying identification.

Thanks for the reply.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#272

Post by bjoli »

1_person wrote: post #147
deepersprout wrote: post #8

Earlier quoted context omitted.

> While I don't believe WireGuard is a drop in replacement for IPsec tunnels or OpenVPN Why?

In reality WireGuard's only valid selling point is that it's easier to use than alternatives. It is not, for example, faster than the literally dozens of ASIC implementations of bump in the wire IPsec that scale to line rate n * 100Gbps. It's not even faster than kernel IPsec on architectures which support AES with dedicated instructions. Incidentally, this is the default configuration for Strongswan on supporting ha…

Those benchmarks are weird. We did a test, just for fun, comparing wireguard and IKEv2 using strongswan (using ike=aes128gcm16-prfsha256-curve25519!). Strongswan came out ever so slightly faster, but with a SHITLOAD of retries. We tried different things, but the only way we got the retires down was switching cipher to chacha20-poly1305 (which made it sliiiightly slower than wireguard). There was basically zero network latency in this test, which makes me wonder how IKEv2 would have looked over the real internet.

As you said: I am not a network admin, so I probably botched something. Which, I guess, is another point for wireguard in my book. It lacks many of the bells and whistles of IPsec, which means less to configure for the average stupid home user (me).

Re: WireGuard Gives Linux a Faster, More Secure VPN

#273

Post by nikon »

twentyloops wrote: post #135

Check out Algo [0] if you're interested in setting up a personal WireGuard VPN server. It's simple and hassle-free, especially if you are not familiar with server administration and don't want to be bogged down by details. I have one deployed on Digital Ocean ($5/mo droplet). All you need to do is run the setup script, answer a few yes/no questions (optional features), paste in your API key, and update the firewall s…

This is good, however I noticed DigitalOcean's IP blocks are banned by a few sites.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#274

Post by qzio »

aeyes wrote: post #65

Are there any official plans for 2FA in Wireguard?

While we wait for something proper, you can always "patch" it on top of the connection like a quick PoC I made: https://github.com/qzio/w2fau2f

Also, see: https://lists.zx2c4.com/pipermail/wireguard/2017-September/0...

Re: WireGuard Gives Linux a Faster, More Secure VPN

#275

Post by ptman »

1_player wrote: post #245
tosh wrote: post #124

I think Tailscale [1] can be to WireGuard what Github and Gitlab are to git. If you haven’t checked them out yet: worth taking a look! [1] https://tailscale.com

Works only with some identity providers, for some reason I could not understand. If you don’t have a Google, Microsoft or corporate email identity provider, you can’t use it. There might be a reason for this, but still it’s not in the same space as Wireguard.

young company, cover a large amount of users with a simple and quick solution

using google/microsoft account is easier than setting up a user service that is comparable in security and ease of use

Re: WireGuard Gives Linux a Faster, More Secure VPN

#276

Post by peterwwillis »

ecnahc515 wrote: post #123
0xbadcafebee wrote: post #60

What I don't like about WireGuard: - Basically no real user or admin-oriented docs. There's some example configs and some getting started guides, and then some crypto-nerd look-how-secure-our-algorithms-are docs, but no real guidance on how to set up a reasonably simple network of hosts. - Authentication/authorization is just IP addresses and public keys? What about users and service accounts that you want to rotate…

If you want SSO, or fine grained access control, the idea is you would do that at a level above wireguard. For example, I'm prototyping a small CLI that talks to hashicorp vault via OIDC/OAuth2, and then creates a wireguard key pair + configuration locally, submits the public key to vault, and then the wireguard "server" is configured with a simple daemon that pulls all the public keys from vault and generates a wire…

It sounds cool, but it also extends the amount of components that have to be made resilient to failure and attack. Your HA vault+consul clusters, HTTPS & OAuth2, key generation, and automation pieces (inc. message passing & load balancing) all need to be working correctly. Compare that to a single stateless server which spits out an OAuth2 login url to a client, receives a token once the client is authed, and opens a connection with that user's specific network authorization.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#277

Post by nif2ee »

dang wrote: post #270
nif2ee wrote: post #269

Earlier quoted context omitted.

Again, please do your job and delete astroturfing comments and ban these users. This company has been exploiting HN for so long to promote itself whenever a post about Wireguard go to the frontpage. They don't even have a ready product. This website encourages really sneaky types of marketing if you don't take action.

I appreciate your concern for the integrity of this site, but if you really care about that you should follow its rules, which say clearly what to do with these insinuations, and it isn't posting them here. I haven't seen any evidence of astroturfing in this case. The user you were accusing above seems entirely legit. You've posted such accusations to HN several times before. Given how little data we have about each…

I will stop doing that. But HN should give the priority to FOSS projects and commercial projects made by single developers and small companies that have no money or other way of reaching out to users instead of helping big companies and startups made by millionaires. As of Wireguard case, if you've been following all popular threads about it throughout the last 2 months you will know what I am talking about.

Don't let HN to become another ProductHunt.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#278

Post by megous »

q3k wrote: post #206
megous wrote: post #108

Earlier quoted context omitted.

What do you mean by static keys? All keys are changeable at runtime and wireguard uses public key cryptography.

That all clients have to be configured on each server.

Server has to know what clients to accept in any VPN solution. I still don't see the point.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#279

Post by [deleted] »

xxpor wrote: post #114
josteink wrote: post #107

WireGuard is nice and fast indeed, but unusable for me at work, because pretty much all outbound UDP-traffic is filtered. Having a TCP-based option sure would be nice.

I'd be fairly confident your work doesn't want people making random VPN tunnels from their work laptops.

[deleted]

Re: WireGuard Gives Linux a Faster, More Secure VPN

#280

Post by zamadatix »

xxpor wrote: post #114
josteink wrote: post #107

WireGuard is nice and fast indeed, but unusable for me at work, because pretty much all outbound UDP-traffic is filtered. Having a TCP-based option sure would be nice.

I'd be fairly confident your work doesn't want people making random VPN tunnels from their work laptops.

Probably not but nobody said it was the work laptop just at work. It'd be pretty hard to get WG installed on a work laptop in the first place.

My work does the same kind of thing on the guest SSID, drives me nuts.

Post reply on HN