41–50 of 187 posts
I think IPSec or OpenVPN are probably the opposite of what WG is offering here... Microsoft's SSTP offering is actually not causing me any major frustration at the moment. I almost like using it. But, seeing these other comments telling tales of 600 megabit VPN wifi experiences... I'll check it out for sure.
Earlier quoted context omitted.
How this plumbing is expected to be implemented? For example Cloudflare Warp uses Wireguard for its VPN solution, but all key exchanges and other stuff happens via HTTPS REST calls. Is it expected for any non-trivial implementation to build a different "control" protocol? For me it sounds like a dangerous approach. While wireguard protocol will be safe and audited, those additional proprietary protocols will hinder c…
Yes, you are exactly right. Wireguard is a typical example of a thing I'd call myopic-cryptographer-protocol. Solve one problem in the minimal fashion that can be called proof-of-concept, do it in a maybe-more-secure way and call it done. Everything else, like proper key distribution and user management, which you need for a real-world deployment that isn't just a personal toy, is left as an exercise to the reader. A…
I do agree with your overall sentiment, though. The next step is to make a higher level protocol on top.
I would like to see 2FA (app or security key) support built into WireGuard. Otherwise, it is perfect as compared to the OpenVPN mess.
Earlier quoted context omitted.
WireGuard is not MFA, but the user's private key could probably be stored in a smart-card instead of on disk. Software changes would need to be made so the key is read from the card instead of specified in the wgx.conf file. To achieve true MFA, it would need either a password, TOTP, or SMS in addition to the stored keys.
Nope, can't. Storing a Wireguard key on a Smartcard isn't possible, because current cards do not support the key format and algorithms Wireguard uses. Only RSA and ECDSA on NIST curves are available on Smartcards. And "reading" the key from the card would make the card useless, the important feature of a smartcard is that it doesn't ever make the key available for reading. Instead, the key is used for signing or decr…
There are programmable smartcards on which you can implement your own algorithm. ZeitControl sells cards you can program in a BASIC dialect: https://www.zeitcontrol.de/de/produkte/basiccard/basiccard-p...
Earlier quoted context omitted.
If people want Wireguard to be a complete multiplatform audited free enterprise VPN solution they need to donate more. A lot more.
Nobody really needs enterprise VPN crap, that stuff does far too much weird stuff that is totally unrelated to what a VPN should do, like patch management, malware scanning, firewalling, and other useless box-ticking. What we do need is a proper replacement for roughly the things OpenVPN plus PAM can do. A VPN plus some user and key management.
I'm not arguing that Wireguard has an obligation to tackle that problem themselves. I'm arguing against your assertion that VPN access should be completely decoupled from ensuring endpoint security.
Earlier quoted context omitted.
wireguard is a VPN technology that is now integrated into the Linux kernel, and is available on all major platforms. It distinguishes itself from other VPNs by not having knobs to twiddle. Should a security issue arise, it will be necessary to replace it with a wireguard2 or such. This also means that it's very hard to get it wrong in config; either it works or it doesn't, and if it doesn't, you haven't got it workin…
Wireguard is pretty much half of what you'd expect from a VPN. It does the low-level part (encryption, packetization, session setup, NAT traversal, etc. -- the “actual VPN”) brilliantly, but everything around key distribution is left to external systems. (Tailscale is a popular choice, but by no means the only one.) E.g., you can't connect to vpn.example.com with user foo and password bar and that's it; there needs t…
That's what I'd like, since authentication is usually a pain to set up and with Wireguard, there's none to be done. This also means it's totally stateless and is great for mobile devices where a connection might be broken and crsated again frequently.
Earlier quoted context omitted.
It's a VPN protocol whose USP is being dramatically simpler than OpenVPN, which should mean that it is both easier to use and more secure (and consensus seems to be that it generally delivers on both of those fronts).
dramatically simpler than IPsec. IPSec is Internet Layer, while TLS/SSL (OpenSSL) are Application Layer
Technically not, since IPSec can also be tunneled over UDP which then turns it into an application layer protocol.
What is WireGuard, is it a new protocol? Or a new algorithm for implementing an existing thing? (Or something else)
Also Ars had a great article on it as well if you want a readable but more in depth version https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review...
Very impressive performance: > While performance is quite good right now (~7.5Gbps TX on my small test box), not a lot of effort has yet been spent on optimizing it > Jonathan Tooker reported to me that, on his system with an Intel AC9560 WiFi card, he gets ~600Mbps without WireGuard, ~600Mbps with wireguard-go/Wintun over Ethernet, ~95Mbps with wireguard-go/Wintun over WiFi, and ~600Mbps with WireGuardNT over WiFi.…
Earlier quoted context omitted.
It's a VPN protocol whose USP is being dramatically simpler than OpenVPN, which should mean that it is both easier to use and more secure (and consensus seems to be that it generally delivers on both of those fronts).
dramatically simpler than IPsec. IPSec is Internet Layer, while TLS/SSL (OpenSSL) are Application Layer