Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GotaTun – Mullvad's WireGuard Implementation in Rust

mullvad.net

Post reply on HN
Print view View original

101–110 of 142 posts

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#101

Post by coppsilgold »

mycall wrote: post #46
DANmode wrote: post #25

Earlier quoted context omitted.

Known Limitations WireGuard is a protocol that, like all protocols, makes necessary trade-offs. This page summarizes known limitations due to these trade-offs. Deep Packet Inspection WireGuard does not focus on obfuscation. Obfuscation, rather, should happen at a layer above WireGuard, with WireGuard focused on providing solid crypto with a simple implementation. It is quite possible to plug in various forms of obfus…

Mullvad does exactly this.

WireGuard limitations hurt the attempt however.

For example, multi-hop betrays the actual exit node to your ISP (or MITM) due to the port used.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#103

Post by wang_li »

ur-whale wrote: post #4

One meta thing I've always wondered ... Are multiple implementations of the same protocol good or bad for security? Probably naively, I'm thinking: - diversity: good - doubling the attack surface: real bad What do the security folks out there think of the topic?

Is having Mac OS and Linux a decrease or increase in security over just having windows only?

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#106

Post by entropyneur »

int0x29 wrote: post #102
ekjhgkejhgk wrote: post #87

Earlier quoted context omitted.

It's just called WireGuard, by the "WireGuard Development Team" off google play.

Pretty sure thats the c implementation not the go one

AFAIK the C implementation is a kernel module that's not shipped in stock Android releases. The WireGuard Android app uses that module when available, but otherwise uses wireguard-go.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#107

Post by nine_k »

Hakkin wrote: post #12

I definitely noticed the performance boost on my Pixel 8, for some reason it seems to really not like wireguard-go, it struggled to pull even 100mbps, maybe something unoptimized on Google's custom hardware. With the new GotaTun version I can pull 500mbps+, though unfortunately it also seems to have introduced a bug that randomly prevents the phone from entering a deep sleep state, so occasionally my battery will ran…

I think the problem is on the Android side. I noticed the same behavior with ZeroTier and even with MizuDroid, all totally unrelated.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#108

Post by throwaway894345 »

conradev wrote: post #91
turblety wrote: post #54

Earlier quoted context omitted.

Yeah you are right. Can you think of any way we could capture that traffic too?

Tor does this the right way on Linux. You make a separate user namespace with access only to the WireGuard network adapter and run the program inside of that. You want the kernel involved if you want any sort of guarantee: https://blog.torproject.org/introducing-oniux-tor-isolation-...

How does this work in something like Kubernetes where you have a sidebar container configuring the network for the main container without affecting others on the same host?

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#110

Post by baobun »

coppsilgold wrote: post #101
mycall wrote: post #46

Earlier quoted context omitted.

Mullvad does exactly this.

WireGuard limitations hurt the attempt however. For example, multi-hop betrays the actual exit node to your ISP (or MITM) due to the port used.

To clarify, this is refering to Mullvad multi-hop feature. Doing your own multihop setup doesn't have this issue, right?
Post reply on HN