Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerabilities exploited in VPN products used worldwide

ncsc.gov.uk

Post reply on HN
Print view View original

121–130 of 140 posts

Re: Vulnerabilities exploited in VPN products used worldwide

#121

Post by fulafel »

morpheuskafka wrote: post #92
lwf wrote: post #84

Earlier quoted context omitted.

Of course they're used for security -- VPNs are a hassle for users and admins, it'd be easier for everyone (except security!) if all internal apps were just public on the internet. VPNs are a band-aid / work-around for "we don't have strong authentication and authorization on all services". That's fine , not everyone can do the latter, and they can provide some safety v.s. the anonymous attacker case. But too often t…

Some protocols/services are designed with a local network in mind and would require modifications to work on the internet. A VPN is invisible to the apps and can easily save a lot of work in a large IT environment with numerous internal services.

You're probably alluding to things like PXE or mDNS, or some proprietary industrial control protocols? This is true but deploying a VPN to cover them is a pretty high price to pay in operational complexity and security cost. There's usually other ways to address the task at hand.

Re: Vulnerabilities exploited in VPN products used worldwide

#122

Post by eeZah7Ux »

ttul wrote: post #50
eeZah7Ux wrote: post #45

Earlier quoted context omitted.

Problem #1: they are closed source. Good luck verifying their security. Problem #2: it is in the best interest of nation states to be able to break the VPNs and it's in the best interest of large vendors to quietly cooperate with the government.

If you are worried about your secrets being revealed to a nation state, then chances are you shouldn’t be putting any of them over the public internet - VPN or not.

That's a big strawman.

Re: Vulnerabilities exploited in VPN products used worldwide

#123

Post by numbsafari »

tptacek wrote: post #69
numbsafari wrote: post #11

Earlier quoted context omitted.

The problem is, in a lot of enterprise environments, you can’t rely on a tool that lists itself as non-production ready, and therefore doesn’t / won’t have CVE, etc. Scroll to the bottom of the wireguard.com site. It’s right on the tin, so to speak. I’m very excited for wireguard, but have some empathy for large enterprises on this one.

I have a lot of empathy for enterprises on this, and while I don't agree with you about "production-ready" (and don't think Jason Donenfeld does either), I do agree with you about giant insurance companies using WireGuard. They're stuck with horrible commercial VPN appliances. You don't have to be.

The latest release announcement, from Jason Donenfeld, on the wireguard mailing list contains the following:

> Hello,

> A new snapshot, `0.0.20190905`, has been tagged in the git repository.

> Please note that this snapshot is, like the rest of the project at this point in time, experimental, and does not constitute a real release that would be considered secure and bug-free. WireGuard is generally thought to be fairly stable, and most likely will not crash your computer (though it may). However, as this is a pre-release snapshot, it comes with no guarantees, and its security is not yet to be depended on; it is not applicable for CVEs.

> With all that said, if you'd like to test this snapshot out, there are a few relevant changes.

I think he’s being very responsible and transparent here. It’d be great if someone with money and/or skin in the game could help the project undergo an audit...

Re: Vulnerabilities exploited in VPN products used worldwide

#124

Post by detaro »

Thorrez wrote: post #95
detaro wrote: post #36

Earlier quoted context omitted.

It's not equivalent with Free Software. Free Software has stricter requirements.

What are the stricter requirements?

I actually was wrong. Free Software is often used to mean Copyleft, but not actually defined that way.

Re: Vulnerabilities exploited in VPN products used worldwide

#125

Post by kdtsh »

tptacek wrote: post #62
mr_puzzled wrote: post #15

Earlier quoted context omitted.

What do you think about cloudflare's vpn offerings? 1.1.1.1 and cf access?

My opinion is that Cloud Flare forked WireGuard, taking Jason Donenfeld's design work without compensation or, from what I can tell, even a sincere thank-you, and built something from it that isn't fully compatible with WireGuard itself. I hope someone else builds a real Rust WireGuard and crushes them with it.

There's nothing in the GPL about compensation or saying thanks. This is part and parcel of licensing your software in a way that respects user freedom.

Also, I doubt Cloudflare forked WG, because 1) that could very well violate the terms of GPLv2 if they don't make the source available (at the very least, the client source code which utilises code lifted from WG would have to be open source), and 2) their offerings don't seem to be as good or as fast as WG, but YMMV.

Re: Vulnerabilities exploited in VPN products used worldwide

#126

Post by aaronmdjones »

numbsafari wrote: post #123
tptacek wrote: post #69

Earlier quoted context omitted.

I have a lot of empathy for enterprises on this, and while I don't agree with you about "production-ready" (and don't think Jason Donenfeld does either), I do agree with you about giant insurance companies using WireGuard. They're stuck with horrible commercial VPN appliances. You don't have to be.

The latest release announcement, from Jason Donenfeld, on the wireguard mailing list contains the following: > Hello, > A new snapshot, `0.0.20190905`, has been tagged in the git repository. > Please note that this snapshot is, like the rest of the project at this point in time, experimental, and does not constitute a real release that would be considered secure and bug-free. WireGuard is generally thought to be fair…

That's not the latest snapshot.

https://lists.zx2c4.com/pipermail/wireguard/2019-September/0...

Re: Vulnerabilities exploited in VPN products used worldwide

#127

Post by specialist »

kdtsh wrote: post #125
tptacek wrote: post #62

Earlier quoted context omitted.

My opinion is that Cloud Flare forked WireGuard, taking Jason Donenfeld's design work without compensation or, from what I can tell, even a sincere thank-you, and built something from it that isn't fully compatible with WireGuard itself. I hope someone else builds a real Rust WireGuard and crushes them with it.

There's nothing in the GPL about compensation or saying thanks. This is part and parcel of licensing your software in a way that respects user freedom. Also, I doubt Cloudflare forked WG, because 1) that could very well violate the terms of GPLv2 if they don't make the source available (at the very least, the client source code which utilises code lifted from WG would have to be open source), and 2) their offerings d…

"There's nothing in the GPL about compensation or saying thanks."

Thank you. I think you may be helping me wrap my head around the notion of "cultural appropriation".

One of my besties beats me over the head with all sorts of things that I'm supposed to be upset about.

One example, we were looking at an art display with a bunch of those origami cranes. I quite liked it. Which is apparently the wrong answer. Because the artist is not Japanese. So that's cultural appropriation.

Here I've been thinking learning from each other, gleaning the best ideas, and putting one's own spin on it is the whole point.

But as a former publisher of my own shareware and public domain stuff, who was widely plagiarized, I do kinda get that lack of attribution, even a nod of the head in the general direction of the original works, feels rude somehow.

To wrap up, I'm now going to reread the GPLs, CC, BSD licenses, thru a lens of cultural appropriation, see if any of it makes more sense to me.

Thanks.

Re: Vulnerabilities exploited in VPN products used worldwide

#128

Post by tptacek »

kdtsh wrote: post #125
tptacek wrote: post #62

Earlier quoted context omitted.

My opinion is that Cloud Flare forked WireGuard, taking Jason Donenfeld's design work without compensation or, from what I can tell, even a sincere thank-you, and built something from it that isn't fully compatible with WireGuard itself. I hope someone else builds a real Rust WireGuard and crushes them with it.

There's nothing in the GPL about compensation or saying thanks. This is part and parcel of licensing your software in a way that respects user freedom. Also, I doubt Cloudflare forked WG, because 1) that could very well violate the terms of GPLv2 if they don't make the source available (at the very least, the client source code which utilises code lifted from WG would have to be open source), and 2) their offerings d…

I'm not accusing Cloud Flare of violating the GPL.

Re: Vulnerabilities exploited in VPN products used worldwide

#129

Post by numbsafari »

aaronmdjones wrote: post #126
numbsafari wrote: post #123

Earlier quoted context omitted.

The latest release announcement, from Jason Donenfeld, on the wireguard mailing list contains the following: > Hello, > A new snapshot, `0.0.20190905`, has been tagged in the git repository. > Please note that this snapshot is, like the rest of the project at this point in time, experimental, and does not constitute a real release that would be considered secure and bug-free. WireGuard is generally thought to be fair…

That's not the latest snapshot. https://lists.zx2c4.com/pipermail/wireguard/2019-September/0...

You’re right, I was off by one. However, they both contain the same disclaimer, which is also repeated on the wireguard website. It’s not production software, according to its own author, despite being quite stable and based on solid theoretical foundations.

Re: Vulnerabilities exploited in VPN products used worldwide

#130

Post by lukasm »

tptacek wrote: post #7

Commercial enterprise VPN products are an open sewer, and there aren't any, from any vendor, that I trust. I don't like OpenVPN or strongSwan, but you'd be better off with either of them than you would be with a commercial VPN appliance. The gold standard, as ever, is Wireguard.

What do you recommend for a personal use?
Post reply on HN