Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard Gives Linux a Faster, More Secure VPN

wired.com

Post reply on HN
Print view View original

91–100 of 306 posts

Re: WireGuard Gives Linux a Faster, More Secure VPN

#91

Post by pergadad »

fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

As a tech-affine user I aporeciate simpler tools. I love configurability but if I have to fight with every tool it's really hard to stick with Linux...

Re: WireGuard Gives Linux a Faster, More Secure VPN

#92

Post by charlesu »

GekkePrutser wrote: post #42
nif2ee wrote: post #30

Don't forget to support Jason, WireGuard's author, on Patreon. https://www.patreon.com/zx2c4

Wow, 10k$/month is a lot more than a 'sustainable full-time job' would pay :) At least here in Europe. But of course what he's getting now ($1212) is nowhere near that.

$10k a month is a 'sustainable full-time job' for a senior developer once you factor in health insurance and the additional 7.65% self-employment tax.

I prefer this model for opensource software. We get an awesome product and he gets enough money to sustain himself while maintaining it. Seems like a fair deal for all.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#93

Post by nif2ee »

tptacek wrote: post #88
nif2ee wrote: post #86

Earlier quoted context omitted.

Of course I am sure he is extremely happy spending 5 years developing the next big thing then others rebrand it for enterprise and become rich.

Jason comments here all the time and is quite easy to talk to, and I think we're all better off hearing from real Jason, not some imaginary angry Jason you've invented. Not least because there are actual abuses in the WireGuard ecosystem, and your imaginary Jason is obscuring them behind fake abuses.

I didn't say he is angry, my main point was not advertise for free for a company that is built off the work of a single man, especially when it's FOSS, especially when it's a technically piece of genius like WireGuard, while not supporting the man himself. There are known ways for companies to market their paid product, it's called ads.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#94

Post by Znafon »

blattimwind wrote: post #82
Znafon wrote: post #67

Earlier quoted context omitted.

This is a common critic of WireGuard, but it looks like those service are looking for excuses to explain why they don't propose WireGuard yet. As far as I understang it: > What they probably need to do is to assign each customer a fixed private IP for use within their VPN, e.g. from 10.0.0.0/8. Actually, they can set a different IP for each session and rotate them by given it to the client out of band, for example wh…

> Actually, they can set a different IP for each session and rotate them by given it to the client out of band, for example when it authenticates to the service. Like I said, Wireguard does not have the concept of sessions. You could add your own proprietary "stuff" around Wireguard to add that concept, but then you don't need anything extra from Wireguard. You add the keys of the users as part of the session setup a…

There is a handshake at most every two minutes. Is it not possible to say e.g. fetch a new key if the last handshake was an hour ago?

Re: WireGuard Gives Linux a Faster, More Secure VPN

#95

Post by cyphar »

GekkePrutser wrote: post #39
293984j29384 wrote: post #33

What makes Wireguard more secure? The article appears to make some weak claims about a smaller codebase and less configuration options but I don't think that translate directly into it being more secure?

Smaller codebase means less chance of bugs. But I agree, it should really be audited properly before this statement can be made.

WireGuard has been extensively audited many times for the past 4-5 years, including several formal proofs[1]. I would argue no other VPN has been as thoroughly audited (not to mention that the codebase size means that an entire-codebase audit is actually possible). That doesn't mean it's perfect (and it has had bugs), but it's definitely exceptionally well designed and written code.

In addition, the crypto design (beyond it being opinionated and thus no way to misconfigure into using the "null cipher") is arguably much more secure by design than other systems. For instance, WireGuard eliminates entire classes of vulnerabilities through careful protocol design while also adding fairly neat features (such as being impossible to port scan) -- the author explains this much more eloquently than I can[2].

[1]: https://www.wireguard.com/formal-verification/ [2]: https://www.youtube.com/watch?v=CejbCQ5wS7Q (about 23 minutes in)

Re: WireGuard Gives Linux a Faster, More Secure VPN

#96

Post by Vysero »

e12e wrote: post #47
Vysero wrote: post #17

So when they say it will be embedded into the Linux Kernel, what does that mean exactly? Does that mean I will be able to open a terminal an type: WireGuard and from then on my connection to the internet will be secure so long as I don't close the terminal or what?

> Does that mean I will be able to open a terminal an type: WireGuard and from then on my connection to the internet will be secure It's more like how iptables/nftables is part of the kernel. You need a recent kernel along with user space tooling. But it will become part of virtually every Linux distribution. As for "my connection to the internet will be secure" - that's possible, but the main use case right now is "…

This may sound like a newb question but.. is my connection to my vpn/server not already secure on Linux?

Re: WireGuard Gives Linux a Faster, More Secure VPN

#97

Post by zoonosis »

lbeltrame wrote: post #62
jhurliman wrote: post #2

Is there a version of Ubuntu that has GUI NetworkManager support for WireGuard? I’m missing the convenience of toggling the VPN on and off from the system menu.

Versions >= 1.20 have support for all the bits and pieces (including routing all traffic). Initial support landed in 1.18.

If that is the case, it looks like Ubuntu 19.10 and later have support.

https://packages.ubuntu.com/search?keywords=network-manager&...

Re: WireGuard Gives Linux a Faster, More Secure VPN

#98

Post by philsnow »

HideousKojima wrote: post #44
Diederich wrote: post #36

Earlier quoted context omitted.

> 70+ node full-mesh vpn ~2^70 VPN connections?

Wouldn't it only be 70^2 (or 69^2 or 69*70 maybe?)? Each of the 70 devices has a VPN connection to 69 other devices. So only ~5,000 total

wireguard uses UDP so they're not actual "connections"

Re: WireGuard Gives Linux a Faster, More Secure VPN

#99

Post by Hello71 »

sbradford26 wrote: post #53
Hello71 wrote: post #40

Earlier quoted context omitted.

this cisco anyconnect system? https://www.cvedetails.com/vulnerability-list/vendor_id-16/p... doesn't seem very secure to me.

CVEs mean that a company can take action to mitigate a vulnerability. Wireguard is not mature enough to have something like that. A known vulnerability is bad, but not nearly as bad as an unknown vulnerability. This is not a knock on Wireguard, I use wireguard and love it. It just has several hoops to jump through before it is ready for widespread adoption. Like NIST approving it to be used instead of IPsec or OpenVP…

my point is that it would appear that "Anyconnect Secure Mobility Client" has a shitton of vulnerabilities. sure, wireguard may have some vulnerabilities, but you don't need a formal audit to tell the difference between "this might have some issues" and "holy fuck this is a fucking dumpster fire". you need an audit to tell if "this might have some issues" is "this has some issues" or "this is actually pretty good". in particular, "Anyconnect Secure Mobility Client" appears to have a significant number of local privilege escalation exploits, some several dozen since 2011. that doesn't necessarily mean that the protocol is shit, but it probably does. it probably means that no serious security professionals have examined it, and the vulnerabilities that have been found are just the easiest ones that can be found with a scanner.

but even ignoring all of that, wireguard has significantly better security guarantees. https://www.wireguard.com/formal-verification/ claims that "WireGuard has undergone all sorts of formal verification, covering aspects of the cryptography, protocol, and implementation." with references to several formal proofs of the protocol.

furthermore, wireguard has actually received a CVE: CVE-2019-14899, which was posted here only a few weeks ago. it's not wireguard-specific though, it's a general problem with VPN setup on general-purpose operating systems.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#100

Post by StreamBright »

nif2ee wrote: post #20
ahnick wrote: post #7

Earlier quoted context omitted.

Tailscale looks promising. ( https://tailscale.com/ )

I am sick of people shilling to this thing here. Stop exploiting HN for free advertising. Every Wireguard post here has become a free ad for this company. EDIT: Stop supporting parasites repackaging and rebranding open source and selling it while leaving the author who single handedly made this entire thing possible begging for donations on Patreon

Actually, I haven't heard of them and they look like a pretty nice way of connecting different resources over the internet. I am not sure what you mean by parasites. I am glad they posted the link in this thread. Wireguard is an opensource project, Tailscale is a paid service. Do you think they compete with each other or you think that people should not share product recommendations at all on HN?
Post reply on HN