undefined | Better HN

0 pointstptacek5mo ago0 comments

WireGuard is designed to be silent preceding a cryptographically authenticated INIT message. It's a superset of whatever security features you'd get from "knocking".

0 comments

akerl_5mo ago

In fairness, most of the fervor for these kind of knock-based flows predate Wireguard existing. They come from the era where OpenVPN and friends were the common practice in that space, and I would not have considered "add OpenVPN" to be a rational way to improve the security of anything I was doing.

frumplestlatz5mo ago

OpenVPN was a perfectly reasonable answer to this problem for many years.

“Port knocking” et al were most definitively not.

akerl_5mo ago

Eh. I've used OpenVPN over many years for many kinds of problems. I'm hesitant to call it perfectly reasonable even for the most mundane use case of "running an entirely vanilla virtual private network". For the use case of securely wrapping services in the way Wireguard can do, it's hilariously bad.

OpenVPN is basically 1000 configuration options and magic incantations wearing a trenchcoat, and if you get any of them wrong the whole thing crumbles (or worse, appears to work but is not secure).

mdhb5mo ago

I’m not arguing with you or pretending to not know the difference. I’m saying that is the right answer 999/1000 but there are other scenarios as well.

j / k navigate · click thread line to collapse

0 comments

akerl_5mo ago

frumplestlatz5mo ago

OpenVPN was a perfectly reasonable answer to this problem for many years.

“Port knocking” et al were most definitively not.

akerl_5mo ago

OpenVPN is basically 1000 configuration options and magic incantations wearing a trenchcoat, and if you get any of them wrong the whole thing crumbles (or worse, appears to work but is not secure).

mdhb5mo ago

I’m not arguing with you or pretending to not know the difference. I’m saying that is the right answer 999/1000 but there are other scenarios as well.

j / k navigate · click thread line to collapse