Re:WireGuard: next generation in-kernel modern VPN
by uudecode on Tuesday June 28, 2016 @09:45PM
(#11998976)
It's possible to shake off OpenVPN and TLS without shaking off use of tun/tap. I use a tun/tap based "VPN" (overlay) and I quite like it. One could even add NaCl to it if they were so inclined.
I sometimes think Apple removed /dev/tap from iOS because it provided too much potential freedom.
Not every user needs in-kernel performance for their daily routine but there's certainly an argument that every user could use a decent "VPN" that could run on all their computers.
Alas, OpenVPN mindshare is rather strong, to the detriment of existing or future userspace alternatives.
Re:WireGuard: next generation in-kernel modern VPN
by teacup50 on Tuesday June 28, 2016 @03:15PM
(#11996649)
> OpenVPN uses TLS.
Granted, but this should generally be behind a shared secret HMAC, according to best practices, limiting the scope to those with the key in hand.
> The whole point of WireGuard is to shake off that complex baggage.
That's great, but also has nothing to do with running in-kernel. I'm not ready to give either product a clear pass on their risk profiles.
OpenVPN uses TLS. The whole point of WireGuard is to shake off that complex baggage.