WireGuard Gives Linux a Faster, More Secure VPN

Re:WireGuard Gives Linux a Faster, More Secure VPN by wahern on Monday March 02, 2020 @07:02PM (#22470468)

> Neither Signal nor SSH in their most common mode of use have a "PKI" in the sense you mean, which is my point.

I assume then that you exchange the public keys of your Signal contacts over SMS. Over perhaps you scp them to a server you share with friends.

> The Web PKI is something we live with because we have to, not something anyone sets out to re-create.

We have to because it's crucial. If public key attestation didn't matter we would have dispensed with the lock icon and "this certificate is untrusted" popups rather than laud the emergence of Let's Encrypt and the ACME protocol.

[ Parent | on HN ]

Re:WireGuard Gives Linux a Faster, More Secure VPN by cyphar on Monday March 02, 2020 @10:28PM (#22471539)

> > Neither Signal nor SSH in their most common mode of use have a "PKI" in the sense you mean, which is my point.

> I assume then that you exchange the public keys of your Signal contacts over SMS. Over perhaps you scp them to a server you share with friends.

You are meant to verify your contacts' keys (aka "safety numbers") either in-person or otherwise out-of-band. The Signal server does not in any way sign or endorse the identity keys they serve to users (yes, they're delivered over TLS but that doesn't count).

Yes, Signal does do some best-effort verification of your phone number when you register a device but that's just to avoid DoS. SMS can be easily intercepted.

[ Parent | on HN ]

Re:WireGuard Gives Linux a Faster, More Secure VPN by tptacek on Monday March 02, 2020 @07:10PM (#22470539)

This is responsive to essentially nothing I wrote.

[ Parent | on HN ]