The side channel attack is silly and impractical. You know it's silly. I know it's silly. Let's quit pretending.
The firewall rule is 100% sufficient to defend against this exploit. All good VPNs already provide it by default. It's not deep. They're just routes.
Please stop the FUD.
Re:Attackers Can Decloak Routing-Based VPNs
by StressedDev on Monday May 06, 2024 @08:59PM
(#40281189)
Side channels are a huge danger. An example is cryptographic functions have been cracked because of timing differences based on the key or data being encrypted. This is why cryptographic ciphers are implemented in constant time code (i.e. code that always runs in the same amount of time regardless of its input).
I'm talking about the specific side channel attack mentioned in their report. Not side channels generally ;)
I do want to point out that you could deny all traffic except allow a single IP address to test the inverse in a low traffic setting. With a low DHCP lease time it’s feasible that could look like a shaky connection. This is only possible because the kill switches don’t actually disconnect the user.
There’s also mitigation bypasses that are likely to be discovered, we have a few we’re working on.