nostream

So far, I have not heard anyone who has found any security holes and I'm active in the #WireGuard IRC channel with 300+ users, where many have looked at the code. There may be some unscrupulous hacker who has reviewed the code and found something but choose not to publish it, but it may also apply to WireGuard's source code.

A security hole in WireGuard's wg-quick that many use to establish the connection is that it allows the .conf file to download and execute programs without asking the user, and this feature is enabled by default.

This is basically a good feature and allows admins to run custom software as soon as the connection has been established.

However, it allows an evil (or NSA-hooked) VPN provider to issue .conf files to infect the user's computer with malicious code because users of VPN services rarely review the .conf files.

TunSafe has the same feature but it is disabled by default and requires Admin privileges to enable it.

I like that TunSafe seems to have more restrictive security settings as default, though it may not be appreciated by hardcore users.

I've never really understood what was controversial with TunSafe more than it was closed source so it was hard for others to review the code, but now it's open source.

As a former fan of WireGuard, I would STRONGLY advise against using ANY WireGuard implementation and that includes the official one.

As it is now, there seems to be only one person in the world who believes that they have the knowledge to determine if a WireGuard implementation is secure or not, and it is the founder himself.

So much for the 4000 lines of code that was supposed to be easily audited and understandable by others.

Avoid WireGuard until there is an outside group that can review the protocol and implementations of the protocol. For as it is now, the founder accuses all third party implementations of being unsecure but without being able to state why (more than it feels he has something personal against them).

It all feels too immature.

I'm a big fan of WireGuard. But it gives a bad taste in the mouth to know that the author banned a WireGuard fan and user from the IRC channel just because he took time to code and release a free Windows client for the protocol. And that the WG author spend time to talk shit about this client whenever he has a chance, for example when the Windows client author announce it here.

The protocol is quite easy to get into, it is well documented to the extent that it is easy to believe that it is in WireGuard's interest that more people develop software that supports the protocol.

Maybe the WireGuard homepage should make an official statement that anyone who implement the protocol and release a client is no longer welcome in the community to discuss the protocol or listen when other people discuss the protocol.

The WG author mentioned in the mailing list that he has reverse engineered Tunsafe and found security flaws. I would like to see that he presents these security shortcomings in order to legitimize his claim instead of keeping it secret. As he is a representative of a security company, it might be a good tactic to not hurt his reputation as it is practice in the security industry to share such information.

zx2c4: I've been waiting for quite a while, how far away in time is shortly?

"appears to speak the protocol some of the time, or merely implementing a protocol at all"

ludde: Is the wireguard protocol fully implemented or just partially implemented in the version that is on the homepage?

zx2c4: Which language is the linux version of wireguard written in?

zx2c4: I've looked at the Go version on your homepage, but the initial text in the git project. "This is not a complete implementation of WireGuard ..... There is no group of users that should use the code in this repository here under any circumstances at the moment, not even beta testers or dare devils.", is this the one that you refer to or do you have a closed git project with a newer version?

Either way. The L2TP/IPSec implementation in Windows 7 I use now is also closed-source proprietary software. So I can't see that TunSafe should be worse since the author is public. I guess TunSafe will not be able to communicate with the wireguard servers if it does not use the correct encryption and protocol scheme?

zx2c4: I appreciate your software but I think it's good with alternatives, and your attitude is a bit harsh. Why not support alternatives? Isn't the main reason with open-source communication protocols to inspire people to make alternative client/server software? TunSafe seems to be a neat pieace a software and something a lot of people have been waiting for, and Ludvig Strigeus made the best software for the BitTorrent protocol in the early days. Why do you not appreciate that he spend time to make a client that support your protocol? I've been waiting for a wireguard windows client and I would have made one if I had the knowledge. God damn, show a little appreciation?

Cool news!

zx2c4: Would it be possible for you to configure the WireGuard demo server so that it detects if there are interoperability issues with other clients?