undefined | Better HN

0 pointswolverine8764y ago0 comments

Regarding stability: WireGuard is widely used, Linus allowed it into the Linux kernel, and I haven't heard anyone mention stability problems.

WireGuard is also orders of magnitude more secure than OpenVPN.

0 comments

3 comments · 1 top-level

TedDoesntTalk4y ago· 2 in thread

> WireGuard is also orders of magnitude more secure than OpenVPN.

This entirely depends on how you configure OpenVPN, which encryption to allow it to support, HMAC, hashes, etc. If you configure it with maximum security, it is equally secure as WireGuard. If you configure it less so, then you allow older clients to connect.

BlackLotus894y ago

I think what the parent post meant isn't necessarily security in the transport, but security in the code.

The wireguard has around 4k LOC [0] and you can read and understand it in a weekend (or faster depending on your skill). Also you not only don't have to configure the ciphers, but you actually can't. If any of the chosen defaults isn't considered secure anymore they will be replaced [citation needed]. So even thought the code resides in the linux kernel you could still reasonably well argue that it is indeed on several levels more secure than OpenVPN. Here [1] is the whitepaper for anyone who is interested.

[0] https://git.zx2c4.com/wireguard-linux/tree/drivers/net/wireg...

[1] https://www.wireguard.com/papers/wireguard.pdf

tptacek4y ago

No, it does not depend on configuration. You cannot configure OpenVPN to be "equally as secure as WireGuard".

j / k navigate · click thread line to collapse