3 ms·
tinc is not a secure choice! Have you seen their documentation? https://www.tinc-vpn.org/documentation/Security.html#Security https://www.tinc-vpn.org/document
by galadran 8y ago
tinc is not a secure choice! Have you seen their documentation?
https://www.tinc-vpn.org/documentation/Security.html#Security https://www.tinc-vpn.org/documentation/Security.html#Securit...
The default cipher is from 1993 and its creator recommends everyone updates.
32 bit MACs are hilariously tiny.
Home rolled authentication based around RSA.
Their own documentation even states: ”tinc’s security is not as strong as TLS or IPsec."
DO NOT USE tinc!
- Freaky 8y agoNew deployments should be with 1.1 using its new protocol. https://www.tinc-vpn.org/documentation-1.1/Simple-Peer_002dto_002dPeer-Security.html https://www.tinc-vpn.org/documentation-1.1/Simple-Peer_002dt...
- galadran 8y agoThat does look a lot better, however: a) its not supported by the stable release b) There are no claims about downgrade resistance. The manual specifies the new transport protocol is used if both clients support it and both have changed their configs to enable experimental mode. Can an attacker still force them to connect with legacy mode? c) Users have to ensure every single config on every client has the correct setting. d) It still doesn't have the identity hiding features of Wireguard. (Someone observing your network traffic can see which servers you are talking to from the transmitted signatures)
- Freaky 8y agoYou can disable legacy support by not generating any RSA keys, or by building with DISABLE_LEGACY.
- xmichael999 8y agoHuh, interesting... I am definitely going to be doing some reading about this one. I wonder what the logic of the project maintainers, whom seem to maintain it, have in keeping with this method of encryption.