4 ms·

Zerotier seems a bit too clever about auto-discovery/peering. For comparison: WireGuard, by design, is a fairly simple protocol that requires some other softwa

Zerotier seems a bit too clever about auto-discovery/peering. For comparison: WireGuard, by design, is a fairly simple protocol that requires some other software or out of band configuration to provide the peer pubkey list (among other things). As a result, there are multiple mesh configuration tools built on top of it, some of which support dynamic (auto-discovered) peers/tunnel establishment. This separation of concerns for the well-designed mesh configuration layers on top of WG make it a little safer than integrated options like ZeroTier in my opinion, because the peer config/establishment and tunneling protocol are separate, independently auditable pieces. I am wary of mesh VPNs that don’t require you to statically enumerate peers, especially when I don’t fully understand the underlying authorization/trust scheme. I’m extra wary of those that don’t have a well staffed team to respond to threats, and that don’t exhibit the appropriate amount of humility when making security claims. (This is not directed at ZeroTier specifically.) On an unrelated note, there is a really fun infosec podcast named Darknet Diaries, worth a listen.

numpad0 5y ago
I think the intended use case for ZeroTier is six Android phones and two Windows laptops connected to a same L2 with ~500kbps UL/DL, that has to be bulletproof, dumbproof and as close as possible to zero setup and nannying, even with Android phones constantly roaming between a Wi-Fi router in a car and Starbucks Wi-Fi and its own metered WWAN. It's a very specialized solution, not a generic VPN. They do seem to care about security but they also probably prioritize zero setup/maintenance/service restart over it. Like, you can post that two apks and that zip and a ZeroTier key on Discord, let that trusted pseudonymous guy to approve connection requests on ZT, tell people to clear cache and retry if it's not working, and that's all you have to do. WireGuard would take more effort to deal with. dc: No, I've never been involved in that kind of activity, but came across ZT from a different direction it is useful for, and got what the app is about.
- op00to 5y ago
  What is the actual intended use case, not the implementation details?
hawski 5y ago
For Wireguard mesh networks is there something in the similar level of maturity as Zerotier?
- watchdogtimer 5y ago
  Tailscale perhaps?
  - tyingq 5y ago
    Self-hosting is possible by adding headscale too: https://github.com/juanfont/headscale https://github.com/juanfont/headscale It doesn't have all the features of tailscale hosted server, but they seem to be actively working the list of missing features.
  - hawski 5y ago
    AFAIK Tailscale is an alternative to ZeroTier, but it doesn't involve WireGuard. Edit: I was wrong.
    - zrail 5y ago
      Tailscale uses WireGuard under the hood.
- _hyn3 5y ago
  Slack's Nebula: https://github.com/slackhq/nebula https://github.com/slackhq/nebula
  - johntash 5y ago
    Does Nebula use Wireguard? I briefly looked at the readme, but did not see it mentioned.
- api 5y ago
  There are several Wireguard managers, but this isn't an issue with the transport protocol. It's an issue much higher in the stack, and one that requires that planets align in precise ways. Things usually are not broken by breaking encryption. Things are usually broken via bugs in higher-level logic somewhere else. Wireguard is fine, but if the thing deploying and managing and configuring Wireguard happened to be vulnerable then it doesn't matter. This is why you want defense in depth. Don't trust just one layer of security, ever.
api 5y ago
It's trivial to do that with Wireguard or IPSec when you are manually provisioning everything. As soon as you add any kind of UX or discovery layer on top, things get more complex and you are by definition delegating trust. You either trust multiple third parties such some kind of SSO provider, multiple SSL CAs (to secure https), and a configuration service, or you have some kind of cryptographic discovery system with certificates. ZeroTier does the latter, and the certs are issued by something ZeroTier can host or can be self-hosted. > WireGuard, by design, is a fairly simple protocol that requires some other software or out of band configuration The core ZeroTier transport protocol isn't much more complex than Wireguard and is basically the same thing. Then you have the certificates, identities, etc. As you say to make Wireguard useful for large scale or auto configuring networks you have to build something analogous on top of it. Vulnerabilities are almost never in the transport protocol unless you're dealing with some hairy legacy protocol like SSL that has a lot of modes and can be vulnerable to downgrade attacks or unless it's a totally incompetently designed transport that uses cryptography wrong. Vulnerabilities are almost always in higher layers, management layers, authentication code, etc.
atatatat 5y ago
> On an unrelated note, there is a really fun infosec podcast named Darknet Diaries, worth a listen. Are these guys paying people peoples to advertise here?

numpad0 5y ago

I think the intended use case for ZeroTier is six Android phones and two Windows laptops connected to a same L2 with ~500kbps UL/DL, that has to be bulletproof, dumbproof and as close as possible to zero setup and nannying, even with Android phones constantly roaming between a Wi-Fi router in a car and Starbucks Wi-Fi and its own metered WWAN. It's a very specialized solution, not a generic VPN. They do seem to care about security but they also probably prioritize zero setup/maintenance/service restart over it. Like, you can post that two apks and that zip and a ZeroTier key on Discord, let that trusted pseudonymous guy to approve connection requests on ZT, tell people to clear cache and retry if it's not working, and that's all you have to do. WireGuard would take more effort to deal with. dc: No, I've never been involved in that kind of activity, but came across ZT from a different direction it is useful for, and got what the app is about.

op00to 5y ago
What is the actual intended use case, not the implementation details?

hawski 5y ago

For Wireguard mesh networks is there something in the similar level of maturity as Zerotier?

watchdogtimer 5y ago
Tailscale perhaps?
- tyingq 5y ago
  Self-hosting is possible by adding headscale too: https://github.com/juanfont/headscale https://github.com/juanfont/headscale It doesn't have all the features of tailscale hosted server, but they seem to be actively working the list of missing features.
- hawski 5y ago
  AFAIK Tailscale is an alternative to ZeroTier, but it doesn't involve WireGuard. Edit: I was wrong.
  - zrail 5y ago
    Tailscale uses WireGuard under the hood.
_hyn3 5y ago
Slack's Nebula: https://github.com/slackhq/nebula https://github.com/slackhq/nebula
- johntash 5y ago
  Does Nebula use Wireguard? I briefly looked at the readme, but did not see it mentioned.
api 5y ago
There are several Wireguard managers, but this isn't an issue with the transport protocol. It's an issue much higher in the stack, and one that requires that planets align in precise ways. Things usually are not broken by breaking encryption. Things are usually broken via bugs in higher-level logic somewhere else. Wireguard is fine, but if the thing deploying and managing and configuring Wireguard happened to be vulnerable then it doesn't matter. This is why you want defense in depth. Don't trust just one layer of security, ever.

api 5y ago

It's trivial to do that with Wireguard or IPSec when you are manually provisioning everything. As soon as you add any kind of UX or discovery layer on top, things get more complex and you are by definition delegating trust. You either trust multiple third parties such some kind of SSO provider, multiple SSL CAs (to secure https), and a configuration service, or you have some kind of cryptographic discovery system with certificates. ZeroTier does the latter, and the certs are issued by something ZeroTier can host or can be self-hosted. > WireGuard, by design, is a fairly simple protocol that requires some other software or out of band configuration The core ZeroTier transport protocol isn't much more complex than Wireguard and is basically the same thing. Then you have the certificates, identities, etc. As you say to make Wireguard useful for large scale or auto configuring networks you have to build something analogous on top of it. Vulnerabilities are almost never in the transport protocol unless you're dealing with some hairy legacy protocol like SSL that has a lot of modes and can be vulnerable to downgrade attacks or unless it's a totally incompetently designed transport that uses cryptography wrong. Vulnerabilities are almost always in higher layers, management layers, authentication code, etc.

atatatat 5y ago

> On an unrelated note, there is a really fun infosec podcast named Darknet Diaries, worth a listen. Are these guys paying people peoples to advertise here?