Hacker News Reader

Comment by zx2c4 | Hacker News Reader

It might still take some time to show up in search, but if you visit https://itunes.apple.com/us/app/wireguard/id1441195209?ls=1&... on iOS, it should take you to the right place in the App Store.

View on HN

Any plans for 2FA/MFA? A lot of businesses these days prefer or even require it for remote access. That would then make WireGuard a good alternative to OpenVPN in those environments.

That is something that would be built on top of WireGuard. I think some people are working on such projects, but the whole point of WireGuard "core" is that it's incredibly minimal in what it does.

I for one applaud that. Strongswan and OpenVPN both have so much legacy cruft it's hard to make sure the VPN is secure - that the OSs implementation isn't incredibly out-of-date and I haven't made grave configuration mistakes, not even talking about how much harder Strongswan is to configure compared to Wireguard.

I could see the server side effectively operating like a public wifi hotspot and force all routing to a disclaimer type page.

Then you could implement the 2FA there (or even proper username/password logins, which seems weird for WireGuard). If you enter the correct 2FA code, then your IP is no longer blocked.

I know phones (and computers) can handle this when connecting to a new WiFi SSID, but do they also run their check when connecting over VPN? I might have to try that.

I can confirm automatic captive portals work on most wired devices. Those that don't will have to go to http://example.com or similar to be redirected. Word of warning for anyone that implements this: your DNS portal needs to be internal and captive as well.

You could write a web portal that generate the wireguard configs on the server and offers the user the client config as a download.

The portal then can hook upto to SAML / OIDC endpoint, use claims / groups / roles to offer specific profile configurations and you treat the keys in the configs as temporary tokens, as you attach an empiry time to the profile such as 8 hours, so your devs need to download a new configuration every day.

I have a portal that does this for openvpn:

https://github.com/secureweb/openvpn-portal

The code quality isn't great as it's my hello world golang project, but I think the idea is fairly sound.

You maintain pass to? Damn, thanks for your hard work on both!

He's the original author (not just maintainer).

Awesome! Thanks for the hard work! I’ll give this a go and submit a bug report if I find an issue :-)

I couldn’t find the reasoning behind using Go for the “API”, would you mind sharing some thoughts on the subject?

I believe another contributor wrote a Go user-space implementation and Jason decided to build off that for the PC user-space implementations and Android and iOS. So basically, because it was there.

Reply on news.ycombinator.com