Hacker News Reader

Comment by yardstick | Hacker News Reader

The problem is lots of organisations in the financial and medical worlds need 2FA. WireGuard needs a 2FA solution - It doesn’t have to be kernel based - but it does need to protect against someone grabbing a copy of the single factor auth in WireGuard (keypair). A solution that rotates/manages/provisions/etc these keypairs is still fundamentally single factor auth of the tunnel.

View on HN

> WireGuard needs a 2FA solution - It doesn’t have to be kernel based - but it does need to protect against someone grabbing a copy of the single factor auth in WireGuard (keypair).

By this standard, no website supports 2FA- ultimately it's just a cookie that's used to authenticate requests, even though to get that cookie you may have to go through 2FA. Nothing prevents an attacker from just grabbing the session cookies.

In fact, I doubt any VPN supports 2FA by this definition- it would mean requiring authentication on every packet. Instead, of course, what you do is do authentication once, when setting up a tunnel, and then use bearer tokens from then on.

The session info in a browser is not persisted on disk as a long term config file that’s easy to copy and duplicate. Having a session key only ever exist in memory is completely different to storing WireGuard keys on a filesystem.

Edit: Also OpenVPN, which is the tool I’m comparing it with, only ever has session keys in memory. The 2FA part (password+OTP) isn’t saved by OpenVPN.

Typical session tokens shouldn't be valid for days, months or even years, unlike a straightforward wireguard setup.

Nobody is arguing that there shouldn't be IdP-based WireGuard management systems. The point is that they are out of scope for the WireGuard project itself. WireGuard has an extremely straightforward configuration interface; if Okta wanted to manage WireGuard, they'd likely have no problem doing it.

Is there any decent open source 2FA / IdP management systems at the moment that work with WireGuard?

It has just landed in one distro. If there isn't yet, there certainly will be.

You don’t need a distro for this, and WireGuard has been available and in use for several years. So in that time has anyone developed a practical 2FA solution that is compatible with it?

People have. I'm unaware of any published. It's not hard. Implementing a new IdP-integrated WireGuard authorizer is probably easier than understanding IPSEC or OpenVPN in sufficient detail to secure it.

There are some attempts like subspace: https://github.com/subspacecloud/subspace but I have not found anything stable yet.

Reply on news.ycombinator.com