Hacker News Reader

Comment by j3th9n | Hacker News Reader

This comment thread is for people who don't think IPSec/IKEv2 is the worst invention on the planet and want to share life saving stories about it. This will inevitably be downvoted, but (almost) everytime I see IPSec/IKEv2 mentioned there's a bunch of people puking all over it. Of course, it has a lot of options and configurations and you can fu*k things up, you have to study it a bit, like a brain surgeon has to read some books and do some practice. But once done that, it is a beautiful piece of protocol, excuse my language. It's fast, stable, it auto-reconnects, not to mention MOBIKE, it is simply state-of-the-art. I guess not everybody can drive the Formula 1 car of the VPN protocols. ;-o

View on HN

It’s like a dishwasher where most of the buttons cause it to not wash your dishes at all and some just break your dishes entirely.

A VPN protocol shouldn’t be a kit of parts that might be able to make a secure tunnel. It should only be able to be used correctly.

IPSec/IKEv2 is not breaking anything, maybe it just won't setup a tunnel. Maybe a better analogy: We don't say the same thing about for example a piano: "it should only be able to be used correctly". You have to study and practice a bit before you can play a somewhat decent piece, without study no piano play. The same for IPSec/IKEv2, without study no tunnel. Every VPN protocol needs a bit of study, maybe some protocol a bit more than the other. We have a Dutch saying: "Als een boer niet kan zwemmen ligt het aan zijn zwembroek", which translates to something like: "If a farmer can't swim it's because of his swimming trunks". If you want out-of-the-box VPN solutions, you go to a VPN provider and download their apps. ;-o

But there's no value in IPsec being like a piano. Continuing the analogue, nearly everyone would be playing the exact same handful of songs in the exact same way and if they don't, they're doing it wrong. Why on earth do you have to learn to play an instrument like that?

You don't want core pieces of security technology to have room for creativity.

Yes, I guess the analogy has its limits. (-: The only point I'm trying to make is that no VPN protocol is an out-of-the-box solution. And mind you, I'm talking about the protocol, the out of the box solution "Tailscale" is not a protocol for example, it's an app with WireGuard at its core with added proprietary functionality to make it work out-of-the-box. WireGuard as a protocol is possibly the easiest to setup, IPSec/IKEv2 might be the most challenging to setup. On the other hand WireGuard has limited capabilities, IPSec/IKEv2 has a bit more. More capabilities for IPSec/IKEv2 comes with more study and practice.

> IPSec/IKEv2 is not breaking anything,

Yes it does. It’s trivial to screw up the configuration into broken security.

Then it's you breaking things because of lack of understanding, not IPSec/IKEv2. The same way no dishwasher is going to break plates, unless you throw them in with force yourself.

Okay, how about a different analogy then. Seatbelts.

Wireguard is a seatbelt where you plug the latch plate into the buckle, it lets out an audible "click" and you're secured. If you fail to secure it properly, the latch plate will not be held by the buckle and will retract. It will be immediately obvious that you aren't secured and the car will refuse to move until the problem is resolved.

IPSec is a seatbelt where the process of putting the latch plate into the buckle requires adjusting several knobs on the buckle to the correct setting depending on your specific size and weight and then placing the latch plate into the buckle at the _exact_ right angle. The settings of these knobs and the angle required differs slightly or significantly between manufacturers as well as model years.

With the IPSec seatbelt, failing to perform these steps correctly often results in the buckle failing to engage and the car failing to start. But sometimes it also results in the buckle letting out a "click" and appearing to be latched while not being properly engaged and able to protect you in a crash. This counts as buckled as far as the car is concerned though and it's happy to let you drive this way.

Well what if I _want_ to drive around with only the appearance of a seatbelt without the safety of it, huh? Wireguard won't let me do that!

Sure, there are _very_ specific situations where IPSec is the only option to implement what we need. Great, I'm glad it exists to cover off those use cases.

But when everyone's getting the common case wrong in subtle and dangerous ways, the answer isn't "well, it's as complicated as brain surgery get good scrub" (I can't imagine how you think that's a defense of IPSec.). It's possible to design a system that allows a secure tunnel _without_ the complexity and massive number of footguns (see: wireguard). For most use cases, that makes IPSec defective by design.

If GM designed their cars to have as many buttons and knobs as a 747 cockpit, they would never make it to market. Manufacturers have been forced to recall vehicles for much less[0].

By all means, continue to use it, but expecting people to learn brain surgery to set up a secure tunnel is and should be a non-starter.

[0] https://www.consumerreports.org/car-safety/fca-recalls-confu...

You missed the point. It shouldn’t be so easy to configure it incorrectly so it breaks security. A dishwasher shouldn’t have buttons that combine to break your dishes.

Your defense of “you don’t understand it” is exactly the problem. That’s an argument in support of my point, not against it.

Why study something outdated when there is a newer, modern and a lot more sane alternative out there?

I can understand if you now have years worth of expertise you are invested in defending. It's selfish, but I understand your position. For anyone else? Suggesting they invest in IPSec vs. something more modern is just nuts.

Why follow the charted map when the beautiful mermaids sing the praise of a better newer shortcut? :p

Ok, you're not the first one blaming me for defending or gatekeeping, even calling me selfish, so I guess I need to clarify myself a bit: I love WireGuard, Tailscale does a great job making it even more "user" friendly and I'm nowhere suggesting to invest in IPSec instead of something "modern" (or do you mean something invented not longer than 3 years ago?). You're missing my point, putting words in my mouth and you seem to not know what you're talking about if you think for example WireGuard is an alternative for IPSec/IKEv2, because in a lot of cases it's not. You're even calling IPSec/IKEv2 outdated. There's a difference between the protocol and the configured crypto algorithms. If the configured algorithm is outdated, configure a modern one. If that's not possible in your device supporting IPSec/IKEv2, vote with your money and don't buy from that manufacturer. Don't blame IPSec/IKEv2 for it.

The protocol is outdated, because its design is based on ideas we now consider to be mistakes.

Unless there is an alternative it can't be outdated, per definition. WireGuard is not an alternative in many cases. But I get your point, it might have design mistakes (or implementations we would have done different today, while I think you are talking about IKEv1, not IKEv2), but no IPSec/IKEv2 server is left open for scriptkiddies to break, it's receiving updates when bugs are found and in this sense not outdated too. Unless you're using outdated crypto algorithms, but that's up to you. The NSA possibly has capabilities to break IPSec/IKEv2 anytime they want, but that's something we don't know about WireGuard either. If that's the case with WireGuard, it has design flaws too or bugs which aren't found yet. It's better to know about a design flaw and mitigate against it, then not knowing about it and not being able to mitigate against it.

This sounds like network security gatekeeping to me. Tailscale and others are trying to make things easier for most people while preserving high security. This is a noble effort IMO.

I had other intentions with my comment than what you insinuate.

I mean, the exact opposite is also true? The Wireguard camp is always essentially claiming that everyone not using Wireguard is incompetent and should feel bad for not understanding how it is better, and this post to me felt like "let's make some space for people to say something good about IPsec actually solving a problem for them".

IPSec is based on tens of RFCs with optional features (such as dpd in IKEv1) and more knobs than a boeing 747 cockpit. You get companies as big as AT&T setting up IKEv1 with pre-shared keys and weak crypto in 2021 by default as that’s their template offering for site-to-sites.

BUT the interoperability (when it works) and the native stack implementations (Android, iOS, Windows, MacOS) though nice for admins, is only owing to it’s prevalence in enterprise rather than any superiority as a standard.

So who is to blame? AT&T for incompetence while implementing the old IKEv1 version, or IPSec/IKEv2 for apparently not being able to be attractive enough for AT&T?

I'm using IPSec for my homelab/roadwarrior setup, and that's explicitly because Linux, macOS, and iOS can all use it right out of the box without any "apps" to install.

The only gripe I have is that StrongSwan is not a particularly easy piece of software to set up and debug when your tunnels suddenly go pear-shaped. I'd say they are a textbook example on how to screw things up when introducing a whole new set of daemons and configuration format, while a multi-year body of knowledge and corner cases exists only for the old format.

Reply on news.ycombinator.com