Kill-switches are a misnomer. What you really want is a firewall external from your "target" system that blackholes all traffic not to the VPN gateways IP address. Than make sure packets traveling the parent interface are ONLY VPN traffic or nothing in case of the tunnel dropping (wireshark is good here.)
Are killswitches actually fast enough? Serious question, I don’t know much/anything about networking internals.
I never trust killswitches and when I want to ensure I don’t leak anything, I bind to the VPN interface instead, but I don’t know if that actually gives better security?
I've never used surfshark myself but they advertise as having a killswitch inlcluded in their VPN [0] so it sounds like in this case, it definitely failed.
Just setup your routes/firewall so that the only possible way traffic can leave your machine is via the VPN device. VPN dies? no traffic going anywhere. Pretty much networking 101 stuff.
That should be the same when bound to an interface, shouldn’t it?
Speed should not be a problem and hardware solution should not have to be a better solution, ideally. Shame that has to be brought up still.
That sounds like a race condition that gives you a false sense of security. It only takes one leaked packet…