Hacker News Reader

Comment by Double_a_92 | Hacker News Reader

They help in public WiFi.

Public wifi, assuming you don't send any personal info to "sign in" to the public wifi is more anonymous than a vpn that has your name/address/etc.

Modern TLS is enough to prevent others from eavesdropping everything except domain names when on public WiFi. Domain names are sent in clear text if your client supports SNI.

A trail of DNS names is more than enough to know what somebody is up to.

You could use DoH, which you should do anyway. No reason to leak DNS lookups to anyone.

DoH alone is not enough due to https://en.wikipedia.org/wiki/Server_Name_Indication being sent in plain text. Some day ECH (formerly, eSNI) should help with that.

I thought TLSv1.3 already encrypted the SNI?

It does

ESNI is not implemented yet on any website. And there is no software support except beta versions of Chrome/Edge and you have to manually toggle flags in dev mode.

All SNIs are passed as plain text to your ISP/VPN, even with DoH/TLS secure DNS enabled.

No. ESNI is an later-created extension to TLS 1.3

you'll always be leaking it to whoever you are sending your query to.

So I can pay $10/mo for a VPN for use when I'm on public wifi, or I can run WireGuard on my Raspberry Pi at home and get one for free

It might be cheaper but still not free. Cost of electricity + time to maintain + Raspberry Pi itself. Not to mention that you don't get the variety of servers (for geo-location or more diverse networks not tracked to you by websites themselves).

Well the Raspberry Pi is already on 24/7 running a few other services for my home network. But even then, the energy consumption per month costs pennies. I update the device once a quarter and it takes me 5 minutes. These costs are so negligible as to have no impact on my decision making process.

Unless you are a network security expert, aren't you greatly increasing your risk by running that WireGuard server?

WireGuard is pretty minimalist and has great defaults, AFAIK if you manage to set it up you're good.

Unless your credentials leak, of course, but a security expert would have that same risk.

Why would you? Nobody can connect to it without your private key. Or is there something I am not aware of? Genuine question, as I am running wireguard in a few places and thought it was secure by default.

You do not need to be a "network security expert" to safely run a WireGuard server

Not sure what services you’ve looked at, but it definitely doesn’t cost $10/month.

Your personal solution seems pretty good though.

Reply on news.ycombinator.com