#SETTING UP STUNNEL WITH PSK CODE#

Which is more secure, WPA-PSK or WPA2-PSK?.

Different WPA2-PSK security options based on the use of encryption method.

Evolution of Wireless Network Security Protocol.

If an attacker doesn't have the key, they can't force you to burn any significant amount of CPU time. In SSL, you go through a complicated handshake before you can decide that the client you're talking to doesn't have the right keys in spiped, you exchange 256-bit nonces, and then if the very next buffer you read doesn't have right right HMAC, the connection is dropped. That's where almost all the vulnerabilities happen. Having a simple secure pipe tool will save me far more time than that, once you count things like wanting to programmatically set up encrypted pipes (for which spiped's command line and arbitrary key is much better than stunnel's configuration file and SSL certificates).Įffectively it only really differs in connection setupĪnd connection setup is a big deal.

#SETTING UP STUNNEL WITH PSK CODE#

Almost everything under /lib/ I had already written as part of tarsnap or kivaloo I spent maybe 10 hours making minor tweaks and cleanups to that code (which will be useful when I next use the library code anyway) and somewhere around 40 hours figuring out the protocol and writing the spiped specific code.

I just wonder why someone'd go to the effort PS: His project is the first time I've encountered the use of gotos resulting in _cleaner_ code than without them. stunnel/TLS's certs-on-both-ends method, but effectively it only really differs in connection setup, as TLS (the way I understand it to be generally used) does symmetric crypto for the payload data anyway (after key setup). His code is good - I just wonder why someone'd go to the effort (which is much higher than most other programming projects, due to the consequences of a bug) when we already have well-worn codebases for stuff /almost/ exactly like this, considering the tightrope-of-vigilance that is correctly implementing crypto protocols. That's enough to effectively cull a lot of the noise that gets posted here. As I mentioned I only looked for five minutes, but I looked for really basic general programming errors, low-hanging fruit kind of stuff. Most of the time when someone posts a 'look what I just implemented in C' to HN it's, well, not great. You will end up in some coffee shop that reserves the whole /16 for itself when all it needs is some random /8, and then nothing works.)ĭidn't know that, I'd never heard of him before (I haven't run BSD in years, and when I did it wasn't FreeBSD). (Oh, and if you do this yourself, don't use anything in 10.0.0.0/16 for your internal network VPN or otherwise. This ends up being much less of a pain than the other setup, scales to many more services, and lets me do cool things like ssh-ing to my phone when it's on Sprint's network and my laptop is on a cafe's network. The result is that I can bind irssi-proxy to the 10.0.42.0 interface and then directly connect from any other machine on my network. I run a server on one of my hosts, and then the other networks I control connect to that and share their networks.

And, with two transport layers, my irc client would disconnect if the irc connection failed or if the ssh connection failed. This involved several steps: binding the proxy to 127.0.0.1, and then sshing in from my desktop and forwarding the ports. I used to use ssh tunnels for tunneling irc from irssi-proxy to my local machine (since I don't trust irssi's authentication around the proxy).

Setting up stunnel with psk