Hacker News Reader

I think this would nerf wireguard similarly to how a "null" encryption effectively nerfed IPSec. Fine for a specific use case (debugging comes to mind) but should never be upstreamed imho.

View on HN

That's not the case at all. The security here is more like HTTPS/TLS with the client not really being validated (just the server). The encryption remains just as strong as if the peers we're locked down.

It's different than the VPN use case where you absolutely want to lock down access to known peers.

I don't see the contradiction here.

There's still confidentiality (encrypted transport) and authenticity of the server, how is that the same as null'd ipsec?

You missed the point.

Reply on news.ycombinator.com