Using public commercial VPN providers for serious security/privacy is a very bad idea. Get someone to set up Trail of Bits "Algo" for you (or do it yourself, if you're comfortable with Ansible).
Looking at Algo (https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-th...), it seems like it provides an easy way to setup a (secure) VPN on a piece of hardware you own or one of the supported public clouds. In that respect, I'm not sure if it gives a lot of privacy. As you're the only one using that VPN, the traffic may not be too hard to trace back to you.
It sounds like you're attempting to gain anonymity, not privacy. Any VPN only offers limited anonymity, since that is not their purpose. If you want robust anonymity, you need to use something like Tor.
Algo isn't that much better than any other VPN - arguably it's slightly better security wise, though I'd argue Wireguard tops it by far on cipher choices and security margins.
Ultimately VPNs just aren't for hiding anything that could cause you significant problems. If you want that, Tor, i2p, or piles of hacked boxes are your only options really if you must interact with the clearnet.
I don't know anyone working in the field who believes Wireguard is likely to be less secure than StrongSwan or OpenVPN, and Wireguard is something that gets talked about a lot.
It's early days for Wireguard, to be sure, but it's one of the most promising security projects there is right now.
I work in the field and anybody that says that a piece of software is secure before it has even had a security evaluation by a third party does not know what they are talking about.
I think what you have seen is security people saying that the design of Wireguard seems to be equal or better than other, current, options, that doesn't mean that the implementation is just yet.
I've spent my career doing third-party software security evaluations --- among other things, I founded the NCC Cryptography Services practice --- and I will tell you right now that the Wireguard security story is far more compelling than any third-party audit.
It's not simply the protocol design, which is superior in pretty much every conceivable way to IKE or TLS, but also the code, which is carefully written to minimize attack surface and increase reviewability.
Choosing OpenVPN or StrongSWAN over WireGuard to minimize exposure to vulnerabilities would be a dumb bet. Sometimes dumb bets pay off, but it's still dumb to make them.
I agree with you. It needs formal evaluation by pros with time to dig into it with review and tool-assisted analysis. That said, a person as experienced at pentesting as tptacek saying the crypto and code looked good puts its trustworthiness above most options in my eyes. I mean, you rarely here good things about both in such software. The quality of average development in crypto is just that bad. I also liked what I saw when I looked at it in terms of simplicity.
I only know Thomas via his output, but will say that based on it, he very much knows what he is talking about when it comes to the design and implementation of security protocols.
I installed algo a couple of weeks ago on a server behind an external firewall. I managed to make it work by opening ports 500 and 4500. Maybe that works for you, too.
By the way, is it possible to have all hosts connected to reach each other, as in a lan?
What would people think of a VPN service that builds it for you, then hands over control when done? E.g., it walks you through setting up a DO droplet, uses keys to install a VPN, then prompts you to change the keys so it can't access the server? Think there's a market for that?
I wondered about creating something very like that a couple of months ago. Check out my vapourware! http://digitalsnorkel.net/
I think a key problem may be that there aren't a whole lot of people who (a) understand the tech well enough to know they need this, and (b) don't understand the tech well enough to spin up a VPS and run a Bash script.
To be clear, I was thinking about the less-technically-sophisticated-than-HN crowd. E.g., is there a market for the people who would typically purchase VPN services, don't want to trust a VPN company, but don't know how to setup a cloud server?
Hmm, it depends on your threat model. If you're being targeted by a three-letter agency, then no (of course, you need something more secure than a VPN at that point, anyway). But if you're not singled out, your own VPS is much less likely to be passively surveilled than if it's part of a known VPN IP block.