Windscribe (VPN Service)

[mangomango]

@nym-product

NymVPN only has client-side AmneziaWG implementation.

What does having client-side or server-side AmneziaWG support entail ?

[ignoramous]

@nhyg

“A CDN is not a ‘reverse proxy’. Windscribe is using Cloudflare as a CDN, not a ‘reverse proxy’.

If ty89’s analysis (above) is correct, this is a misleading statement (hopefully, not made in an official capacity?)

@ty89

They should stop leaking user account credentials and generated Wireguard encryption keys to Cloudflare before being considered to be recommended.

I looked through their codebases, and I see 2 kinds of credentials: OpenVPN and WireGuard.

The former is kind of a like a pre-shared auth.

With the latter, what I’ve found is: The clients generate the private key on their own (and from my review) they don’t send it to Windscribe’s API endpoints (which you say are proxied via Cloudflare). Only the corresponding public key is sent (android, ios, desktop).

What you’re saying is, when the client doesn’t generate the credential/keypair (the browser config generator?), only then is it generated server-side (proxied behind Cloudflare)? Sounds more like a usability thing to me. That said, it is possible to generate credentials for WireGuard right in the browser (literally 4 lines of code).^[1] Can you point to the code you’re seeing that does what you claim (you can consider using archive.is or equivalent to link to the javascript file, if possible)?

---

1. downloads/src/warp.js at 0c1d783ba7dda9b9392ad0abb3a401c720930423 · celzero/downloads · GitHub ↩︎

[ty89]

@ignoramous

What you’re saying is, when the client doesn’t generate the credential/keypair (the browser config generator?), only then is it generated server-side (proxied behind Cloudflare)? Sounds more like a usability thing to me. That said, it is possible to generate credentials for WireGuard right in the browser (literally 4 lines of code). Can you point to the code you’re seeing that does what you claim (you can consider using archive.is or equivalent to link to the javascript file, if possible)?

Users preferring plain Wireguard client instead of the app have to generate the config via website. Wireguard config was being generated server-side and downloaded through Cloudflare when I looked into this a few months ago. The page for config generation is only acessible for paid accounts, however any paying user can verify this using their browser’s network inspector.
Interestingly, after generating that config I didn’t see a way to delete it for the purpose of revoking that private key.

[ignoramous]

Thanks.

@ty89

however any paying user can verify this using their browser’s network inspector.

Since your analysis is a “few months old”, are you in a position to run this flow anew or grab hold of the client-side javascript file?

Like I said above, the generation of keys server-side by Windscribe seems like a usability thing to me. The keypair for WireGuard can be generated in the web browser, but I guess Windscribe may have reasons to not trust the web browser (bots, automation etc) for key generation and enrollment.

[mangomango]

@ty89

Interestingly, after generating that config I didn’t see a way to delete it for the purpose of revoking that private key

You can delete your VPN credentials in your account settings.

If you have a doubt about one of your connection.

“This will delete all generated VPN credentials and all static IP devices and port forwards (if you have any).”