Peter Membrey

Quantum computing poses an immediate threat to VPN infrastructure through the "harvest now, decrypt later" attack model, where adversaries collect encrypted traffic today for future decryption with quantum computers. While existing VPN protocols await formal post-quantum standardization, practical protection is needed now. This paper presents a deployable solution for adding post-quantum security to WireGuard without modifying the protocol itself. Our approach leverages WireGuard's existing pre-shared key (PSK) mechanism, delivering quantum-resistant PSKs over channels protected by ML-KEM hybrid TLS 1.3. Through a carefully designed split-service architecture separating authentication from configuration management, we achieve both cryptographic and operational benefits. The authentication service handles client connections using post-quantum TLS, while the configuration service manages WireGuard settings with no direct network exposure, providing defense in depth. This architecture has been successfully deployed across ExpressVPN's global infrastructure, demonstrating its practicality at scale. The solution provides immediate quantum resistance with minimal performance impact (15-20ms additional connection establishment time, no impact on steady-state throughput), supports dynamic IP allocation and simplified key management, and can be implemented by engineering teams without deep cryptographic expertise. We provide detailed implementation guidance for deployments ranging from small (<1,000 users) to enterprise scale. Our work demonstrates that post-quantum WireGuard is achievable today using proven technologies and sound engineering principles, offering VPN providers a straightforward migration path to quantum resistance without abandoning existing WireGuard deployments.

Although the assigning of new IP addresses is central to the VPN experience, the way in which these addresses are traditionally managed doesn’t suit everyone. Rotating IP addresses can lead to frequent authentication challenges, unreliable access to geo-restricted services, and increased exposure to tracking and security breaches. These issues highlight the need for alternative solutions for users who require a static IP address, while still maintaining a high level of privacy and security. ExpressVPN’s Dedicated IP (DIP) solution solves these problems with technologies designed to enhance user privacy and security, without compromising on convenience. ExpressVPN’s DIP service assigns a unique IP address exclusively to a single user, providing a consistent online identity that is not shared with other users, while maintaining the user’s privacy. DIP offers secure logins and seamless access to IP address-sensitive sites and reduces the frequency of verification challenges.

In this paper, we introduce a novel categorization of DNS leaks into Type 1 and Type 2, underscoring the privacy and security risks these pose to VPN users. A critical examination reveals how Stealth DNS servers, by remaining hidden from traditional DNS leak detection tools, contribute to a false sense of security, particularly with Type 2 leaks. We then highlight the challenges associated with detecting such leaks. The paper also explores proposed mitigations and best practices for VPN providers, emphasizing server-side protections and the strategic whitelisting of DNS servers to enhance online privacy and security.