Timeline for Should we discourage the use of PPTP
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 21, 2013 at 23:52 | comment | added | John Gardeniers | @tylerl, no, that's not real world. Real world is where it happens to someone without their knowledge or permission in a non-lab situation. Using that tool on myself is a lab situation, which is my entire point. | |
| Jan 21, 2013 at 23:45 | comment | added | tylerl | @JohnGardeniers Here's a tool called chapcrack which will decrypt your PPTP session and hand you back the unencrypted packet capture. Is that real-world enough for you? The only thing between an attacker and your private communication is him caring enough to actually want it. | |
| Jan 21, 2013 at 20:29 | comment | added | John Gardeniers | @tylerl, have you ever known of a single real world instance of PPTP being compromised? If you have you're the only person I know who has. | |
| Jan 21, 2013 at 18:27 | comment | added | tylerl | It's also not as insecure as some would have us believe. There are always some who overestimate risk. But PPTP is far less secure than most people think it is. Yes, you can configure it to be secure, but few people do. I have yet to encounter even one secure PPTP installation, even though it's the most common "VPN" technology companies offer. | |
| Jan 21, 2013 at 18:20 | comment | added | tylerl | You're assuming that anyone who asks about using PPTP on SF knows the risks, knows the options, and has chosen PPTP with full understanding of all factors involved. This does not describe the average person who asks questions on SF. | |
| Jan 21, 2013 at 9:43 | comment | added | John Gardeniers | No, that could never have been said for telnet because it's a clear text protocol designed strictly for use within a closed and private network. There is absolutely no comparison. | |
| Jan 21, 2013 at 9:23 | comment | added | the-wabbit |
In short, PPTP is more than safe enough for nearly all purposes - you could state that for telnet as well, nevertheless hardly anyone would advocate its use over SSH due to the simple reason that the risk is not the only part of the calculation, you have to factor in the impact as well. If you deliberately decided to do encryption because communications are supposed to be secret, you should not settle for a protocol which is known to be broken.
|
|
| Jan 21, 2013 at 7:56 | history | answered | John Gardeniers | CC BY-SA 3.0 |