I have seen a lot of questions recently regarding the use of PPTP. Since PPTP with most of the common authentication and encryption mechanisms are considered unsecure should we suggest it not be used in favor of another VPN solution such as IPSec, OpenVPN, or something of that nature?
Answers should, at minimum, answer the question. Something that doesn't answer the question should be in a comment, or not posted at all.
Suggesting not to use PPTP (for any reason) belongs in an answer only if PPTP won't actually solve the person's problem, and you're recommending something else because it will solve the problem.
Otherwise, it's best left as a comment, or perhaps as an addendum to an answer that actually answers the question given.
No. There is nothing more frustrating than coming in and asking a question about something, and then having a million voices cry out "Why are you using that? It's shit, it's not worth it" blah blah blah.
If I ask a question about a Windows NT box I have, I don't give a shit that it's out of support, I want someone with a long memory to tell me how to fix my problem, or point me in the right direction. I don't want someone to say "Pft dontchaknow it's out of date? Upgrade it to Windows 2012 Core!"
So if I have a PPTP VPN, there's probably a good reason why I have it. I don't want people to tell me to switch to a VPN that requires additional software (OpenVPN), or a VPN that doesn't work well behind NAT or dynamic IPs (IPSec).
We're here to help people with their problems. Unless "change it" really is a valid answer to their question, let's lay off the preaching.
People use PPTP because it's simple -- but the simple way to configure it is insecure to the point of being pointless. It takes a lot more work to configure PPTP securely, and in certain use cases it may not even be possible at all. Common knowledge on the subject is a little stale, so it's likely that other online resources the user searches will give him insecure advice.
And since, in almost all installations, PPTP fails at its only goal, I would say it wouldn't be a bad idea to mention this. You don't have to be condescending and refuse to answer the question. But you probably should add something like this to the bottom of your answer:
NOTE: All password-based authentications mechanisms for PPTP are broken and insecure. Unless you're authenticating via SSL certificates (both client and server), you should consider PPTP tunnels unencrypted.
Chances are pretty good that this will spark some sort of additional discussion, so a canonical question to point to may be advantageous.
I usually try to answer on SF the same way I do consulting.
Here is the answer to your question, THEN here are my recommendations.
Not answering the question by dodging the subject simply because it makes no sense from your point of view is not very usefull.
As a professional, especially consultant, we are asked to do things that makes no sense but was decided well above our heads. When working in very large corporations, it's a plague.
Sometimes you end up managing software and/or devices that you didn't choose. Sometimes you have to deal with poor architecture that you have no control over.
There are situations where PPTP is the only way to go and the OP, who is the only one in a position to properly know his/her circumstances, may have little or no choice in the matter. It's also not as insecure as some would have us believe. It's not up to us to discourage its use, although I see nothing wrong with a gentle and polite mention that other methods might be preferable.
There are things that I believe we should discourage for well known and documented reasons (e.g. the use of Virtualbox as a server based virtualisation layer) but as far as I'm concerned PPTP isn't anywhere near being on that list.
In regard to PPT's security, which has been demonstrated only in lab conditions, you need to consider just what would be involved in someone compromising the connection. In the real world the right set of circumstance and conditions, coupled with someone who has the skill and tools to break it, are downright mythical. In short, PPTP is more than safe enough for nearly all purposes.