4

I have seen a lot of questions recently regarding the use of PPTP. Since PPTP with most of the common authentication and encryption mechanisms are considered unsecure should we suggest it not be used in favor of another VPN solution such as IPSec, OpenVPN, or something of that nature?

8 Answers 8

Reset to default
10

Answers should, at minimum, answer the question. Something that doesn't answer the question should be in a comment, or not posted at all.

Suggesting not to use PPTP (for any reason) belongs in an answer only if PPTP won't actually solve the person's problem, and you're recommending something else because it will solve the problem.

Otherwise, it's best left as a comment, or perhaps as an addendum to an answer that actually answers the question given.

3
  • That seems like a run-on sentence but I can't quite tell and sometimes I'm wrong about these things but they also tend to be hard to understand on account of the mental diarrhea effect so getting a coherent message or understanding can be a challenge.
    – Chris S Mod
    Commented Jan 21, 2013 at 4:13
  • I guess I was thinking more along the lines of a crazy solution to a problem. (see TomTom Cell Phone as a Server) Just wasn't sure if PPTP was at the same level of craziness given its inherent security issues.
    – Brent Pabst
    Commented Jan 21, 2013 at 7:33
  • 4
    I wouldn't hesitate to warn somebody of security problems with PPTP, but if it isn't an answer to their question, or at least attached to an answer, it shouldn't be posted as such. (Though, sometimes, it is the answer.)
    – Michael Hampton
    Commented Jan 21, 2013 at 7:37
9

Here's how you do it with PPTP:

[...]

By the way, PPTP is pretty insecure, so if you care at all about the security of your VPN connection, you'll probably want to replace your PPTP VPN with [blah].

7

No. There is nothing more frustrating than coming in and asking a question about something, and then having a million voices cry out "Why are you using that? It's shit, it's not worth it" blah blah blah.

If I ask a question about a Windows NT box I have, I don't give a shit that it's out of support, I want someone with a long memory to tell me how to fix my problem, or point me in the right direction. I don't want someone to say "Pft dontchaknow it's out of date? Upgrade it to Windows 2012 Core!"

So if I have a PPTP VPN, there's probably a good reason why I have it. I don't want people to tell me to switch to a VPN that requires additional software (OpenVPN), or a VPN that doesn't work well behind NAT or dynamic IPs (IPSec).

We're here to help people with their problems. Unless "change it" really is a valid answer to their question, let's lay off the preaching.

7
  • 1
    It's all fine if you know about the implications of doing something, be it to run an old NT4 box or setting up a PPTP VPN. Unfortunately, many people that come here don't and in these cases, adding some background is a good thing, IMHO.
    – Sven
    Commented Jan 21, 2013 at 4:06
  • That said, the issues around PPTP are somewhat special as many of the clueless won't understand the problem anyway and also it's debatable if it is an actual problem for the person who wants to establish it. If your goal is to get around YouTubes or Netflix' country ban, it's not going to be an isssue, but if you want to protect your trade secrets from someone, it really is.
    – Sven
    Commented Jan 21, 2013 at 4:10
  • 1
    +1 For "No", PPTP is just as secure as IPSec as any of the others. Just because people do stupid things with it doesn't mean it's inherently bad. Almost -1 for the NT bit; way out of support software shouldn't be used in a production environment unless you're asking how to upgrade off of it. You're analogy is about as good as most car analogies, just like an AMC Gremlin.
    – Chris S Mod
    Commented Jan 21, 2013 at 4:11
  • 1
    @ChrisS - the NT one seemed poignant as I found out the other week that my major grocery chain still uses it on their brand new checkouts.
    – Mark Henderson Mod
    Commented Jan 21, 2013 at 4:46
  • 2
    @ChrisS It's not that people do stupid things with it; it's that people don't know that they have to manually set up a complex authentication scheme to gain any modicum of security with it. That's not really a recipe for success.
    – tylerl
    Commented Jan 21, 2013 at 5:13
  • @tylerl It doesn't have to be a complex authentication scheme, and most people should naturally think that v2 is somehow better than the original. I think most people, even here at SF, don't actually understand the security problems (or potential therefor) with PPTP. Also, configuring IPSec for no encryption and no authentication is easier than configuring encryption and authentication.... So your same argument works for the main alternative.
    – Chris S Mod
    Commented Jan 21, 2013 at 22:03
  • 2
    @ChrisS The only remaining supported auth scheme for PPTP that can't be brute-forced in 20 minutes or less is the one that requires you to authenticate using x509 certificates. "Complex" is a matter of opinion, but for the average user it's pretty complex.
    – tylerl
    Commented Jan 21, 2013 at 23:33
7

People use PPTP because it's simple -- but the simple way to configure it is insecure to the point of being pointless. It takes a lot more work to configure PPTP securely, and in certain use cases it may not even be possible at all. Common knowledge on the subject is a little stale, so it's likely that other online resources the user searches will give him insecure advice.

And since, in almost all installations, PPTP fails at its only goal, I would say it wouldn't be a bad idea to mention this. You don't have to be condescending and refuse to answer the question. But you probably should add something like this to the bottom of your answer:

NOTE: All password-based authentications mechanisms for PPTP are broken and insecure. Unless you're authenticating via SSL certificates (both client and server), you should consider PPTP tunnels unencrypted.

Chances are pretty good that this will spark some sort of additional discussion, so a canonical question to point to may be advantageous.

5
  • 1
    I agree with the majority if your statement, but I take issue with the statement PPTP fails at its only goal - PPTP is Point to Point Tunneling Protocol, and at creating a Point to Point tunnel it succeeds just fine, and that is its primary goal. It's not called "Point to Point Super-Encrypted Uncrackable Tunneling Protocol"
    – Mark Henderson Mod
    Commented Jan 21, 2013 at 5:14
  • @MarkHenderson -- You intentionally left out "in almost all installations", while I intentionally put it in there. How many people implement PPTP just for the tunneling and not the encryption? Really?
    – tylerl
    Commented Jan 21, 2013 at 5:22
  • I would say plenty. From what I can tell, most people use their PPTP tunnels for connecting remote sites together (who would have thought?) - if you were just after P2P encryption then they are doing it wrong, then yes, they're totally wrong and batshit crazy to be using PPTP. But I don't think people use PPTP for encryption, they use it for tunelling.
    – Mark Henderson Mod
    Commented Jan 21, 2013 at 5:32
  • 1
    @MarkHenderson - so agreed that if anyone suggests that they're using PPTP for encryption, then a warning is in order.
    – tylerl
    Commented Jan 21, 2013 at 7:40
  • 1
    Yes, that I can get behind.
    – Mark Henderson Mod
    Commented Jan 21, 2013 at 8:22
6

First answer the question - that's our mission. If you wish to proselytize having answered the question then fine.

3

I usually try to answer on SF the same way I do consulting.

Here is the answer to your question, THEN here are my recommendations.

Not answering the question by dodging the subject simply because it makes no sense from your point of view is not very usefull.

As a professional, especially consultant, we are asked to do things that makes no sense but was decided well above our heads. When working in very large corporations, it's a plague.

Sometimes you end up managing software and/or devices that you didn't choose. Sometimes you have to deal with poor architecture that you have no control over.

2

There are situations where PPTP is the only way to go and the OP, who is the only one in a position to properly know his/her circumstances, may have little or no choice in the matter. It's also not as insecure as some would have us believe. It's not up to us to discourage its use, although I see nothing wrong with a gentle and polite mention that other methods might be preferable.

There are things that I believe we should discourage for well known and documented reasons (e.g. the use of Virtualbox as a server based virtualisation layer) but as far as I'm concerned PPTP isn't anywhere near being on that list.

In regard to PPT's security, which has been demonstrated only in lab conditions, you need to consider just what would be involved in someone compromising the connection. In the real world the right set of circumstance and conditions, coupled with someone who has the skill and tools to break it, are downright mythical. In short, PPTP is more than safe enough for nearly all purposes.

7
  • 1
    In short, PPTP is more than safe enough for nearly all purposes - you could state that for telnet as well, nevertheless hardly anyone would advocate its use over SSH due to the simple reason that the risk is not the only part of the calculation, you have to factor in the impact as well. If you deliberately decided to do encryption because communications are supposed to be secret, you should not settle for a protocol which is known to be broken.
    – the-wabbit
    Commented Jan 21, 2013 at 9:23
  • 1
    No, that could never have been said for telnet because it's a clear text protocol designed strictly for use within a closed and private network. There is absolutely no comparison.
    – John Gardeniers
    Commented Jan 21, 2013 at 9:43
  • 1
    You're assuming that anyone who asks about using PPTP on SF knows the risks, knows the options, and has chosen PPTP with full understanding of all factors involved. This does not describe the average person who asks questions on SF.
    – tylerl
    Commented Jan 21, 2013 at 18:20
  • 1
    It's also not as insecure as some would have us believe. There are always some who overestimate risk. But PPTP is far less secure than most people think it is. Yes, you can configure it to be secure, but few people do. I have yet to encounter even one secure PPTP installation, even though it's the most common "VPN" technology companies offer.
    – tylerl
    Commented Jan 21, 2013 at 18:27
  • @tylerl, have you ever known of a single real world instance of PPTP being compromised? If you have you're the only person I know who has.
    – John Gardeniers
    Commented Jan 21, 2013 at 20:29
  • @JohnGardeniers Here's a tool called chapcrack which will decrypt your PPTP session and hand you back the unencrypted packet capture. Is that real-world enough for you? The only thing between an attacker and your private communication is him caring enough to actually want it.
    – tylerl
    Commented Jan 21, 2013 at 23:45
  • @tylerl, no, that's not real world. Real world is where it happens to someone without their knowledge or permission in a non-lab situation. Using that tool on myself is a lab situation, which is my entire point.
    – John Gardeniers
    Commented Jan 21, 2013 at 23:52
-1

Seems to me like we should propose the OP use a more secure variant such as OpenVPN when they ask about PPTP problems instead of supporting a known penetrable system.

Or at the very least suggest they implement EAP-TLS as part of the tunnel.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .