Re: PPTP traffic should be considered unencrypted

> http://www.theregister.co.uk/2012/07/31/ms_chapv2_crack/
>
> "Marlinspike says that MS-CHAPv2 should be purged from the Internet,
> advising that PPTP traffic “should be considered unencrypted”, and
> that MS-CHAPv2 enterprise users should begin migrating – now."

I was just reading about this the other day, and I was hoping someone
could clarify something for me:

Is the attack against the user's password, or the user's session key?

Because if it's against the session key, and the user's password is
still secure, then maybe we just rename "VPN" to "VN" and tell users
that they should use SSL or SSH to get access to resources.

We use PPTP as a remote IP-granting service, so that users who are
currently off-campus (at home/traveling/whatever) can get on-campus IP
addresses, as some of our vendors gate access based on source IP.  Is
PPTP + MSCHAv2 still an acceptable solution for that service?

-- 

Tim Gustafson
[email protected]
831-459-5354
Baskin Engineering, Room 313A

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Poptop-server mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/poptop-server