Re: PPTP traffic should be considered unencrypted
Tim Gustafson <[email protected]> Tue, 31 Jul 2012 16:40:03 -0700
| Newsgroups | gmane.network.poptop,gmane.comp.misc.pptpclient.devel |
|---|---|
| Message-ID | <CAG27QgT19n_uL2qwRu5xYTQqt2D_Pr2SmR+-jGAa2h8jaVp=Bw@mail.gmail.com> |
> The user's password. That is to say, the attack would have to be > repeated if the user changed their PPTP password. Actually, it occurs to me that I haven't seen this question asked or answered so far either: The vulnerability described does not seem to be related to EAP, correct? Is using EAP as an authentication method still viable? I'm thinking something like EAP-TTLS. As described on the Wikipedia page, it seems like a viable option. I get that it doesn't do MPPE encryption, but as I mentioned before, I don't particularly care about that. -- Tim Gustafson [email protected] 831-459-5354 Baskin Engineering, Room 313A ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/