Re: PPTP traffic should be considered unencrypted

On Tue, Jul 31, 2012 at 04:40:03PM -0700, Tim Gustafson wrote:
> > The user's password.  That is to say, the attack would have to be
> > repeated if the user changed their PPTP password.
> 
> Actually, it occurs to me that I haven't seen this question asked or
> answered so far either:
> 
> The vulnerability described does not seem to be related to EAP,
> correct?  Is using EAP as an authentication method still viable?

I agree, the vulnerability is specific to MSCHAP-v2.  I know nothing
useful about EAP, sorry.  I don't know if anybody has it working with
PPTP.  Yes, MPPE depends on MSCHAP-v2, I don't think it can be made to
depend on anything else, but that's a matter for the pppd guys, in
pptpd land we just ask pppd to do it.

-- 
James Cameron
http://quozl.linux.org.au/

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/