Re: PPTP traffic should be considered unencrypted
Nick Owen <[email protected]> Wed, 1 Aug 2012 12:42:42 -0400
| Newsgroups | gmane.network.poptop,gmane.comp.misc.pptpclient.devel |
|---|---|
| Message-ID | <CAJC4Zaof+k_kxOKsEL6J5N7MsBfmDFWcguJWK+v7qiBMh=xkDQ@mail.gmail.com> |
On Tue, Jul 31, 2012 at 6:26 PM, James Cameron <[email protected]> wrote: > On Tue, Jul 31, 2012 at 09:00:25AM -0700, Tim Gustafson wrote: >> > http://www.theregister.co.uk/2012/07/31/ms_chapv2_crack/ >> > >> > "Marlinspike says that MS-CHAPv2 should be purged from the Internet, >> > advising that PPTP traffic ???should be considered unencrypted???, and >> > that MS-CHAPv2 enterprise users should begin migrating ??? now." >> >> I was just reading about this the other day, and I was hoping someone >> could clarify something for me: >> >> Is the attack against the user's password, or the user's session >> key? > > The user's password. That is to say, the attack would have to be > repeated if the user changed their PPTP password. I'm curious about the impact of using one-time passwords. If the attacker knows you are using a 6-digit number, then it would take a lot less time to break. Still it might be longer than your session. Nick -- Nick Owen WiKID Systems, Inc. http://www.wikidsystems.com Commercial/Open Source Two-Factor Authentication ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/