36 ms·
Am I correct that some security experts don't necessarily trust open vpn because of its reliance on TLS?
by qrbLPHiKpiux 9y ago
Am I correct that some security experts don't necessarily trust open vpn because of its reliance on TLS?
- lucb1e 9y agoI'm pretty sure you can find an expert in any field (provided enough 'experts', which for TLS there certainly are) who will have a given opinion on the topic. I myself am not entirely happy with the way TLS works. It invites for bad configurations and in our pen testing reports, it is extremely rare to see setups that do not have some recommendation. I have yet to see one, but I'm sure someone in the office will have seen a "perfect" setup on some odd assignment (once again: given enough samples, you'll find one...). And then there's the fact that almost all TLS connections use endpoints written in memory-unsafe languages, which has caused its fair share of vulnerabilities. (Alright, maybe a lot more than its fair share.) But the notion that OpenVPN is bad just because it relies on TLS is mildly ridiculous. The only reason I could agree with "let's move OpenVPN off of TLS" is because too much relies on one protocol. Then again, that makes it an extremely well-vetted protocol, which is one of the things that makes it so good, and it's a fairly versatile protocol. Most of the important parts can be swapped out with a configuration change.