4 ms·

VPNs are so 2010s. They just add friction and a false sense of security (the way they're traditionally implemented - VPN is "trusted" and everything behind is o

by sofixa 4y ago

VPNs are so 2010s. They just add friction and a false sense of security (the way they're traditionally implemented - VPN is "trusted" and everything behind is open access), and an amazing point of entry for attackers. A "zero trust" approach where nothing is trusted and you pass through an SSO with MFA like Okta is better in that Okta do a better job in security than "random network team running an unpatched firewall from vendor X" do on average. And each service has an auth layer and doesn't implicitly trust some IPs are good. In any case, a phishing that captures login+password+mfa means game over in both scenarios.

exabrial 4y ago
100000x Incorrect. VPNs add a layer of security at the network level. You do not rely SOLELY on a VPN. You add it to drop network traffic that does not belong, decreasing the noise level in other logs, highlighting threats elsewhere. This is one of the worst pieces of advice to be repeated ad deafenun.
- sofixa 4y ago
  The thing is that VPNs are usually deployed in the way i described. No ACLs, everyone on the VPN is "trusted" regardless of position and role, with services behind often relying on the fact that the VPN is securing them.
  - xiwenc 4y ago
    “Trusted” does not mean authorized. I have never seen any (corporate) environment that uses VPN and not require some form of authentication & authorization on top. With “trusted” status often grants those trusted users read only access to internal communication or documentation.
  - awinder 4y ago
    Utilizing VPN as _a_ layer of network security with additional systems access security is something we learned in the old pre-2020s era, and I’ve never seen a cavalier system like you’ve described deployed. But maybe it’s just because I’m not up to date on “state-of-the-art” 2020s systems.
    - fulafel 4y ago
      In practice VPNs are a very visible layer that people will tend to rely on when they decide what security measures to implement. They are very clunky, so people end up assuming that they must provide quite a lot of security, to be worth enduring.
  - elric 4y ago
    Do you have any sources for this claim? Are there any stats about VPN deployments anywhere? I have never seen a VPN deployed in this way. Who are the companies that do this? Mom and pop shops with a two employees? Or 1990s corporations which were blissfully unaware of online threats?
  - kelnos 4y ago
    Not sure where you're getting this idea. I've never been on a VPN where services inside the VPN all just assumed I was allowed to be there. Internal services still at least required a username and password, and some would require 2FA as well. I'm sure there are some VPNs that are implemented a poorly as you describe, but I'm not sure that's the common case like you seem to think.
- 0xbadcafebee 4y ago
  > VPNs add a layer of security at the network level Which you get from TLS. Strong authentication and authorization per-web-application using short-lived tokens through OAuth/OIDC is about a billion times more robust than any VPN network security. 90% of what VPNs are useful for is connecting you to a non-routable network.
  - exabrial 4y ago
    This is also very very incorrect! Think about it, how come people in Iran/China use VPNs to access the outside work? If TLS were sufficient for privacy, your claim would be correct, but this is very far from reality. TLS is another _layer_ of security, but it still reveals who you are talking to via SNI and DNS queries, and worse: how often you are talking to them.
    - kelnos 4y ago
      That's kinda a different thing, though. People using VPNs to circumvent national internet restrictions is one thing. Securing a corporate network is another.
      - deleted 4y ago
        [deleted]
    - 0xbadcafebee 4y ago
      You can use TLS to secure a VPN connection from state actors. You can also use TLS 1.3 to avoid SNI, and DNS over HTTPS (or just use DNS over a tunneled connection). But I'm talking about how you don't need a VPN for a business purpose.

by sofixa 4y ago

exabrial 4y ago

100000x Incorrect. VPNs add a layer of security at the network level. You do not rely SOLELY on a VPN. You add it to drop network traffic that does not belong, decreasing the noise level in other logs, highlighting threats elsewhere. This is one of the worst pieces of advice to be repeated ad deafenun.

sofixa 4y ago
The thing is that VPNs are usually deployed in the way i described. No ACLs, everyone on the VPN is "trusted" regardless of position and role, with services behind often relying on the fact that the VPN is securing them.
- xiwenc 4y ago
  “Trusted” does not mean authorized. I have never seen any (corporate) environment that uses VPN and not require some form of authentication & authorization on top. With “trusted” status often grants those trusted users read only access to internal communication or documentation.
- awinder 4y ago
  Utilizing VPN as _a_ layer of network security with additional systems access security is something we learned in the old pre-2020s era, and I’ve never seen a cavalier system like you’ve described deployed. But maybe it’s just because I’m not up to date on “state-of-the-art” 2020s systems.
  - fulafel 4y ago
    In practice VPNs are a very visible layer that people will tend to rely on when they decide what security measures to implement. They are very clunky, so people end up assuming that they must provide quite a lot of security, to be worth enduring.
- elric 4y ago
  Do you have any sources for this claim? Are there any stats about VPN deployments anywhere? I have never seen a VPN deployed in this way. Who are the companies that do this? Mom and pop shops with a two employees? Or 1990s corporations which were blissfully unaware of online threats?
- kelnos 4y ago
  Not sure where you're getting this idea. I've never been on a VPN where services inside the VPN all just assumed I was allowed to be there. Internal services still at least required a username and password, and some would require 2FA as well. I'm sure there are some VPNs that are implemented a poorly as you describe, but I'm not sure that's the common case like you seem to think.
0xbadcafebee 4y ago
> VPNs add a layer of security at the network level Which you get from TLS. Strong authentication and authorization per-web-application using short-lived tokens through OAuth/OIDC is about a billion times more robust than any VPN network security. 90% of what VPNs are useful for is connecting you to a non-routable network.
- exabrial 4y ago
  This is also very very incorrect! Think about it, how come people in Iran/China use VPNs to access the outside work? If TLS were sufficient for privacy, your claim would be correct, but this is very far from reality. TLS is another _layer_ of security, but it still reveals who you are talking to via SNI and DNS queries, and worse: how often you are talking to them.
  - kelnos 4y ago
    That's kinda a different thing, though. People using VPNs to circumvent national internet restrictions is one thing. Securing a corporate network is another.
    - deleted 4y ago
      [deleted]
  - 0xbadcafebee 4y ago
    You can use TLS to secure a VPN connection from state actors. You can also use TLS 1.3 to avoid SNI, and DNS over HTTPS (or just use DNS over a tunneled connection). But I'm talking about how you don't need a VPN for a business purpose.