5 ms·
OpenVPN supports all ciphers supported by the OpenSSL library, so you can for instance get 256 bit AES-CBC if you want. I´ve seen benchmarks with one tunnel run
by kfreds 14y ago
OpenVPN supports all ciphers supported by the OpenSSL library, so you can for instance get 256 bit AES-CBC if you want. I´ve seen benchmarks with one tunnel running >400 Mbit, so you can certainly get some nice performance.
PPTP* is broken, and should only be used for anonymisation, never to ensure confidentiality or integrity of the data in the tunnel. PPTPs encryption scheme is MPPE which is based on RC4, and tunnel traffic can be decrypted in a matter of minutes unless the key is sufficiently strong. This is almost never the case since the password is the only thing used for key material. IMHO this is pretty much irrelevant anyway since you can do a MITM attack to hijack the connection or downgrade the session to not use encryption. So basically the encryption doesn´t matter.
* I´m told the exception would be to use PPTP with EAP-TLS which is certificate-based. However I don´t have any experience setting that up, so I´m staying quiet on that one.
As for data retention, I don´t see how VPN providers have any obligation to log. And even if they did perhaps a little bit of collective civil disobedience might be in order?
Full disclosure: I run a VPN service.
- sandGorgon 14y agoWhat is your opinion on SSTP ? The problem with most VPN tunnels is that you cannot use them if your corporate firewalls only allow port 443/80. SSTP gets you around that.
- kfreds 14y agoI haven´t read the specs thoroughly enough to have an opinion. As for firewalls, as long as they´re not doing DPI (Deep Packet Inspection) you can just run the VPN on the right ports. In addition to the standard ports, we run our VPNs on tcp/80, tcp/443, udp/53 among others. That takes care of most firewalls.
- jwr 14y agoI don't know which VPN service you run, but I looked at tunnelr and the showstopper for me is that it only supports OpenVPN. In order to use VPNs on my Mac and on my mobile devices, I have to pay for two separate VPN services, which is a deal breaker. I would much rather use a service that supports both OpenVPN and PPTP, with a bunch of disclaimers. I understand the tradeoff and I am willing to make it.
- kfreds 14y agoYou´re more than welcome to use us. My name is Fredrik Strömberg and I´m co-founder of Mullvad. Welcome :)
- jcr 14y agoYou might want to take a closer look at tunnelr.com. They do support both OpenVPN and OpenSSH based tunnels, and both of these work fine on MacOS. I don't own a "normal" Mac, but I did see MacOS tutorials on their site, in fact, there are two tutorials, with each using a different method. You were a bit vague when simply stating "mobile device" but if memory serves me, Both OpenVPN and OpenSSH will work on some "mobile" platforms (Android, iOS, etc.). I've never tried it personally, and I don't know what kind of "mobile device" you use, so for your specific case, I could very well be wrong. Using OpenSSH via SOCKS support in applications or by using a SOCKS-Wrapper like "DSOCKS" by Dug Song or similar ("Sockify for windiws, etc), take more effort than running OpenVPN. It might take more effort, but if you don't mind the hassle, it's most likely more secure than the common alternatives (OpenVPN, PPTP, etc.). The only thing better than OpenSSH (in my opinion) would be using a correctly configured IPSec implementation. But getting IPSec right makes OpenSSH look very easy. You might want to note how in this discussion both Fredrik Strömberg (kfreds -runs the Mullvad VPN service) and myself have intentionally tried to avoid disparaging PPTP. Whether good or bad, a lot of people like PPTP for various reasons, and a lot of VPN services offer it as an option. Other than for the sake of curiosity, learning, and experimentation, I would never use PPTP. When it comes to both security and privacy, PPTP has many known problems and some VPN service providers refuse to support it due to these issues. Trying to be fair to those who like PPTP is being a bit too generous since the security and privacy of people is at stake. None the less, development work is still being done on PPTP, and it has supposedly made some improvements over the years. EDIT: I misspelt Fredrik Strömberg's name. Sorry. (sigh).
- jwr 14y agoiOS devices do not support OpenVPN nor OpenSSH. You can use L2TP, PPTP or IPSec for VPNs. So, I can either pay for tunnelr.com and have zero VPN support on my iOS devices, pay for two separate services, or switch to a provider that supports both. I suggested that while it's fine to tell people not to use PPTP, some of us will still want to use it, because it is better than nothing at all (please don't make me argue that it really is better than no VPN at all). Here's a statement of fact: at present, the only reason tunnelr.com does not get my money is because it does not support PPTP alongside OpenVPN.