4 ms·
So PPTP is insecure, and IPSec is fundamentally broken… How about OpenVPN? Is that compromised too?
by riobard 13y ago
So PPTP is insecure, and IPSec is fundamentally broken… How about OpenVPN? Is that compromised too?
- ghshephard 13y agoIPSec is not fundamentally broken, it's just needlessly complex.
- cpeterso 13y agoIs there a simple (and auditable) subset of IPSec that could still compatible with IPSec clients using a full/complex stack?
- wiml 13y agoAs I understand it most of the terribleness is in the key agreement stuff; the actual packet processing is a little ugly but is practical. So you could in theory set up (and regularly update) SAs manually with setkey(8), instead of having racoon do it. For a small network you could presumably lash together some cronjobs to keep this working. Would that be as secure as IKEv2 as actually implemented? I dunno :)
- plorkyeran 13y agoIf the unnecessary complexity has resulted in most implementations being broken then I'd be okay with calling it fundamentally broken, but I have no idea if that's actually the case.
- gwu78 13y agoOpenVPN uses SSL for encryption. It's an "SSL VPN". Any more questions? There are more reasons than just current events to avoid using SSL. But if this NSA hoopla is what it takes to make people aware of how poor SSL is as a solution, then let the conspiracy theories flourish.