OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: How secure is PPTP?
From: Joseph Pingenot (jap3003KSU.EDU)
Date: Tue Jun 20 2000 - 20:51:56 CDT

>Would really appreciate any info on PPTP security in Windows NT. We use
>Microsoft's PPTP on the server and clients to connect via VPN but I can't
>find any info on how secure such connection really is.. It's obviously
>better then plain TCP/IP but any additional info would be appreciated.

I just got out of a tutorial at the USENIX technical conference
  done by Tina Bird of Counterpane. In her tutorial, she listed
  a criticism both before and after Microsoft patched their
  implementation, done by Schneier and Mudge (IIRC). The more
  recent one is at:
  http://www.counterpane.com/pptpv2-paper.html
I haven't had time to check it out in-depth, though.
IIRC, she heavily suggested *not* using Microsoft's PPTP
  implementation, although PPTP in and of itself wasn't bad at
  all. From what I gathered, I would use IPsec, or a freeware
  system, if possible.
Good luck.

                              Joseph 

--
Joseph==============================================jap3003ksu.edu
"A perfect firewall, as Marcus Ranum has commented, is actually
  a pair of wirecutters applied to ALL wires associated with the
  computer and network."  --Anton J Aylward, on the vuln-dev list