Re: [tlug] VPN

[Tod McQuillin <devin@example.com>]

On Mon, 6 Dec 2004, Christopher SEKIYA wrote:

> On Mon, Dec 06, 2004 at 08:37:35PM +0900, Jacques Deguest wrote:
>
>> As far as I know, there are 3 main types of VPN: FreeS/Wan, OpenVPN (SSL
>> VPN) and PPTP.
>
> No.  There are two types of VPN:
>
> 1) IPSEC,
> 2) everything else.
>
> Option #1 is trustworthy _only_ if the following are true:
>
> * XAUTH is not being used,
> * both endpoints are controlled,
> * the CA has not been compromised (x.509 only)
> * the preshared secret is an ungodly long string generated by a monkey 
>   banging on a keyboard for a bit.
>
> Option #2 ain't even close to trustworthy.  Go ahead -- set up a 
> solution using PPTP, go to defcon, use it, and see how fast your 
> concentrator is cracked.

Chris omits to mention why SSL and other TCP/IP based solutions (like ppp 
over SSH etc) are a bad idea:

http://sites.inka.de/sites/bigred/devel/tcp-tcp.html
-- 
Tod