The risks of VPN aren't in the VPN itself, they are in the continuous network connection architecture. 90%+ of VPN interconnects could be handled cleanly, safely, and reliably using HTTPS, without having to get internal network administration involved at all. And the risks of key exposure with HTTPS are exactly the same as the risks of having one end or the other of your VPN compromised. As it is, VPN means trusting the network admins at your peer company. On 10/08/2018 12:15 PM, valdis.kletnieks@vt.edu wrote:
On Mon, 08 Oct 2018 08:53:55 -0500, Daniel Taylor said:
Especially when you have companies out there that consider VPN a reasonable way to handle secure data transfer cross-connects with vendors or clients. At some point, you get to balance any inherent security problems with the concept of using a VPN against the fact that while most VPN software has a reasonably robust point-n-drool interface to configure, most VPN alternatives are very much "some assembly required".
Which is more likely? That some state-level actor finds a hole in your VPN software, or that somebody mis-configures your VPN alternative so it leaks keys and data all over the place?