Slashdot Mirror
VPN Flaw Shows Users' IP Addresses
AHuxley writes "A VPN flaw announced at the Telecomix Cyphernetics Assembly in Sweden allows individual users to be identified. 'The flaw is caused by a combination of IPv6, which is a new Internet protocol due to replace the current IPv4, and PPTP (point-to-point tunneling protocol)-based VPN services, which are the most widely used. ... The flaw means that the IP address of a user hiding behind a VPN can still be found, thanks to the connection broadcasting information that can be used to identify it. It's also relatively easy to find a MAC address (which identifies a particular device) and a computer's name on the network that it's on.' The Swedish anti-piracy bureau could already be gathering data using the exploit."
You don't need PPTP if you're using IPSEC and IPv6. Even Microsoft clients don't need it any more.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
And it's just as sensible as spoofing your home address when ordering pizza that you ultimately want to eat.
I seriously doubt any reasonable level of donations will ever allow the Tor network to add the kind of capacity required to torrent. I think it has many more important needs than that anyway.
IPv6, which is a new internet protocol due to replace the current IPv4
My grand kids will probably be saying that to their grand kids.
Not only that, but Tor isn't nearly as secure as most people think it is
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
Any Network Admin worth his weight has not been using pptp for vpn for quite some time. IPSEC (AES) anyone? Just sayin.
IPSEC doesn't have to use AES, it supports other ciphers. Further, PPTP does not specify encryption, but Windows clients use MPPE, which is RSA RC4.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
The conference video apparently.
assigning a second IP address, that you also control, to an interface is not 'spoofing' in any sense of the word. If you assign an IP address that I control, then you're spoofing, at which point you have the same problem in IP6 that you have in IP4.