RE: Remote Desktop vs VPN on Windows 2003

From: Nero, Nick (Nick.Nero_at_disney.com)
Date: 01/19/05

  • Next message: Frank Hamersley: "RE: Remote Desktop vs VPN on Windows 2003" 
    Date: Wed, 19 Jan 2005 16:01:59 -0500
To: <security-basics@securityfocus.com>

     Unfortunately the phrase "weak encryption algorithm" is only slightly
    less subjective than the terms, "too much money". For what purpose?
    The default on 2000 and XP is 128bit RC4 which does seem dated but this
    is a pretty popular algorithm for symmetric encryption. Sure we could
    all use key pairs to encrypt everything to have "strong encrytion" but
    the cost in performance for the amount of security it provides isn't
    worth it for the large majority of applications.

    Furthermore in Windows 2003 you have the option of FIPS 140-1/FIPS 140-2
    compliant algorithms for encrypting RDP sessions. This can even be set
    via a GPO to your entire environment. Doesn't get much easier than
    that. Is it secure enough to transfer missle launch codes? I probably
    wouldn't. Is it good enough to secure a user remotely accessing their
    desktops - you betcha. Also, bear in mind these encyption keys are per
    session so once you find one it isn't as easy as just listening to all
    the new sessions.

    At the same time 128bit SSL isn't as secure as 1024bit but it is secure
    enough for the overwhelming majority of uses. And SSH has had lots of
    holes in the past 2 years. Bashing RDP is just baseless MS bashing
    without concern for the facts.

    -----Original Message-----
    On Behalf Of Ansgar -59cobalt- Wiechers
    Sent: Wednesday, January 19, 2005 2:52 PM
    To: security-basics@securityfocus.com
    Subject: Re: Remote Desktop vs VPN on Windows 2003

    On 2005-01-19 Roger A. Grimes wrote:
    > On 2005-01-19 Ansgar -59cobalt- Wiechers wrote:
    >> On 2005-01-18 Roger A. Grimes wrote:
    >>> but if the Windows tool can do the same or better job, why not use
    >>> the free tools in the system?
    >>
    >> Because it can't.
    >
    > SSH multiple hacks...RDP one in 2002. How is RDP the worse tool? I
    > keep waiting for facts?

    *sigh*

    Like I already said: because its encryption algorithm is weak. Thus it
    simply cannot do a better job than tools which provide strong encryption
    (like SSH or VPNs). Period.

    Regards
    Ansgar Wiechers 

    --
"Those who would give up liberty for a little temporary safety deserve
neither liberty nor safety, and will lose both."
--Benjamin Franklin
  • Next message: Frank Hamersley: "RE: Remote Desktop vs VPN on Windows 2003"

    Relevant Pages

    • How good an encryption algorithm is this?
      ... Must be capable of encrypting strings to a byte array, ... back again to the same string ... Encryption algorithm must also return the exact number of bytes of the ...
      (microsoft.public.dotnet.languages.csharp)
    • How good an encryption algorithm is this?
      ... Must be capable of encrypting strings to a byte array, ... back again to the same string ... Encryption algorithm must also return the exact number of bytes of the ...
      (microsoft.public.vc.language)
    • Re: Unix Password Encryption Procedures
      ... I know that most Unix machines either use the DES encryption algorithm ... such thing as the "MD5 encryption algorithm". ... Some administrators have also been known to setup systems to authenticate ...
      (comp.unix.admin)
    • Re: how to send data using crypto keys?
      ... The ONLY unbreakable encryption algorithm is One Time Pads. ... EVERY algorithm that re-uses keys or computes new keys in a ...
      (comp.security.misc)
    • Re: UsernameToken Encryption with TripleDES
      ... EncryptionMethod passed in the request. ... > The default encryption algorithm for UsernameToken, ... > at server side by config or programmatically. ...
      (microsoft.public.dotnet.framework.webservices.enhancements)