Gregory's Server@ebassi @dickon @marcan
RDP has it's own huge mess since it's actually fundamentally rooted in RC4 crypto which broke in 2003 or so.
("proof": modern openssl has a "no-rc4" configure option. All the security folks will say you should set that since, well, rc4 and 2003. If you use that, the RDP stack no longer works)
|
Top-level
2 comments
@winterschon I'll buy the "it should wrap in SSL by default' as solution.. I hope all the linux stack for this does that by default... I don't buy the VPN argument; that's not reasonable in practice. |
@fenruspdx @ebassi @dickon @marcan
Anyone sending RDP connections across the network without a VPN or SSH tunnel is asking for problems. You don't need to flag RC4, just use sensible tunnels for what they are designed for... securing network traffic.