Alleen OpenVPN is veilig, naar mijn weten. De rest zijn veilig voor 'casual' gebruik, maar zeker niet als je echt iets te verbergen hebt.
Deze uitspraak hoorde ik laatst ook, maar kon er niet echt bevestiging voor vinden.
Na wat zoeken kwam ik bij wat nordVPN artikelen uit. Daar gebruikten ze standaard openVPN maar zijn nu langzaam maar zeker al hun apps naar IKEv2/IPsec aan het migreren. En uit de comments etc kan ik alleen maar afleiden dat iedereen dat super tof vindt. Dus dat zou impliceren dat IKEv2/IPsec > OpenVPN ?
imho lijkt het erop dat de layer3 implementatie iets veiliger is qua reach dan de openVPN layer4 approach.. maar ik ben een redelijke leek op het gebied van security.
IKEv2/IPsecThe latest addition to NordVPN security protocol family, which is also protected by IPsec, just as L2TP is, however IKEv2/IPsec significantly increases security and privacy of the user by employing very strong cryptographic algorithms and keys. NordVPN uses NGE (Next Generation Encryption) in IKEv2/IPsec. The ciphers used to generate Phase1 keys are AES-256-GCM for encryption, coupled with SHA2-384 to ensure integrity, combined with PFS (Perfect Forward Secrecy) using 3072-bit Diffie Hellmann keys. IPsec then secures the tunnel between the client and server using the strong AES256. This is the protocol, which provides the user with peace of mind security, stability and speed. For these reasons, it is highly recommended by NordVPN and has been adopted as a default in the iOS and mac OS apps. Instructions for set up for other devices coming soon.
IKEv2/IPsec and Other Security ProtocolsIKEv2/IPsec (the latest addition in NordVPN protocols) is also protected by IPsec, just as L2TP is, however IKEv2/IPsec significantly increases security and privacy of the user by employing very strong cryptographic algorithms and keys. NordVPN uses NGE (Next Generation Encryption) in IKEv2/IPsec. The ciphers used to generate Phase1 keys are AES-256-GCM for encryption, coupled with SHA2-384 to ensure integrity, combined with PFS (Perfect Forward Secrecy) using 3072-bit Diffie Hellmann keys. IPsec then secures the tunnel between the client and server using the strong AES256. This is the protocol, which provides the user with peace of mind security, stability and speed. For these reasons, it is highly recommended by NordVPN and has been adopted as a default in the iOS app and will soon be available on other platforms.
IPSec vs SSL VPNs comparisonBoth SSL and IPSec VPNs are good options, both with considerable security pedigree, although they may suit different applications.
IPsec VPNs operate at layer 3 (network), and in a typical deployment give full access to the local network (although access can be locked down via firewalls and some VPN servers support ACLs). This solution is therefore better suited to situations where you want remote clients to behave as if they were locally attached to the network, and is particularly good for site-to-site VPNs. IPSec VPNs also tend to require specific software supplied by the vendor, which is harder to maintain on end-user devices, and restricts usage of the VPN to managed devices.
SSL VPNs are often cited as being the preferred choice for remote access. They operate on layers 5 and 6, and in a typical deployment grant access to specific services based on the user's role, the most convenient of which are browser-based applications. It is usually easier to configure an SSL VPN with more granular control over access permissions, which can provide a more secure environment for remote access in some cases. Furthermore, SSL/TLS is inherently supported by modern devices, and can usually be deployed without the need for specialist client-side software, or with lightweight browser-based clients otherwise. These lightweight clients can often also run local checks to ensure that connecting machines meet certain requirements before they are granted access - a feature that would be much harder to achieve with IPSec.
In both cases one can be configured to achieve similar things as the other - SSL VPNs can be used to simply create a tunnel with full network access, and IPSec VPNs can be locked-down to specific services - however it is widely agreed that they are better suited to the above scenarios.
However, for exactly these reasons, many organisations will use a combination of both; often an IPSec VPN for site-to-site connections and SSL for remote access.
[Reactie gewijzigd door edzob op 25 juli 2024 08:05]
In een tweet schrijft de organisatie dat de nieuwe functie in de komende weken beschikbaar moet komen. Open Whisper Systems geeft geen nadere details over de precieze implementatie van de functie of de werking ervan. De aankondiging volgt op de mededeling dat na onderzoek is gebleken dat Egypte communicatie via Signal blokkeert. De organisatie raadt gebruikers in de tussentijd aan om gebruik te maken van Tor of van een vpn.
/i/1364660649.png?f=fpa)
/i/1391687194.png?f=fpa)
/i/1387529847.png?f=fpa)
/i/1225618914.png?f=fpa)
:strip_exif()/i/1392884304.jpeg?f=fpa)
/i/2001261633.png?f=fpa)
:strip_exif()/i/1224703772.gif?f=fpa)
:strip_exif()/i/1294081930.gif?f=fpa)
/u/94596/crop643fb12fd4e6d.png?f=community){kind=small}
/u/584529/crop5af32c5cc1bce_cropped.png?f=community){kind=small}
:strip_icc():strip_exif()/u/793705/crop57de4b2cc3582_cropped.jpeg?f=community){kind=small}
:strip_icc():strip_exif()/u/23148/crop5aa38c3d4a408_cropped.jpeg?f=community){kind=small}
:strip_icc():strip_exif()/u/14922/crop59886d91a6c76_cropped.jpeg?f=community){kind=small}
/u/207099/crop5fd7460dadcb6_cropped.png?f=community){kind=small}
/u/10064/leuk_he.png?f=community){kind=small}
) aangeschaft. Op een Synology NAS is het bijvoorbeeld erg eenvoudig een goedwerkende VPN-server op te zetten./u/15038/logo.GIF?f=community){kind=logo}
:strip_icc():strip_exif()/u/479581/Coffee%25202.jpg?f=community){kind=small}
:strip_icc():strip_exif()/u/30300/crop649b06535e901_cropped.jpg?f=community){kind=small}
:strip_icc():strip_exif()/u/343187/avatar.jpg?f=community){kind=avatar}
:strip_icc():strip_exif()/u/26185/crop598dae491aa4e_cropped.jpeg?f=community){kind=small}
:strip_icc():strip_exif()/u/168551/crop5cc9f0696f0a5_cropped.jpeg?f=community){kind=small}
/u/590416/crop5d8a8f12228ba_cropped.png?f=community){kind=small}