PPTP
Cryptographically broken — kept here only for identification.
How widely is it used?
Should not be used for new deploymentsCryptographically broken and removed from modern Apple systems — do not deploy it.
How it works
PPP frames are tunnelled inside GRE with MPPE encryption keyed from the user's password. The MS-CHAPv2 handshake it relies on can be broken offline in hours.
Connects
Device → VPN server
Protocols
PPTP, GRE, MPPE
Typical users
Legacy systems being decommissioned
Main use case
Recognising and replacing an obsolete deployment.
Advantages
- Trivially simple
- Historically supported everywhere
Limitations
- MS-CHAPv2 is broken — treat PPTP traffic as readable by an attacker
- Removed from modern macOS and iOS entirely
- Must not be used for new deployments
Not safe on its own
The encryption in this protocol is broken. Treat anything sent over it as readable by an attacker, and migrate to WireGuard or IKEv2.