0

Windows offers the option of using either RDP encryption or SSL (TLS 1.0) to secure a remote desktop connection. Which option is more secure?

Given the recent discoveries, is TLS 1.0 still secure in this use case?

This is the description Microsoft provides

  • RDP: The RDP method uses native RDP encryption to secure communications between the client and RD Session Host server. If you select this setting, the RD Session Host server is not authenticated.

  • SSL (TLS 1.0): The SSL method requires the use of TLS 1.0 to authenticate the RD Session Host server. If TLS is not supported, the connection fails.

UPDATE: I'm referring to the POODLE vulnerability discovered recently that TLS 1.0 is no longer secure

1
  • You have a misconception, POODLE does make TLS not secure. What it does is make the connection fail then your browser tries a older method to connect. It only demonstrates the dangers of allowing legacy SSL 3.0 connections. Feb 26, 2015 at 22:03

2 Answers 2

2

I'm referring to the POODLE vulnerability discovered recently that TLS 1.0 is no longer secure

Poodle does not make TLS 1.0 not secure, what it does is make the TLS 1.0 connection fail and the browser falls back to the older less secure SSL 3.0 which does have vulnerabilities that can be exploited.

RDP will not fallback to SSL 3.0, it falls back to the proprietary RDP security protocol if you choose the option to negotiate the connection. If you set it to not negotiate and only allow TLS 1.0 connections you are unaffected by POODLE.

2
0

I assume the RDP security layer is less secure because SSL is preferred if you select the auto-negotiate method:

The most secure layer that is supported by the client will be used. If supported, SSL (TLS 1.0) will be used. If the client does not support SSL (TLS 1.0), the RDP Security Layer will be used.

See here:

Is windows remote desktop secure?

Not the answer you're looking for? Browse other questions tagged .