I've been reading about the security, or lack of, with regards to a PPTP VPN. The specific things mentioned over and over are the fact that DNS can leak and the encryption is insecure. Is this a flaw with PPTP itself, or just the MS implementation? I do not see why you can't set your default resolver to a DNS server on the VPN to force DNS through the tunnel. Would setting up a static routing table to force the default route also cause all traffic to be sent out the PPTP tunnel? As far as the encryption is concerned, isn't the encryption suite the responsibility of the client\server and not the PPTP protocol itself. Couldn't a PPTP client\server theoretically use something other than MSCHAP?
The MSCHAP authentication protocol is insecure, and the MPPE tunnel protocol is vulnerable to bit-flipping attacks. You can use a different authentication protocol, such as EAP-TLS, but that requires more complex configuration (namely, PKI). If you're concerned about security, there are several other VPN protocols you could use, such as OpenVPN, L2TP, and IPSec.