0

If you're not familiar, Ventrilo is a voice chatroom used for gaming. Here's the wiki for Ventrilo and similar software Mumble and TeamSpeak to give you an idea of what the software is about.

I tried to find out if a locally hosted (i.e. my own) Ventrilo server uses encryption of sufficient strength to prevent eavesdropping and was unable to do so. I found an article on wireshark.org talking about a pre-shared key, but it does not go in depth about how or why the key is used.

This comparison mentions some things related to encryption, privacy, and security, but does not answer my question.

Does Ventrilo use sufficient encryption to prevent eavesdropping while the connection is going through the internet? Using Server 3.0.3 and client 3.0.8, which are the ones posted on the download page.

Edit

By saying "prevent eavesdropping" I mean that they use modern or known to be strong encryption, not something that has been well known to be hacked since the software was produced.

For example, DES to encrypt the packets in transit would be encryption, but would not be sufficient to prevent eavesdropping since it is easy to crack or has been considered to be cracked for a long time.

Another example in that same vein: using WEP to secure your WAP/Wireless network. Technically, it's using some kind of encryption, but it is easy to bypass and no one considers this a strong level of encryption.

VPN protocols and encryption have a similar example. PPTP does not have strong encryption, and while it is/was an option for mobile VPNs, it was usually a legacy one, there if that was all your device supported. The ability to crack PPTP exists, but it takes days to crack it; that's only going to get quicker. On the flipside to PPTP, OpenVPN is considered to have strong encryption, so if you use a VPN provider that gives you the choice of protocols, you should choose OpenVPN.

You can ascertain the encryption strength of something independent of a particular threat model. You don't have to ask a question "Is this encrypted good enough to defeat X", mostly because attackers, bad guys, and hackers are not arranged in a linear fashion, nor assigned a "hacker power level" of any kind. "Can this encryption be defeated by guys with hacker power level 9000? Or do they have to be over 9000 to break it?" is not a valid question, nor comparison. People attacking your comms are bubbles in a 3D Venn diagram, not lines on a number line. Meaning they have overlap in capabilities, even if there is a large amount of overlap (ie in the case of state sponsored attackers).

  • Eavesdropping by whom, your little brother who is a script kiddie and is on the same LAN as you, or the government you are using Vent to plan the rebellion against? It may be good enough for some but not others, we need to know your "threat model" to know if it is good enough. – Scott Chamberlain Feb 5 '16 at 16:11
1

To directly answer your question:

Does Ventrilo use sufficient encryption to prevent eavesdropping while the connection is going through the internet?

No, Ventrilo's encryption methods cannot prevent a knowledgeable individual from eavesdropping on your communications to and from the server.

If you read further into the Wireshark article you linked as well as a page it references, one can in theory force Ventrilo traffic through a proxy that decrypts the data.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.