Does anybody have any information about LogMeIn's vulnerability? Googling reveals that there's nothing to worry about but I'm curious about SU's take on the matter.
I have used LogMeIn Ignition and Central for a while now (way back when they were both in beta testing) and I think it is a wonderful tool to allow multiple users to gain access to computers from all over. Much less hassle than RDP, and you don't have to poke holes in your firewall for it. One could argue that because your not allowing Direct VPN or creating holes for RDP that LogMeIn is more secure that other remote access solutions.
From the LogMeIn Security Page
Layered Security Overview
- Authorization of target resource to users: This is logging in to the LogMeIn site to obtain a list of your machines.
- Authorization of users to gateway: Authorizing you to the gateway.
- Authorization of gateway to host: Authenticating gateway to the target machine.
- Authorization of host to gateway: Reverse of 4.
- 128-to-256 bit SSL end-to-end data encryption: SSL encryption throughout the entire exchange.
- SSL/TLS intrusion detection: Stops people from trying to sniff or hijack your session. I'm guess that it would automatically lock down the host and terminate the connection.
- IP address filtering: Deny / Allow based on ip addresses.
- Denial of service filtering: Stops standard DOS attacks.
- IP address lockout: Multiple failed connection attempts from a single ip? Lockout that ip for an amount of time.
- Authentication and authorization of users to the host: Actually authenticating with the host machine.
- Authentication and authorization of users within the host: Machine verifies the user.
- Detailed auditing and logging including remote control video recording RSA SecurID support: Detailed logs of everything and support for an RSA SecurID.
I've used LogMeIn extensively and never noticed anything I would call "insecure." There are multiple (hopefully different) passwords required to access a remote machine. Everything is SSL encrypted. Heck even the entire website uses a 128 bit certificate.