Possible Duplicate:
Are software like NTRconnect and LogMeIn safe enough for businesses with sensitive data?

Does anybody have any information about LogMeIn's vulnerability? Googling reveals that there's nothing to worry about but I'm curious about SU's take on the matter.

marked as duplicate by random, Arjan, BinaryMisfit Feb 5 '10 at 15:28

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
  • The only thing I've ever found unsecure about LogMeIn is when my friend left his username and password written on a post it next to his PC. :) – BBlake Feb 5 '10 at 15:17

I have used LogMeIn Ignition and Central for a while now (way back when they were both in beta testing) and I think it is a wonderful tool to allow multiple users to gain access to computers from all over. Much less hassle than RDP, and you don't have to poke holes in your firewall for it. One could argue that because your not allowing Direct VPN or creating holes for RDP that LogMeIn is more secure that other remote access solutions.


From the LogMeIn Security Page

Layered Security Overview

  1. Authorization of target resource to users: This is logging in to the LogMeIn site to obtain a list of your machines.
  2. Authorization of users to gateway: Authorizing you to the gateway.
  3. Authorization of gateway to host: Authenticating gateway to the target machine.
  4. Authorization of host to gateway: Reverse of 4.
  5. 128-to-256 bit SSL end-to-end data encryption: SSL encryption throughout the entire exchange.
  6. SSL/TLS intrusion detection: Stops people from trying to sniff or hijack your session. I'm guess that it would automatically lock down the host and terminate the connection.
  7. IP address filtering: Deny / Allow based on ip addresses.
  8. Denial of service filtering: Stops standard DOS attacks.
  9. IP address lockout: Multiple failed connection attempts from a single ip? Lockout that ip for an amount of time.
  10. Authentication and authorization of users to the host: Actually authenticating with the host machine.
  11. Authentication and authorization of users within the host: Machine verifies the user.
  12. Detailed auditing and logging including remote control video recording RSA SecurID support: Detailed logs of everything and support for an RSA SecurID.

I've used LogMeIn extensively and never noticed anything I would call "insecure." There are multiple (hopefully different) passwords required to access a remote machine. Everything is SSL encrypted. Heck even the entire website uses a 128 bit certificate.

Not the answer you're looking for? Browse other questions tagged or ask your own question.