PPTP is not an open, ratified standard the way that, for example, SSL/TLS is. (see: http://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.2 and http://datatracker.ietf.org/doc/rfc5246/ )
The most popular (most widely deployed) implementation of PPTP came from Microsoft, in WinNT. This implementation was also used in many 3rd party applications designed to work with WinNT and its successors.
The MS implementation of PPTP (with MS-CHAP authentication) was publicly demonstrated to be cryptographically broken in 1998 (see https://www.schneier.com/paper-pptp.html ). And there are utilities available to sniff for MS-CHAP authentication sessions and automatically extract passwords from them (L0phtCrack v2.0, released 1997).
So, the question is: Does anyone know the details of the DD-WRT implementation of PPTP? I see that PPTP Server in "v24-sp2 mini" uses "MPPE Encryption" and stores "CHAP Secrets". Does it have the same vulnerabilities as PPTP/MS-CHAP did in 1997? Is this implementation of the protocol any better than it was 16yrs ago?
Or, for a home-grown VPN, do I need to I upgrade my hardware and firmware to use OpenVPN?
(Reposted from superuser.com/questions, following a user recommendation.)