I'm looking at a few VPN providers and many seem to offer L2TP VPN but they seem to share their shared secrets publicly on their website, for example :
- Goldenfrog https://www.goldenfrog.com/support/vyprvpn/vpn-setup/iphone/l2tp
- Witopia https://www.witopia.net/support/setting-up-and-using-your-vpn/apple-ios/ipsec/
- Astrill http://wiki.astrill.com/index.php/Astrill_Setup_Manual:How_to_configure_L2TP/IPSec_with_built-in_client_on_Mac_OS_X
Providing that anyone can read these shared secrets what prevents someone in a privileged network position (i.e. Government, ISP, etc) from setting up a rogue VPN server and impersonating the VPN provider, worse still there would be no way to know whether you connected to the real or rogue server - is this correct?