This is really surprising. Microsoft has good cryptographers in their employ. The problem, he said, is that they're not adequately involved in product development. Schneier emphasized that no flaws were found in the PPTP protocol itself, but in the Windows NT version of it. Alternate versions are used on other systems such as Linux-based servers.
People point out security issues with the product all the time.
He acknowledged that the password hashing had been fairly simple, but that updates have used a more secure hashing algorithm. He also contends that even a weak hashing can be relatively secure. The issue of using simple passwords as encryption keys is relevant to individual company policy more than Microsoft's product. A company that has a policy requiring employees to use long, more complex passwords can ensure that their network encryption is more secure. An update to the product, Kean said, lets administrators require a long password from company employees.