I could care less about their 2 factor auth, length of the cypto key, or whatever else is advertised to provide secure connection, because that is not the problem. All remote-control software should be built reasonably securely by now, that much should be taken for granted (review past years of vulnerabilities in RDP and VNC for a list of errors that should be avoided). It’s not about technology, but trust. Do I trust LogMeIn? Should I? Are they trustworthy?

Another, huge problem is that use of such software extends network perimeter to all of the Internet. I gave one example of shoulder surfing at an airport or cafe. Home user’s have little reason to care who looks over their shoulder, yet few fill out their tax returns on the airport. The same, however, cannot be said for corporate accountants, eager to finish work before whey show up home for a late supper. Corporate finances are far more interesting, because little no-risk gain can be glean from my tax information. The same is not true when the data belongs to a publicly traded company. I have more scenarios to offer, all more-or-less true.

I understand that corporate VPNs, requiring special software, tokens, time slots, etc are a in direct opposition to the everyday home computer use paradigm. That’s why huge numbers of totally insecure home/small business systems fall, as easy pray, to botnet operators. Most enterprises are able to avoid similar fate, but this success is partially paid by users in decreased usability or ease of access.

I will not claim here that nothing can be done. Ease of access is rarely high on the priority list of IT Sec departments, so there is little talent or money devoted to it. Sometimes instant, secure, fast, and all-encompassing access to ERP from home pc is just not going to happen. At other times rules can be changed when a proper and sensible argument is presented.

Again, this does not apply to home, or no-IT businesses. I would use gotomypc to get to home PC from work, sure, mostly because there is nothing of value on the PC. That is, nothing that cannot be stolen anyway, right from the browser, with smart but malicious use of *script.