What are RealVNC 5.0 Authentication Protocol Security Limitations?

Question

In the old version of RealVNC, the password length was limited to 8 characters which was easier to be cracked. They have now increased the password length by 255 characters, will this make Realvnc authentication more secure now?

Answer 1

As I love KISS concept, (Keep It Simple as Stupid), I'm ready to trust VNC developpers to make my desktop transportable. But I'm more likely to trust OpenSSL developpers to build Secured Transport Layer.

In fact, I prefer to not authenticate VNC, than bind his TCP ports to OpenSSL to make this strong and efficient (using self-signed certificates protected by password and storing fingerprints in server).

Sample:

Running VNC server to listen only on localhost (127.0.0.1) and maybe, block VNC port (tcp 5900, to be verified) on firewall.

By default, first VNC session use tcp port 5900, but this could change if you have many VNC server on same host (multisession) or if you configure another port manualy.

Access via SSH, routing VNC port through SSH:

ssh -f -L 5900:127.0.0.1:5900 user@host sleep 10 && xvncviewer localhost

Nota: Some xvncviewer command line implementation accept a -via parameter. In fact, it is a wrapper to ssh:

xvncviewer -via user@host localhost

would do something like:

ssh -f -L 5599:127.0.0.1:5900 user@host sleep 20 && xvncviewer localhost:5599

Simple and efficient!

This use your SSH with all your config, keys, facilities and password managment. (may need cygwin for vnc server on windows).

Answer 2

Having a long password doesn't mean it's secure - the VNC client might still have vulnerabilities, such as the authentication bypass bug in versions 4.0 to 4.2.2. However, a limit of 255 characters is certainly better than a limit of 8 characters, since you can at least rule out a brute force.