In the old version of RealVNC, the password length was limited to 8 characters which was easier to be cracked. They have now increased the password length by 255 characters, will this make Realvnc authentication more secure now?
As I love KISS concept, (Keep It Simple as Stupid), I'm ready to trust VNC developpers to make my desktop transportable. But I'm more likely to trust OpenSSL developpers to build Secured Transport Layer.
In fact, I prefer to not authenticate VNC, than bind his TCP ports to OpenSSL to make this strong and efficient (using self-signed certificates protected by password and storing fingerprints in server).
Running VNC server to listen only on localhost (
By default, first VNC session use tcp port 5900, but this could change if you have many VNC server on same host (multisession) or if you configure another port manualy.
Access via SSH, routing VNC port through SSH:
would do something like:
Simple and efficient!
This use your
Having a long password doesn't mean it's secure - the VNC client might still have vulnerabilities, such as the authentication bypass bug in versions 4.0 to 4.2.2. However, a limit of 255 characters is certainly better than a limit of 8 characters, since you can at least rule out a brute force.