Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In the old version of RealVNC, the password length was limited to 8 characters which was easier to be cracked. They have now increased the password length by 255 characters, will this make Realvnc authentication more secure now?

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

As I love KISS concept, (Keep It Simple as Stupid), I'm ready to trust VNC developpers to make my desktop transportable. But I'm more likely to trust OpenSSL developpers to build Secured Transport Layer.

In fact, I prefer to not authenticate VNC, than bind his TCP ports to OpenSSL to make this strong and efficient (using self-signed certificates protected by password and storing fingerprints in server).

Sample:

Running VNC server to listen only on localhost (127.0.0.1) and maybe, block VNC port (tcp 5900, to be verified) on firewall.

By default, first VNC session use tcp port 5900, but this could change if you have many VNC server on same host (multisession) or if you configure another port manualy.

Access via SSH, routing VNC port through SSH:

ssh -f -L 5900:127.0.0.1:5900 user@host sleep 10 && xvncviewer localhost

Nota: Some xvncviewer command line implementation accept a -via parameter. In fact, it is a wrapper to ssh:

xvncviewer -via user@host localhost

would do something like:

ssh -f -L 5599:127.0.0.1:5900 user@host sleep 20 && xvncviewer localhost:5599

Simple and efficient!

This use your SSH with all your config, keys, facilities and password managment. (may need cygwin for vnc server on windows).

share|improve this answer
add comment

Having a long password doesn't mean it's secure - the VNC client might still have vulnerabilities, such as the authentication bypass bug in versions 4.0 to 4.2.2. However, a limit of 255 characters is certainly better than a limit of 8 characters, since you can at least rule out a brute force.

share|improve this answer
    
Does this problem solve in VNC 5.0? –  user236501 Dec 29 '12 at 13:49
    
I'm wondering how RealVNC are solving the MITM problem. I think I'll stick to transport across openssh tunnel. –  ewanm89 Dec 29 '12 at 14:26
    
RealVNC still vulnerable to MITM, is that any article talk about this? –  user236501 Dec 29 '12 at 14:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.