In the old version of RealVNC, the password length was limited to 8 characters which was easier to be cracked. They have now increased the password length by 255 characters, will this make Realvnc authentication more secure now?


As I love KISS concept, (Keep It Simple as Stupid), I'm ready to trust VNC developpers to make my desktop transportable. But I'm more likely to trust OpenSSL developpers to build Secured Transport Layer.

In fact, I prefer to not authenticate VNC, than bind his TCP ports to OpenSSL to make this strong and efficient (using self-signed certificates protected by password and storing fingerprints in server).


Running VNC server to listen only on localhost ( and maybe, block VNC port (tcp 5900, to be verified) on firewall.

By default, first VNC session use tcp port 5900, but this could change if you have many VNC server on same host (multisession) or if you configure another port manualy.

Access via SSH, routing VNC port through SSH:

ssh -f -L 5900: user@host sleep 10 && xvncviewer localhost

Nota: Some xvncviewer command line implementation accept a -via parameter. In fact, it is a wrapper to ssh:

xvncviewer -via user@host localhost

would do something like:

ssh -f -L 5599: user@host sleep 20 && xvncviewer localhost:5599

Simple and efficient!

This use your SSH with all your config, keys, facilities and password managment. (may need cygwin for vnc server on windows).

| improve this answer | |

Having a long password doesn't mean it's secure - the VNC client might still have vulnerabilities, such as the authentication bypass bug in versions 4.0 to 4.2.2. However, a limit of 255 characters is certainly better than a limit of 8 characters, since you can at least rule out a brute force.

| improve this answer | |
  • Does this problem solve in VNC 5.0? – user236501 Dec 29 '12 at 13:49
  • I'm wondering how RealVNC are solving the MITM problem. I think I'll stick to transport across openssh tunnel. – ewanm89 Dec 29 '12 at 14:26
  • RealVNC still vulnerable to MITM, is that any article talk about this? – user236501 Dec 29 '12 at 14:47
  • @user236501 For the record, RealVNC products are not vulnerable to MITM attacks. The security uses an RSA Authenticated Key Exchange (AKE) protocol to establish the AES keys and nonces; it is not possible for a passive or active man-in-the-middle to decrypt traffic, or to impersonate either party. – Nicholas Wilson Jul 10 '14 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.