Is there a version of VNC that stores its password more securely? TightVNC and RealVNC both store their password in the registry using DES, but since the key is know it’s trivial to decrypt it.
Printable View
Is there a version of VNC that stores its password more securely? TightVNC and RealVNC both store their password in the registry using DES, but since the key is know it’s trivial to decrypt it.
Well, I found UltraVNC:
http://ultravnc.sourceforge.net/index.html
it lets me use Doman authentication, bad side is it's flaky as hell and the only platform it runs on seems to be windows.
Yep, Ultra is what I use. On top of domain auth, it offers file transfer too.
Hey Iron, wanna know another secret? No matter what you set the password in RealVNC, it will only look at the first 8 characters. Give it a try. ;)
I've noticed the 8 character limit, VNC it's something I’ve been researching for my presentation. I’m surprised that after all these years Real and Tight have not added more security features. Ultra is doing some work in that area, but it’s only for Windows. Also, Ultra’s Java client does not seem to work with MS login. Thanks Horse.
Probably because this restriction exists on Linux machines if one uses DES encryption, it's actually to do with the enryption algorithm. SHA1 would be ideal I'd suppose.
Try using TightVNC.
Read the first post.Quote:
Sorry, not fully awake yet. Me = retard...
That's ok. I like tight VNC, it just does not have the options I need.
I also use TightVNC. I just keep it in my private LAN, behind firewall....
until it gets at least two layers of authenticating I don't trust it for public networks
I'm more worried about the fact that to password is almost a bad as plain text in the registry (DES encrypted, but with a known key). I wourk on a campus LAN so there are plenty of folks we can't trust.
Couldnt you just run VNC over SSH?
*guesses he should acctually read the post...
No, my problem is the password is stored in the registry and others have physical access to the box.
FYI: Only the free versions have that limitation.Quote:
Originally posted here by thehorse13
Hey Iron, wanna know another secret? No matter what you set the password in RealVNC, it will only look at the first 8 characters. Give it a try. ;)
Buy the realVNC personal or enterprise edition for strnoger encryption, 128bit AES.
Personal edition is only $30.
enterprise is $50.
peace