What if anything is encrypted without DSM plugin?

[bilbus]

i searched the faq's section and found nothing about encription (other then 1 dsm post)

I was wondering what is encrypted without the plugin. I wanted to be sure the password was.

Also if you dont use the plugin is it posable for somone to watch the vnc screen from a remote pc?

thanks

[UltraSam]

Yes the password is somewhat encrypted when stored in the regitry (server side), but the algo is dummy and the key is public (in the source code !). A few seconds is enought to crack it if the person has access to your server registry.

When handshaking is done, the password does not transit between the viewer and the server.
Instead a (weak) encrypted challenge of the password+random bytes is send to the server.

Nothing else is encrypted.

So yes, someone can spy your connection and visualize/record your session as well as you. It's especially easy to achieve as the source code is public.

It's also -quite- easy to get your password by using the "Man in the middle" trick

Using the DSM Plugin prevents all these risks:
- Everything is encrypted from the very first byte.
- Both sides need an additionnal key file to be able to "understand" the other side. So the man in the middle trick can't be used in this case.

[bilbus]

thanks, i will need to get the plugin then.

Any chance you will intergrate the plugin into the next or an upcomming version?

[bevtech]

bilbus,

If you downloaded Utlra VNC 1.0.1 the plugin is already on your machine. You can find it under the plugin directory of your UVnc installation folder. You have to copy the *.dsm files to the Ultra VNC root folder

And follow the FAQ How do I install the MRC4 plugin in Ultra VNC
[topic=3049][/topic]