Password Encrypted or Just Session?

[EncryptAsker]

When initiating an ecrypted VNC session is the Password encrypted when sent over the network or only the session data after the password is confirmed.

If not is there a way to not send VNC Session passwords across networks in plain text?

Thanks

[Rudi De Vos]

Encryption is activated before you send the password.

Even without encryption plugin, passwords still use des encryption.

[EncryptAsker]

Wow thanks!

Someone told me that RealVNC sent the session passwords in plain text. I wasn't sure if that was true for Ultra or not.

Maybe I was misinformed all the way around.

This is really good though because I was running into policy issues prohibiting the use of any app that sends administrative type passwords across the network unencypted.

Thanks!

[Rudi De Vos]

Even realvnc use des encryption for the password.

The server send a random string to the viewer.
The viewer use this string to encrypt the password
The encrypted password is send to server
The server use the random string he has send to the viewer to decrypt the password.

The only problem is that des encryption is not strong, it's ok for
intranet use, but for internet connections you should use the encryption plugin or ssh....depending on the security level you need for your PC.