Is server password encrypted?

[pjme7154]

Just wondering, when I type in my password from the remote client, is it encrypted before it is sent to the server?

Thanks,
-PJ

[OldNick]

I would also be interedsted to know this. At present, I use a private phone line, but am looking using the Net.

Also, how secure is the password _on_ the Server machine? If somebody connects, networking, can they read / alter the VNC passwordon that machine at all?

Thanks for any advice

[lenisham]

Just wondering, when I type in my password from the remote client, is it encrypted before it is sent to the server?

Thanks,
-PJ

It is encrypted, but it is trivial to break the encryption. If I remember correctly Ettercap breaks it on the fly.

[lenisham]

I would also be interedsted to know this. At present, I use a private phone line, but am looking using the Net.

Also, how secure is the password _on_ the Server machine? If somebody connects, networking, can they read / alter the VNC passwordon that machine at all?

Thanks for any advice

It is stored encrypted, but default settings allow it to be changed. I know some of the later versions of 19 have some sccurity areoud this at least for the service password, but I don't know the details.

[UltraSam]

The password is never send over the connection.

- The server generates a random challenge (like "µ%l!§£@^bhg45")
- It encrypts this challenge (3DES) using the entered VNC password
- The server sends the UNencrypted challenge to the viewer
- The viewer encrypts the received challenge (3DES) using the entered VNC password
- The viewer sends its encrypted challenge back to the server
- The server checks if boths encrypted challenges match. If yes, the connection is allowed.

But the DES used is weak anyway. Can be cracked using brute force:
- Always use 8chars VNC passwords
- Use an encryption DSMPlugin, this way everything is additionnaly strongly encrypted, even connection handshaking.

[Guest]

Thanks both for the replies.

OK. I will use the DSM. If it works even on ther handshake, then it would mean that the person at the other end had to have the same setup exactly, even to break in to my system.

Thanks again.