Security Fix Question

[jgray]

I see in the change information for version 1.1.0.0 it says this:

-security fix ( encryption plugin + vnc passwd : password can be broken)

I was curious to the nature of this as it relates to running the current non-beta version (1.0.9.6.2). Is this an issue specifically related to using an encryption plugin... meaning that if a plugin is used then the password can be broken? In that case would it be better to run it without the encryption plugin?

[stack]

I was also having hard time finding specifics about this fix. The closest I came to the explanation was from the history screen of 1.1.0.0 installer:

-new vncpasswd + encryption.
Instead of using the password as part of the encryption, we now check the password insite the encryption by the server. This allow the server to balcklist servers after x fault password.

WARNING: If using encryption plugin + vncpassword you better upgrade. No protection against Brute force password hacking."

I guess that still doesn't answer your question. So I too would appreciate if someone could shed the light on this.
And also clarify if encryption plugin + new ms login combo in 1.0.9.6.2 is vulnerable to the same attack.

Thank you