1

I understand that VNC is not encrypted, which is fine if I tunnel with SSH. But what about setting a password? Is it really helpful? Or is it really a joke?

  • 1
    You can use a password but the traffic is not encrypted which means unless it’s encrypted the password is transmitted in the clear – Ramhound Dec 11 '17 at 17:13
  • @Ramhound If someone gains access to the computer, locally, can he see the password and access the session, even though I'm connecting through SSH? That should be possible, right? – The Quantum Physicist Dec 11 '17 at 17:37
  • What? If anyone has physical access to a machine then all bets are off on what’s possible. Physical access changes any answers dramatically – Ramhound Dec 11 '17 at 17:41
  • @TheQuantumPhysicist It's always better to use a password than not using it at all. Even if the traffic is not encrypted, the one gets access to the pc locally may not have the proper skills, or tools, to catchsaid password. You can use a small chainlock to lock your door, it might not stop the Police to swat your house, but it will keep a bunch of kids away. – dmb Dec 11 '17 at 17:43
0

Well, the manual says

vncpasswd['s] ... default behavior is to prompt for a VNC password and then store an obfuscated version of this password to a file. ... Note that the stored password is not encrypted securely - anyone who has access to this file can trivially find out the plain-text password, so vncpasswd always sets appropriate permissions (read and write only by the owner.) However, when accessing a VNC desktop, a challenge-response mechanism is used over the wire making it hard for anyone to crack the password simply by snooping on the network.

This is enough to keep out the idly curious, or the other user on your machine who has forgotten their display number and tried to connect to your display by mistake, but it sounds like not enough to keep out a determined attacker.

Note especially that the password file is "obfuscated," rather than encrypted; anyone who can read your read-only files can trivially determine the password.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.