Update: UltraVNC 1.4.3.6 and UltraVNC SC 1.4.3.6: viewtopic.php?t=37885
Important: Please update to latest version before to create a reply, a topic or an issue: viewtopic.php?t=37864

Join us on social networks and share our announcements:
- Website: https://uvnc.com/
- GitHub: https://github.com/ultravnc
- Mastodon: https://mastodon.social/@ultravnc
- Facebook: https://www.facebook.com/ultravnc1
- X/Twitter: https://twitter.com/ultravnc1
- Reddit community: https://www.reddit.com/r/ultravnc
- OpenHub: https://openhub.net/p/ultravnc

Is MS logon password and username sent as clear text

Should you have problems with the MS logon plugin, here's the place to look for help or report issues
Post Reply
raymondb
Posts: 5
Joined: 2006-02-25 12:06

Is MS logon password and username sent as clear text

Post by raymondb »

Can someone please advise as to whether MS logon passwords and usernames are sent as clear text when not using DSM? I know that MS Remote Desktop doesn't send them as clear text so I'm hoping UltraVNC doesn't either. If it does, where can I suggest this be changed in the next version?

thanks.
Last edited by raymondb on 2006-02-25 13:34, edited 1 time in total.
raymondb
Posts: 5
Joined: 2006-02-25 12:06

Post by raymondb »

After searching this forum I found a reply to a similar topic that said MSlogon is encrypted but it's a weaker encryption than DSM. Is this true? If so, how unsafe is this to use over the internet? I don't need fully encrypted sessions so would be nice if the encryption for MS logon could be strengthened so I don't have to use DSM.
scovel
100
100
Posts: 307
Joined: 2004-07-12 11:56
Location: CT, USA
Contact:

Post by scovel »

VNC (in general) uses 3DES for password encryption. You have to decide for yourself if 3DES is strong enough encryption to protect access to your machines.
raymondb
Posts: 5
Joined: 2006-02-25 12:06

Post by raymondb »

OK, thanks but I think only UltraVNC has the ability to use Windows username and password via it's MS Logon option. I'm wondering if Ultra VNC encrypts both username and password in this case.

Also I've read in other posts that standard VNC (ie. when not using the Ultra VNC's MS Logon option) transmits passwords in clear text. So does anyone know for sure which it is?

Now I guess I'm asking 2 questions above....

a. Does UtraVNC's MS Logon option use encryption for both the username and password or not and what kind of encryption is it?
b. Does standard VNC use 3DES encryption for transmitting passwords or are they transmitted as clear text?
scovel
100
100
Posts: 307
Joined: 2004-07-12 11:56
Location: CT, USA
Contact:

Post by scovel »

I answered B. If you don't believe my answer then go read the source code. That way you'll be sure. ALL VNC's use 3DES to encrypt the password.

Sean
raymondb
Posts: 5
Joined: 2006-02-25 12:06

Post by raymondb »

scovel wrote:I answered B. If you don't believe my answer then go read the source code. That way you'll be sure. ALL VNC's use 3DES to encrypt the password.

Sean
ok, ok, i believe you. Thanks for your help. You don't blame me for wanting to get verification do you?

So now for question a). I can't speak, read or write source code so would much appreciate if someone could answer this for me.

cheers
User avatar
Rudi De Vos
Admin & Developer
Admin & Developer
Posts: 6831
Joined: 2004-04-23 10:21
Contact:

Post by Rudi De Vos »

Standard vnc passwd
MS-logon user/passwd

---> all are encrypted using DES

A standard sniffer can't see the password. You are safe for some people.
No plain text password.

But as Wifi encryption can be broken in 2 minutes, DES is not secure against sniffers with des decryptors.

It just depend how you use vnc.
+ For temp access and no secret data on your PC, encryption is not needed. If you are in front of the PC you can always see what happen.
+ If you setup winvnc to run as service and your PC is 24 hours connected, use the extra encryption plugin.

Using the encryption plugin, passwd/user is 2 times encrypted.
The DES encryption is encapsulated ib the plugin encryption.
raymondb
Posts: 5
Joined: 2006-02-25 12:06

Post by raymondb »

Thanks Rudi, much appreciated.
Post Reply