Security Question

bvierra · Post by **bvierra** » 2010-11-30 01:25

In the SRC/InstantSupport_File/instatnsupport.ini there is a second password:
passwd2=BEB49784199CB48172

This never changes. Is it a 'backdoor' password of some sort?
I removed it and it all seems to still work, just worries me that it was there.

supercoe · Post by **supercoe** » 2010-11-30 14:36

It's the view only password for UltraVNC, nothing to worry about.

EDIT:
Which I've simply set to random keys I hit on the keyboard.
I didn't realize this could be left blank, maybe that will be a better option.

Yod4z · Post by **Yod4z** » 2010-12-21 15:19

not related with the first question but related to the topic name.

What encryption are use by default 3.2 version? AES CFB 256bits?
How is used the SecureVNCPlugin.dsm? there's no Viewer_ClientAuth.pkey or Server_ClientAuth.pubkey used in chunkVNC 3.2?

redge · Post by **redge** » 2010-12-21 23:09

the default settings of SecureVNC
Default configuration uses 2048-bit RSA keys and 256-bit AES keys.

Yod4z · Post by **Yod4z** » 2010-12-22 09:47

then it use OFB in place of CFB

, less secure

but there's no key with the instantsupport to crypte the connexion

supercoe · Post by **supercoe** » 2010-12-22 14:10

Yod4z,

Currently SecureVNC is setup to use the set VNC password which uses the encryption redge states.

You seem to know a lot about encryption, which way would you suggest as being the most secure? Should I be using the generated keys?

The way I see it:
Security is like locking the doors of your car, it'll keep honest people honest but anyone can just bust the window.

Yod4z · Post by **Yod4z** » 2010-12-22 15:31

the problem are the restriction from the operator that want me to use AES CFB 128bits minimal encryption because of security risk.

I try to configure the plugin option in ultravnc.ini directly and see what it do.

I see the dev of this plugin have in mind to the next version to set CFB as default encryption.

The plugin encrypt the connexion or only the password?

supercoe · Post by **supercoe** » 2010-12-22 15:59

Try this:

Edit SRC\InstantSupport_Files\ultravnc.ini

Change:

For 128bit AES-CFB

Code: Select all

DSMPluginConfig=SecureVNC;0;0x00101020;

For 256bit AES-CFB

Code: Select all

DSMPluginConfig=SecureVNC;0;0x00104020;

The SecureVNC plugin encrypts the connection only at this point, it will encrypt the password in the future.

Yod4z · Post by **Yod4z** » 2010-12-22 18:05

that's what i use in my modified chunkVNC 3.1

and it work great

UltraVNC

Security Question

Security Question

Re: Security Question

Re: Security Question

Re: Security Question

Re: Security Question

Re: Security Question

Re: Security Question

Re: Security Question

Re: Security Question