VNC very insecure

[MrFaber]

Is it possible to use SHA1 or an other secure hash instead of the old method because it seems to be very easy to crack the password from the registry.
http://phenoelit.de/fr/protos.html#VNC
Maybe there can be an option for compatible (insecure method) or new ultravnc password storing (with SHA1 or maybe SHA-256 ). If you activate the secure option the old values have to be removed.

CU
Mr Faber

[Rudi De Vos]

Direct registry hacking

The risk is limited, you need a standard windows password to get access to the registry.

If you can get access, you can change the password without
the need to crack it.
If you have physical access, you can boot from a linux cdrom
and even change the administrator account. AFter that you can do what you want.


Net sniffering and packet capturing

This is possible, for external connections you should always use some kind of extra encryption.
If somebody insite you network is capable of doing this, be sure he has 100 other ways of getting access. 99% of the security breaks are caused by users, how many bosses have there password on the bottom of there keyboard, or secured document are printed and left on the desk.

[SirNigel]

This is an old issue. Just make sure you use the mslogon and you should be fine.

[lenisham]

Is it possible to use SHA1 or an other secure hash instead of the old method because it seems to be very easy to crack the password from the registry.
http://phenoelit.de/fr/protos.html#VNC
Maybe there can be an option for compatible (insecure method) or new ultravnc password storing (with SHA1 or maybe SHA-256 ). If you activate the secure option the old values have to be removed.

CU
Mr Faber

As long as we're on the subject when will the file transfer require a password before allowing a connection and file transfers?