Mac Forum / General / General / March 2006

There are vnc-specific two security issues here.  First, since the data
on an established vnc connection is unencrypted, a snooper could watch
all your virtual keystrokes once the connection is established (the data
stream is compressed but that's easy for an evil-doer to deal with).  If
you happen to type in a password during your vnc session, it would be
compromised in this scenario.

Second, this way of running vnc is vulnerable to automated password
crackers.

A third issue is not specific to vnc.  Any service ports exposed to the
net at large are going to be hammered by port scanners looking for entry
points.  The fewer of these you have, the better.

If you tunnel vnc through ssh and configure the vnc server to accept
connections only from localhost, these issues go away.  Everything is
encrypted, the ports are not exposed, and a password guesser has nothing
to talk to. The downside is that ssh adds overhead, which means slower
response time.  

In article
<kurt.r.todoroff-E9E35A.15545331032006@comcast.dca.giganews.com>,

So, you're using the well-known VNC ports and opened them to the general
population.  Unless you leave the macs logged in, an intruder would need
to guess two passwords: one for the VNC connection and another to
establish a login on the target machine.  If the Mac is left in the
logged-in state, only one password need be guessed.

You could tighten security by using ssh and disabling password
authentication.  With two target machines, you would either configure
the machines to run sshd on different ports, forwarded by your router,
or only open one machine and have it tunnel to the second machine.  
Either way would work and, once configured, remote usage would look the
same.

I use and recommend the ssh with public key authentication method, but
that's just me.

Well, the fact that you're not using wireless is a good thing since
essentially all your communication is not encrypted. So, passwords etc.
are sent over as clear text, unless TightVNC has changed since i last
used it.

You can set up OSXvnc to allow only 'local' (localhost) connections. And
then tunnel your TightVNC session through SSH using Putty on your
Windows boxes. Much safer. Lots of google comes up with SSH tunneling
using Putty.