{"action":"created","issue":{"url":"https://api.github.com/repos/TigerVNC/tigervnc/issues/601","repository_url":"https://api.github.com/repos/TigerVNC/tigervnc","labels_url":"https://api.github.com/repos/TigerVNC/tigervnc/issues/601/labels{/name}","comments_url":"https://api.github.com/repos/TigerVNC/tigervnc/issues/601/comments","events_url":"https://api.github.com/repos/TigerVNC/tigervnc/issues/601/events","html_url":"https://github.com/TigerVNC/tigervnc/issues/601","id":299272973,"number":601,"title":"TigerVNC is extremely insecure and should not be used.","user":{"login":"a-raccoon","id":1052090,"avatar_url":"https://avatars1.githubusercontent.com/u/1052090?v=4","gravatar_id":"","url":"https://api.github.com/users/a-raccoon","html_url":"https://github.com/a-raccoon","followers_url":"https://api.github.com/users/a-raccoon/followers","following_url":"https://api.github.com/users/a-raccoon/following{/other_user}","gists_url":"https://api.github.com/users/a-raccoon/gists{/gist_id}","starred_url":"https://api.github.com/users/a-raccoon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/a-raccoon/subscriptions","organizations_url":"https://api.github.com/users/a-raccoon/orgs","repos_url":"https://api.github.com/users/a-raccoon/repos","events_url":"https://api.github.com/users/a-raccoon/events{/privacy}","received_events_url":"https://api.github.com/users/a-raccoon/received_events","type":"User","site_admin":false},"labels":[{"id":109518517,"url":"https://api.github.com/repos/TigerVNC/tigervnc/labels/duplicate","name":"duplicate","color":"cccccc","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-02-22T09:13:46Z","updated_at":"2018-02-22T20:34:26Z","closed_at":"2018-02-22T12:00:37Z","author_association":"NONE","body":"Not documented anywhere in the FAQ; TigerVNC passwords (and likely its authentication methods) are entirely insecure.\r\n\r\n- Passwords are limited to 8 characters in length, even if you specify 20.\r\n  - Extra characters are silently ignored and TigerVNC pretends they're useful.\r\n  - Try it!: Enter only the first 8 characters of your password to log in.\r\n\r\n- Passwords are stored on the server in DES encrypted (effectively plain text).\r\n  - In Windows: HKEY_LOCAL_MACHINE\\SOFTWARE\\TigerVNC\\WinVNC4\\Password\r\n\r\n- This weakness has been known for at least 11 years and is readily exploited with common tools.\r\n  - (details) https://www.raymond.cc/blog/crack-or-decrypt-vnc-server-encrypted-password/\r\n  - (download) https://www.raymond.cc/blog/wp-content/plugins/download-monitor/download.php?id=232\r\n  - (download) http://aluigi.org/pwdrec/vncpwd.zip\r\n  - (virustotal) https://www.virustotal.com/#/file/9d773bd8045688eb8fbb0baa0dfe161aef1a1feb1a4a696289b13e99707270c9/detection\r\n\r\nPasswords should be stored, at minimum, as a one-way hash that cannot be decrypted. They do not need to be decryptable for any practical purpose.  Anyone can brute force an 8 character password, even without gaining momentary access to the local system."},"comment":{"url":"https://api.github.com/repos/TigerVNC/tigervnc/issues/comments/367813304","html_url":"https://github.com/TigerVNC/tigervnc/issues/601#issuecomment-367813304","issue_url":"https://api.github.com/repos/TigerVNC/tigervnc/issues/601","id":367813304,"user":{"login":"a-raccoon","id":1052090,"avatar_url":"https://avatars1.githubusercontent.com/u/1052090?v=4","gravatar_id":"","url":"https://api.github.com/users/a-raccoon","html_url":"https://github.com/a-raccoon","followers_url":"https://api.github.com/users/a-raccoon/followers","following_url":"https://api.github.com/users/a-raccoon/following{/other_user}","gists_url":"https://api.github.com/users/a-raccoon/gists{/gist_id}","starred_url":"https://api.github.com/users/a-raccoon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/a-raccoon/subscriptions","organizations_url":"https://api.github.com/users/a-raccoon/orgs","repos_url":"https://api.github.com/users/a-raccoon/repos","events_url":"https://api.github.com/users/a-raccoon/events{/privacy}","received_events_url":"https://api.github.com/users/a-raccoon/received_events","type":"User","site_admin":false},"created_at":"2018-02-22T20:34:26Z","updated_at":"2018-02-22T20:34:26Z","author_association":"NONE","body":"My remarks are anything but snarky.  You also mistaken user who submit feedback, bug reports and security advisories as \"programmers who need to fix it for themselves or shut up.\"  This is not the case."}}
{"actor":{"display_login":"a-raccoon"}}