Re: How secured is Remote Desktop?

Hi,

Techmanblues wrote:
> How secured is Remote Desktop in its default settings when both
> machines are XP Pro with the latest patches? Obviously the initial
> handshaking when username and password are sent is encrypted, but is
> subsequent data tranfer also encrypted as well?

Yes.

> If so how strong is the encryption?

The highest available encryption level is used by default, which amounts to
128-bit RC4. There are some flaws with it -- plaintext checksums make a
cryptoanalysis attack potentially easier than it should be -- however, it's
still quite well encrypted and the keys are unique to each session.

The single layer of authentication (username and password only) is usually a
more serious problem. For high security requirements, consider wraping RDP
access with a VPN and smart card or certificate authentication.

For personal use, make sure your Windows user accounts have decent
passwords. If you only connect from certain locations (e.g. from the office
to your home computer) you can configure your firewall (or router, if there
is one) to only allow RDP connections from certain IP addresses or address
blocks.

--
Chris Priede




I


.

Relevant Pages

  • Re: WSE 3.0 + UserNameToken without X.509 Cert/Kerberos + Signing + Encryption How?
    ... signed messages using UserName stuff. ... do response encryption, but I added that and it's working to great effect. ... I'm at a loss on how to add an "authorization assertion" to ... between client and server using a UserNameToken that passes the UserName ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: one way permutation?
    ... with a name, get the salt from the row, do the computation ... In this case, you can use symmetric encryption, in a way that I will ... This isn't absolutely guaranteed against collisions, ... The username and password are encrypted, ...
    (sci.crypt)
  • Re: Simple VB.NET Web Application Encryption/Decryption of password
    ... Public Function Hash(string username, string password) ... > Do you have a one-way encryption example that you can point me to? ...
    (microsoft.public.dotnet.security)
  • Re: A quick question before I kill myself... (XP EFS)
    ... Encryption key is tied to profile and user under which it was first created ... Since you still have your old profile, username and everything else there is ... Administrator) changes your username's (e.g. tje) password you will lose ...
    (microsoft.public.windowsxp.security_admin)
  • Re: vb & mssql apps : security issue
    ... And I still don't know where to secure uid/pw on my complied code above. ... >> You could have the password an encryption of the username. ... > own encryption it should be one of the standard, published algorithms ...
    (microsoft.public.sqlserver.security)