alt Hacker News> This is a networked service. You send your password (or a hashed form) to it
Hopefully neither. But given everybody involved in VNC seems to be the same batch of clueless morons who built all those PHP web forums twenty years ago with MD5 as the password hash, who knows what they cobbled together. Maybe an expert can chime in about what actually happens here?
Yes, for a sensible scheme this can't work.
I’m not an expert in RustDesk, but I did take a quick look at the code, and it’s filled with massive red flags like [1], where it appears the general mechanism is SHA256(SHA256(password++salt)++challenge). I can’t even tell if the whole thing is vulnerable to trivial MITM ([2] makes it sound like it might be; while investigating, I ran into the concerning comment [3], “fall back to non-secure connection in case pk mismatch”). I can’t find any actual documentation of the protocol and it’s a custom thing built on NaCl boxes, yikes. [4] generates a keypair on the fly for a new connection to sign the box containing the symmetric key generated at the same time…
I would recommend never using this software.
[1]: https://github.com/rustdesk/rustdesk/blob/7aa98d43cf1962a7a2... [2]: https://github.com/rustdesk/rustdesk/discussions/8392 [3]: https://github.com/rustdesk/rustdesk/blob/7aa98d43cf1962a7a2... [4]: https://github.com/rustdesk/rustdesk/blob/7aa98d43cf1962a7a2...