Hi Klaatu,

You mentioned several times in the show that VNC is secure, that is not the case unless people tunnel the session over ssh or a vpn as you have done. This was not clear and may lead someone to assume that VNC in itself is secure.

https://www.cl.cam.ac.uk/research/dtg/attarchive/vnc/sshvnc.html
"VNC uses a random challenge-response system to provide the basic authentication that allows you to connect to a VNC server. This is reasonably secure; the password is not sent over the network. Once you are connected, however, traffic between the viewer and the server is unencrypted, and could be snooped by someone with access to the intervening network. We therefore recommend that if security is important to you, you 'tunnel' the VNC protocol through some more secure channel such as SSH."

Even the "reasonably secure" statement is challenged here:
https://en.wikipedia.org/wiki/Virtual_Network_Computing#Security
"By default, RFB is not a secure protocol. While passwords are not sent in plain-text (as in telnet), cracking could prove successful if both the encryption key and encoded password are sniffed from a network. For this reason it is recommended that a password of at least 8 characters be used. On the other hand, there is also an 8-character limit on some versions of VNC; if a password is sent exceeding 8 characters, the excess characters are removed and the truncated string is compared to the password."

I have also seen VNC security questioned for not requiring a username and password.

Recommendations:
use the -localhost option so that only local (and tunneled) connections are allowed
use ssh tunneling
use the maximum size password allowed