Topic closed

[JohnMcKinsey]

Topic closed

[kanaka]

Short answer: RDP (VNC) sends less identifying info than RDP, but remote frame buffer protocols in general are probably not a good way to stay anonymous.

Longer answer:

I'm not intimately familiar with the RDP protocol. A VNC client does send the version of the RFB protocol it supports, and security types and render encodings that it supports. Those tend to be fairly generic. From the initial handshake, somebody might be able to tell you are running noVNC and maybe which major version of noVNC but probably not much more. So there is less identifying information in the initial RFB handshake than there is for RDP.

However, note that any sort of remote frame buffer protocol is problematic if you are trying to remain anonymous because mouse movements and keyboard typing are sent to the remote server. It has been demonstrated that this sort of information provides a fairly unique user fingerprint: each person uses the mouse differently, uses a specific timing pattern when typing and tends to make certain typos over and over. I'm also not intimately familiar with the Tor browser and whether it attempts to limit fingerprinting via mouse movement and keyboard typing patterns. Even if it has mechanisms to limit that sort of fingerprinting, I wouldn't count on it working particularly well unless it adds so much latency to mouse and keyboard events that it would be noticeable and annoying.

So it's probably better than RDP. And probably better than a regular VNC client (since the browser inherently adds some jitter and latency to user input), but probably still not that great. If anonymity is critical for you, I wouldn't use a remote frame buffer system at all. Note, that I could see creating a variant of noVNC that modifies what is being sent. For example, only sends mouse clicks and not mouse movement and only sends key events on quarter second boundaries. But I'm not an expert on staying anonymous online so that just me thinking out loud.

[JohnMcKinsey]

Topic closed

[JohnMcKinsey]

Topic closed

[samhed]

noVNC will log to the browser console, that log includes RFB protocol version if log-level is set to INFO or higher. On the server-side you will have logs from your VNC server (which of course differs depending on which server you use) and connection logs from Websockify if you use that. As far as user-actions go, that's nothing the RFB protocol is aware of..

We can't really answer for the server side of things.. since noVNC is only a client.

[JohnMcKinsey]

Topic closed

[samhed]

Nope, it's not included in the RFB protocol (VNC) and not possible with noVNC.

[kanaka]

@JohnMcKinsey Again, I'm not an expert, but my understanding is that a common way that people who use anonymization tools have been unmasked is that they are fingerprinted while using those tools and this is later correlated with logs/records/fingerprinting when they access the Internet without those tools (which is probably inevitable regardless of how diligent a person is). So if you must use a remote frame buffer service, then noVNC (on Tor) is probably better than regular VNC is better than RDP. But using a frame buffer service (regardless of whether noVNC and/or Tor) still increases your fingerprint IMO.