Scott, The "email newsletter" from Tridia is incorrect. VNC has always used a challenge-response protocol for verifying the user's password, and so has never sent it in the clear. This simply sounds like their marketting team has misunderstood the point of encrypting the rest of the session. Wez @ RealVNC Ltd.