J'ai rien dit j'ai mal cherché :
VNC uses a random challenge-response system to provide the basic authentication that allows you to connect to a VNC server. This is reasonably secure; the password is not sent over the network. Once you are connected, however, traffic between the viewer and the server is unencrypted, and could be snooped by someone with access to the intervening network. We therefore recommend that if security is important to you, you 'tunnel' the VNC protocol through some more secure channel such as SSH.
Donc c'est seulement au moment de l'authentification qu'il y a du cryptage, ensuite tout est en clair.
Mais y'a moyen de tout securiser avec SSH.
Voir cette page : http://www.uk.research.att.com/vnc/sshvnc.html