Is there an actually secure VNC iOS app for use with OS X Screen Sharing?
The answer to that question is correct, but there are some nuances.
Screen Sharing server supports 4 authentication types:
- Mac OS X user login / password
- Apple ID
- Request for observe / control ("Anyone may request permission to control screen")
- VNC password ("VNC viewers may control screen with password")
Whenever the built-in Screen Sharing client (Cmd+K in Finder) connects to a Screen Sharing server, it uses only types 1, 2 and 3. Then server enables traffic encryption that may work in one of two modes: full encryption or keystroke/mouse move encryption. You could select encryption mode in earlier versions of Mac OS X, but in 10.8 (AFAIR) they removed this option, so Screen Sharing connection is always fully encrypted.
AFAIK there are only two third-party iOS clients that support Screen Sharing authentication types: Screens and Remotix. Both can use authentication types 1 and 3 with keystroke/mouse move encryption, but it seems that full encryption is provided only by Remotix.
Note that if a client uses VNC password (type 4) to connect to Screen Sharing server, then encryption is disabled at all.
MochaVNC lite uses Mac OS X user login / password. I've been using it forever and don't even remember how long ago they added Mac OS credential authentication. Unlike most other apps that support this feature you do not need the paid version. I use it sporadically mainly to perform software updates to a headless mac mini that is my home server and iTunes video library server.
Since I only use it locally I didn't really look into the security features it has. It is a free solution with a paid $6 version but I really haven't looked into the paid differences since the free solution works with screen sharing for me. As a side note, my mac mini works much better now that I bought a HDMI video dongle. It used to be very sluggish even though its on ethernet, turns out a headless mac mini doesn't use the video card unless there is a monitor (dongle) plugged in.