6 ms·
As far as the password storage goes, you are not up-to-date. They are stored base64-encoded now. Yes, much better.
by vermilingua 11y ago
As far as the password storage goes, you are not up-to-date. They are stored base64-encoded now.
Yes, much better.
- scrollaway 11y agoFTP passwords can't be hashed. The right solution would be to support platform keyrings but ... https://trac.filezilla-project.org/ticket/1373 https://trac.filezilla-project.org/ticket/1373
- joopxiv 11y agoSomeone explained that after he got some malware on his computer and subsequently all his websites were hacked. The response? Once you've got malware on your computer, you've lost already, game over. You need to prevent the infection in the first place. OMFG...
- lmm 11y agoThat's correct though. Even if the passwords weren't stored at all, malware could just install a keylogger and record them when you typed them in.
- joopxiv 11y agoThe fact that there are ways to obtain passwords even when they are not stored unencrypted is not really a reason to make it as easy as possible for malware to get every password on your system.
- DanBC 11y agoNo, you're wrong. If you've run malware on your machine then it's not your machine anymore. This is exactly the thing that Google spent months trying to tell people when it was refusing to include password access to the password list. That extra password does nothing to increase security, and may be counter productive.
- lmm 11y agoEncrypting stored passwords gives users a misleading false sense of security.
- zamalek 11y ago> botg: All third-party offers can easily be declined. Nothing unwanted is being installed without your consent. Talk like that can only mean that they know about the malware bundling. Extremely interesting in combination with that quote of yours. Essentially: "the malware we install on your machine will get access to your passwords anyway." Looks like Filezilla will not die a hero's death.
- StavrosK 11y agoWhy can the passwords not be hashed?
- scrollaway 11y agoThe client needs them in plain text to be able to connect. "Remember password" is a feature, there. Like I said, correct solution is to use the keyring, but the dev team is incompetent, so ...
- danielbarla 11y agoThe application needs the original password so that it can pass it on to the FTP server.
- vermilingua 11y agoFTP is inherently insecure, everything is transmitted in plaintext. Because the server cannot check a password against a hash (due to the limitations of FTP), the client needs to store the password, and can't keep only a hash. That being said, Base64 is woefully inadequate, just google 'base64 decode'; and this response (from someone who appears to be a contributor) is just not a defence.
- icebraining 11y agoIf the server checked against a client-provided hash, the hash would become the password, and the attacker could just use the hash as-is to login to the server. Hashing on the client solves nothing.
- deleted 11y ago[deleted]
- mekal 11y agoI'm confused...who said they could be hashed?
- joopxiv 11y agoWas about to post the same thing. If this crap is posted by a contributer I'm moving away from it as fast as possible.
- scrollaway 11y agoIt is.
- TazeTSchnitzel 11y agoThat's nowhere near sufficient for 2015. rot13 at the very least.
- ashmud 11y agoWould a "master password" (a la Firefox/Thunderbird) be the way to go (as input to an encryption routine)? It seems like any credentials that can be automatically used after a program loads without the user authenticating are at risk for malware harvesting.