4 ms·
Are there security issues with FTP, or do people just not use it enough because HTTP supplants it? I haven't used FTP in a while to download files.
by yingw787 7y ago
Are there security issues with FTP, or do people just not use it enough because HTTP supplants it? I haven't used FTP in a while to download files.
- liquidify 7y agoThe article indicates that it is insecure.... "The main reason why FTP is being removed is that it is considered insecure but Google's decision to remove support from Chrome certainly played a role in Mozilla's decision to remove support as well."
- yingw787 7y agoDamn. I should be downvoted, that's pretty blantant i-didnt-read-the-article. Thanks for the clarification.
- tyingq 7y agoPlaintext passwords over the net. Also, it's somewhat painful for NAT because it opens up a second port that isn't a named one, the client sends that port number to the server, then the server opens a connection to the client.
- duskwuff 7y agoThat's for active FTP, which basically nobody uses anymore (since it's incompatible with most firewalls). Most clients use the passive FTP extension, in which the server sends the client a host/port pair to connect to for the data connection. Still painful, but slightly less so.
- okraszo 7y agoFor sure it is unencrypted, so it is vulnerable to man-in-the-middle attacks.
- karatestomp 7y agoftps? Not to be confused with SFTP.
- sabujp 7y agoftp over ssl
- weare138 7y agoI'm sure the majority of people that still use FTP aren't relying on a browser for access but people still use it. Why not just deprecate standard FTP and only support FTPS and SFTP?
- duskwuff 7y agoBecause that'd amount to the same result as removing FTP. The "installed base" of web-accessible FTPS and SFTP resources is essentially zero, and that's unlikely to change -- if a web site was previously using FTP, they're probably going to move those resources to HTTP/S, not to another protocol which has limited browser support.
- weare138 7y ago> The "installed base" of web-accessible FTPS and SFTP resources is essentially zero Well that's true of SFTP, browsers don't support that protocol but I think they should. But FTP is still ubiquitous on the internet and most browsers like FF already support FTPS. To me it would make more sense to deprecate FTP like HTTP and warn users when their logging in over an insecure protocol than just kill the feature all together, especially if one of the primary reasons is because "Google did it". FTPS uses the same URI as FTP (ftp://). FTPS is common now, most people don't even realize they're using it. There are those of us that still need to deal with FTP and being able to click on a link in the browser rather than use a separate FTP client is just convenient. Just make it an optional feature and disable it by default.
- 7y ago
- calvinmorrison 7y agoWell it reeks a bit because from the article "Mozilla could have opted for implementing support for secure FTP in Firefox; a bug was filed 19 years ago to introduce support for SFTP in Firefox but nothing ever came out of it."
- duskwuff 7y agoNever happened because there was no use case for it. FTP made some sense to have in a browser because it supported unauthenticated downloads. SFTP, as a protocol which runs over SSH, basically requires authentication. (You could conceivably set up an SSH server to allow authentication against a "guest" user, but that gives security folks the heebie-jeebies.) So it doesn't really make sense to link to an SFTP resource in a web context, making it very low value to support in a browser.
- calvinmorrison 7y agoThat is extremely common no? Ex: checking out as an anonymous git user?
- duskwuff 7y ago> That is extremely common no? Ex: checking out as an anonymous git user? That almost always happens over the git protocol or git+http, not git+ssh.
- philipov 7y agoThe only FTP I use these days is really SFTP
- layoutIfNeeded 7y agoLast I’ve checked SFTP was much slower than FTP unless you used the HPN-SSH patches. Is this still the case?
- Someone 7y agohttps://en.wikipedia.org/wiki/File_Transfer_Protocol#Security https://en.wikipedia.org/wiki/File_Transfer_Protocol#Securit... lists many issues. The worst is that FTP transmits user names and passwords in cleartext. Having said that: nowadays it isn’t uncommon to say “FTP server” for a server running SFTP, its secure replacement, so it isn’t clear to me what exactly is being removed from Firefox.
- duskwuff 7y agoFTP is FTP. SFTP is SFTP -- a protocol which runs over SSH -- and Firefox doesn't support that. It wouldn't really make sense for it to do so, either; SFTP more or less requires SSH authentication, making it a poor fit for a web browser. There is FTPS (FTP + SSL/TLS), which Mozilla might support -- but that's rather rare.
- jcranmer 7y agoThe entirety of changes to one of the files in the past 13 years is here: https://hg.mozilla.org/mozilla-central/log/tip/netwerk/streamconv/converters/ParseFTPList.cpp https://hg.mozilla.org/mozilla-central/log/tip/netwerk/strea... There's more changes on nsFtpConnectionThread.cpp: https://hg.mozilla.org/mozilla-central/log/tip/netwerk/protocol/ftp/nsFtpConnectionThread.cpp https://hg.mozilla.org/mozilla-central/log/tip/netwerk/proto... Looking at those changes, it's clear that there has been very little substantive modifications to the FTP code itself, as opposed to keeping up with style guide changes, mass renamings, and API changes. So either you believe this 15 year old code is really rock-solid, stable, high-quality code, or you believe that it's a massive pile of bugs and security holes that no one's examined too closely. I know which one I believe.
- saagarjha 7y agoPerhaps they should take the opportunity to rewrite it in Rust.
- jcranmer 7y agoIf I'm reading the telemetry correctly (https://mzl.la/3bq5oFZ https://mzl.la/3bq5oFZ), there are ~6k people who used FTP to download a file in the past week or so. That's not enough users to really justify spending manpower rewriting it.
- jovial_cavalier 7y agoWhy is this comment grey?
- rhencke 7y agoYour monitor is likely running low on black ink.