7 ms·

SFTP is completely different protocol. Notably, SFTP is not even a "file transfer" protocol (ie. GET/PUT), but full blown remote filesystem (which even has two

• Spivak 6y ago
  Look, yes SFTP is an extension of SSH and is a completely independent wire protocol with some different features and semantics. But from the user’s perspective it looks just like a different flavor of FTP and all the security comes from the underlying transport. It’s remarkably easy to accidentally let your users accidentally have more access than they should with SFTP because SSH is a complex protocol. A good example is that “SFTP only” users can still port forward by default unless you remember to turn it off. And SSH doesn’t have public CAs so in practice it’s a lot of blindly accepting keys. And with FTPS you have to remember to turn off anonymous access and that that dynamic port range makes firewalls annoying. There are trade-offs and no tool is going to be better in all situations. The idea that FTPS is bad and you should feel bad is more like the JSON vs XML debate than it is legitimate security gripes.