3 ms·
If you're running FTP as plaintext you're indeed doing it wrong, I'm not sure that that must be what GP meant. Not as if we explicitly mention (START)TLS for ev
by lucgommans 5y ago
If you're running FTP as plaintext you're indeed doing it wrong, I'm not sure that that must be what GP meant. Not as if we explicitly mention (START)TLS for every other protocol that supports it.
- SilverRed 5y agoYou can't have secure FTP without a certificate and you can't have a certificate without DNS/domain names unless you want to manually add certificates around which is bad UX again. The ideal situation would be some universal airdrop which will never happen. The next easiest solution is to use cloud storage and send a link to the other person.
- lucgommans 5y agoYeah, that's fair. I think FileZilla shows who signed the cert, but yeah it still gives that pop-up asking the user to decide and I haven't checked whether they verify that signer against the system CA list. Either way, that's as canon as FTP clients get and since they don't have it, indeed it's mostly opportunistic encryption. (Not that relying on the CA system rather than TOFU'ing or sharing a fingerprint is without problems of its own, but that's a discussion for another thread.)