3 ms·

You could always just hard-code the username/password into the applet and recompile. That shouldn't be too hard... Or, if you control the FTP server, you could

by mbreese 14y ago

You could always just hard-code the username/password into the applet and recompile. That shouldn't be too hard... Or, if you control the FTP server, you could dynamically add and remove random virtual users/passwords to the FTP server (hopefully virtual users). Then when the client javascript gets the username/password, it could only be used once.

cstavish 14y ago
One could scan the .class file for string literals with relative ease. Obfuscation would be an improvement, but still not completely secure.
- gue5t 14y ago
  It would hardly be an improvement. Wireshark would be a first step for most reverse engineers when there's network authentication involved.
- mbreese 14y ago
  Well, we are talking about FTP, so the string is going to travel over the line in plaintext anyway.