Full Disclosure mailing list archives
Re: Security issue in Filezilla 3.0.9.2:passwordsare stored in plain text (sitemanager.xml)
From: "Micheal Cottingham" <techie.micheal () gmail com>
Date: Mon, 21 Apr 2008 13:51:54 -0400
But, but, feet are tasty. I can't believe people are commenting in here not knowing that FTP is plaintext. Any infosec 101 book will tell you this. Along with telnet. Don't use them, use the secure alternatives, such as FTPS or SFTP (which is indeed a subprocess of SSH, look at sshd.conf if you don't believe me, nevermind that it was already covered) and SSH in place of telnet. Those protocols are specifically meant to replace their insecure counterparts. Here's a few references on this "discovery." http://forum.filezilla-project.org/viewtopic.php?f=2&t=5906&p=20285&hilit=xml+plaintext#p20285 http://forum.filezilla-project.org/viewtopic.php?f=4&t=1328&p=4660&hilit=xml+plaintext#p4660 If you don't want your passwords stored in this manner, remember your passwords or use a password manager. On Mon, Apr 21, 2008 at 12:57 PM, <Valdis.Kletnieks () vt edu> wrote:
On Mon, 21 Apr 2008 12:04:41 EDT, Joey Mengele said: > I think you are mistaken. Perhaps you have an outdated version of > the document in question? No, it is you that is sadly mistaken. IETF RFCs are not versioned. If substantial changes are made, the document is re-issued with a new number. And you'd know that if you had actually spent any significant time reading RFCs. Hint: When arguing about the contents of an RFC, it's usually advisable to actually have found and read said RFC before opening your mouth in order to insert your foot. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Security issue in Filezilla 3.0.9.2:passwordsare stored in plain text (sitemanager.xml) Joey Mengele (Apr 21)
- Re: Security issue in Filezilla 3.0.9.2:passwordsare stored in plain text (sitemanager.xml) Valdis . Kletnieks (Apr 21)
- Re: Security issue in Filezilla 3.0.9.2:passwordsare stored in plain text (sitemanager.xml) Micheal Cottingham (Apr 21)
- Re: Security issue in Filezilla 3.0.9.2:passwordsare stored in plain text (sitemanager.xml) Valdis . Kletnieks (Apr 21)
- <Possible follow-ups>
- Re: Security issue in Filezilla 3.0.9.2:passwordsare stored in plain text (sitemanager.xml) Joey Mengele (Apr 21)
- Re: Security issue in Filezilla 3.0.9.2:passwordsare stored in plain text (sitemanager.xml) Valdis . Kletnieks (Apr 21)
- Re: Security issue in Filezilla 3.0.9.2:passwordsare stored in plain text (sitemanager.xml) Andrew Farmer (Apr 21)
- Re: Security issue in Filezilla 3.0.9.2:passwordsare stored in plain text (sitemanager.xml) Valdis . Kletnieks (Apr 21)
- Re: Security issue in Filezilla 3.0.9.2:passwordsare stored in plain text (sitemanager.xml) Valdis . Kletnieks (Apr 21)
- Re: Security issue in Filezilla 3.0.9.2:passwordsare stored in plain text (sitemanager.xml) Valdis . Kletnieks (Apr 21)