Full Disclosure mailing list archives
Re: Filezilla's silent caching of user's credentials
From: Christian Sciberras <uuf6429 () gmail com>
Date: Thu, 14 Oct 2010 17:13:04 +0200
Valdis, the thing is, if people want their password-keeping software secure, they ought to be limiting access to this said software. Instead, what we are proposing here is limiting software capability. Why? I can't back up the password file reliably anymore, thanks to this "feature". I can't understand why we are encrypting the file from this level, rather than relying on the environment. The only reason I can see so far (which you and others have repeatedly cited) is that the said environment *might* not be secure. My opinion about this? I'd rather have to fix the environment than have to maintain both. Then again, security is all about layers and adding bloat upon bloat to somewhat limit access. Since there seems to be some sort of "standard" which everyone seems to have agreed on, this is where I quit. Though I still see this idea as simply adding bloat without a real cause. On Thu, Oct 14, 2010 at 4:49 PM, <Valdis.Kletnieks () vt edu> wrote:
On Thu, 14 Oct 2010 10:20:30 +0200, Christian Sciberras said:And that is my point exactly. While I'm shouting out loud, let me ask aquestion:How many FD readers are dumb enough to share their harddisks with theworld?None? So what is the problem in using FileZilla personally? I mean,anyone whichtakes security seriously, would be encrypting their drive in the first place.The problem is that "FD readers" and "anyone who takes security seriously" are vanishingly small corners of the total Internet population. Yes, there may be 5,000 race car drivers in the US who can do amazing drifts and the like if a car isn't equipped with anti-lock brakes. That doesn't mean that they aren't a better choice for the other 200 million drivers in the US. Similarly, the fact that a security feature isn't strictly needed on the 0.2% of systems that are properly administered doesn't mean that the programmer shouldn't be thinking about the other 99.8% of users where the feature will add incremental benefit. Think: Why does SSH use a passphrase to protect your private key by default, and why does it allow the *optional* omission of said passphrase? Why shouldn't the exact same reasoning apply to all other software that stores credentials?
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Filezilla's silent caching of user's credentials, (continued)
- Re: Filezilla's silent caching of user's credentials silky (Oct 13)
- Re: Filezilla's silent caching of user's credentials Christian Sciberras (Oct 13)
- Re: Filezilla's silent caching of user's credentials silky (Oct 13)
- Re: Filezilla's silent caching of user's credentials Christian Sciberras (Oct 13)
- Re: Filezilla's silent caching of user's credentials silky (Oct 13)
- Re: Filezilla's silent caching of user's credentials Chris Evans (Oct 14)
- Re: Filezilla's silent caching of user's credentials silky (Oct 14)
- Re: Filezilla's silent caching of user's credentials Christian Sciberras (Oct 14)
- Re: Filezilla's silent caching of user's credentials silky (Oct 14)
- Re: Filezilla's silent caching of user's credentials Valdis . Kletnieks (Oct 14)
- Re: Filezilla's silent caching of user's credentials Christian Sciberras (Oct 14)
- Re: Filezilla's silent caching of user's credentials Valdis . Kletnieks (Oct 14)
- Re: Filezilla's silent caching of user's credentials Pete Smith (Oct 14)
- Re: Filezilla's silent caching of user's credentials Adnan Vatandas (Oct 14)
- Re: Filezilla's silent caching of user's credentials Jeffrey Walton (Oct 14)
- Re: Filezilla's silent caching of user's credentials Andrew Farmer (Oct 16)
- Re: Filezilla's silent caching of user's credentials Adnan Vatandas (Oct 14)
- Re: Filezilla's silent caching of user's credentials Christian Sciberras (Oct 14)