Full Disclosure mailing list archives
Re: Filezilla's silent caching of user's credentials
From: Christian Sciberras <uuf6429 () gmail com>
Date: Thu, 14 Oct 2010 01:57:03 +0200
If the encryption key stays on the same PC, there is absolutely no security in that. Given that this is open source, security through obscurity can't even start working (-> encrypting local files with a local key / using custom algo == security through obscurity). I think it ought to stay plaintext and people limit access to this file whenever possible. It's hardly a trivial matter to delete this file....if an attacker can search for and read this file, a user could search for the same file and delete it. Fortunately, for the poor souls out there that allow read access to their drives, computer forensics haven't caught up yet (and probably won't in the near future). My 2 cents. Chris. On Thu, Oct 14, 2010 at 12:41 AM, silky <michaelslists () gmail com> wrote:
On Wed, Oct 13, 2010 at 2:33 PM, Mutiny <mutiny () kevinbeardsucks com> wrote:The issue is that someone gained access to that file. You sharing your drives over the internet with read privileges? You have other vulnerable software being leveraged to read that file? Would you prefer they MD5'd it? It sounds like your issue is that your password is stored. I mean, they moved your encrypted password from passwd to shadow for a reason, but that doesn't change the fact that it's stored and if someone doesn't need access to shadow or passwd, they shouldn't have it. Stop logging into your FTP server from a public terminal with Filezilla.Rubbish. The passwords should be encoded so-as to avoid trivial searching. End of story. It takes 10 minutes to do from a development point of view, and there is no excuse. -- silky http://dnoondt.wordpress.com/ "Every morning when I wake up, I experience an exquisite joy — the joy of being this signature." _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Filezilla's silent caching of user's credentials, (continued)
- Re: Filezilla's silent caching of user's credentials Charles Morris (Oct 08)
- Re: Filezilla's silent caching of user's credentials Shirish Padalkar (Oct 09)
- Re: Filezilla's silent caching of user's credentials Vipul Agarwal (Oct 09)
- Re: Filezilla's silent caching of user's credentials Brandon McGinty (Oct 11)
- Re: Filezilla's silent caching of user's credentials rdsears (Oct 11)
- Re: Filezilla's silent caching of user's credentials Mutiny (Oct 13)
- Re: Filezilla's silent caching of user's credentials Chris Evans (Oct 13)
- Re: Filezilla's silent caching of user's credentials Ryan Sears (Oct 13)
- Re: Filezilla's silent caching of user's credentials Valdis . Kletnieks (Oct 13)
- Re: Filezilla's silent caching of user's credentials Vipul Agarwal (Oct 09)
- Re: Filezilla's silent caching of user's credentials silky (Oct 13)
- Re: Filezilla's silent caching of user's credentials Christian Sciberras (Oct 13)
- Re: Filezilla's silent caching of user's credentials silky (Oct 13)
- Re: Filezilla's silent caching of user's credentials Christian Sciberras (Oct 13)
- Re: Filezilla's silent caching of user's credentials silky (Oct 13)
- Re: Filezilla's silent caching of user's credentials Chris Evans (Oct 14)
- Re: Filezilla's silent caching of user's credentials silky (Oct 14)
- Re: Filezilla's silent caching of user's credentials Christian Sciberras (Oct 14)
- Re: Filezilla's silent caching of user's credentials silky (Oct 14)
- Re: Filezilla's silent caching of user's credentials Valdis . Kletnieks (Oct 14)
- Re: Filezilla's silent caching of user's credentials Christian Sciberras (Oct 14)
- Re: Filezilla's silent caching of user's credentials Valdis . Kletnieks (Oct 14)