Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: Security issue in Filezilla 3.0.9.2:passwordsare stored in plain text (sitemanager.xml)
From: "Micheal Cottingham" <techie.micheal () gmail com>
Date: Mon, 21 Apr 2008 13:51:54 -0400

But, but, feet are tasty.

I can't believe people are commenting in here not knowing that FTP is
plaintext. Any infosec 101 book will tell you this. Along with telnet.
Don't use them, use the secure alternatives, such as FTPS or SFTP
(which is indeed a subprocess of SSH, look at sshd.conf if you don't
believe me, nevermind that it was already covered) and SSH in place of
telnet. Those protocols are specifically meant to replace their
insecure counterparts.

Here's a few references on this "discovery."

http://forum.filezilla-project.org/viewtopic.php?f=2&t=5906&p=20285&hilit=xml+plaintext#p20285
http://forum.filezilla-project.org/viewtopic.php?f=4&t=1328&p=4660&hilit=xml+plaintext#p4660

If you don't want your passwords stored in this manner, remember your
passwords or use a password manager.

On Mon, Apr 21, 2008 at 12:57 PM,  <Valdis.Kletnieks () vt edu> wrote:
On Mon, 21 Apr 2008 12:04:41 EDT, Joey Mengele said:
 > I think you are mistaken. Perhaps you have an outdated version of
 > the document in question?

 No, it is you that is sadly mistaken.

 IETF RFCs are not versioned.  If substantial changes are made, the
 document is re-issued with a new number.  And you'd know that if you
 had actually spent any significant time reading RFCs.

 Hint: When arguing about the contents of an RFC, it's usually advisable
 to actually have found and read said RFC before opening your mouth in order
 to insert your foot.




_______________________________________________
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault