Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Filezilla's silent caching of user's credentials
From: Valdis.Kletnieks () vt edu
Date: Thu, 14 Oct 2010 10:49:39 -0400

On Thu, 14 Oct 2010 10:20:30 +0200, Christian Sciberras said:
And that is my point exactly. While I'm shouting out loud, let me ask a question:
How many FD readers are dumb enough to share their harddisks with the world?
None? So what is the problem in using FileZilla personally? I mean, anyone which
takes security seriously, would be encrypting their drive in the first

The problem is that "FD readers" and "anyone who takes security seriously" are
vanishingly small corners of the total Internet population.  Yes, there may be
5,000 race car drivers in the US who can do amazing drifts and the like if a
car isn't equipped with anti-lock brakes.  That doesn't mean that they aren't a
better choice for the other 200 million drivers in the US.  Similarly, the fact
that a security feature isn't strictly needed on the 0.2% of systems that are
properly administered doesn't mean that the programmer shouldn't be thinking
about the other 99.8% of users where the feature will add incremental benefit.

Think: Why does SSH use a passphrase to protect your private key by default,
and why does it allow the *optional* omission of said passphrase? Why shouldn't
the exact same reasoning apply to all other software that stores credentials?

Attachment: _bin

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]