Comments on: Warning: FileZilla FTP Passwords now Stored in Plaintext

By: sam

sam — Sat, 13 Feb 2010 18:46:32 +0000

I still use FileZilla frequently (which supports SFTP). I wrote this post only to inform of the potential security risk, I still think FileZilla is among the best FTP clients out there.

-Sam

By: WiredEarp

WiredEarp — Tue, 09 Feb 2010 22:33:27 +0000

Actually, I just came from the FileZilla website, and know what you mean. The admin there seems to be a real idiot (he actually suggests that everyone should spend an hour a day on their PC making sure its secure). Any encryption, even basic, is an improvement over plaintext (they could always leave in a plaintext option). I used to be a big FileZilla fan, but will no longer run it due to the password issue – that and the fact that I dont like supporting dickheads.

By: Jake

Jake — Tue, 26 Jan 2010 13:09:48 +0000

First thanks UT for this post! I agree with all you said about Filezilla and the storage of passwords. This has woke me up and I’m evalutaing my whole password strategy.

So what FTP program do you recommend for Windows?

I would assume you recommend to start using SFTP?

By: michael

michael — Mon, 18 Jan 2010 14:13:59 +0000

I keep waiting for someone to write a free, Windows-compatible FTP client that doesn’t suck, but I have yet to find one.

Thanks for the heads up. I’m ditching FileZilla.

By: josh

josh — Mon, 18 Jan 2010 10:24:35 +0000

I too came to figure out where the passwords were stored. My passwords are very strong, and I sometimes forget them. Thanks for the tip.

(FTP isn’t secure anyway, packet sniffing on wifi networks, many of which are wep, is easy enough. Use SCP if you want security.)

By: Andy

Andy — Tue, 12 Jan 2010 19:57:07 +0000

If you’re using FTP in a public location, this is only one of your worries. If you administer the workstation, use the fzdefault.xml file in the /docs/ folder and change the kiosk mode parameter to 1 or 2 so that it doesn’t save this info.

Additionally, you can use the fzdefault.xml file to tell FileZilla not to check for updates, which is usually a nuisance on a public machine anyway.

By: Paul

Paul — Fri, 18 Dec 2009 22:44:40 +0000

I’ve just had 6 sites hacked due to this vulnerablity. I run all sorts of security measures on my PCs, but it was so easy for the malware to pick up the plain text host, user, and password info from the FileZilla xml file that it was sent to the hackers before I could even flick my WiFi switch off! Literally – I was stunned by how quickly it happened. Although the sites were hacked within 24hrs, luckily I spotted it before my sites were blacklisted as their hacks loaded the sites with malware.

Read the FileZilla forums and see how their “admin” deals with such queries – quite frankly, the tone of his responses to their users would stop me using FileZilla even without this recent event!

If you don’t want all your ftp account details to land up in the hands of some hacker who will ruin your websites, DON’T USE FILEZILLA – even if your machines are like Fort Knox!

FileZilla’s “admin” response to users caught out in this way – “don’t use Windows”! Sorry?….I’m sure I was using the WINDOWS version of FileZilla? Really, I urge you to read their forums (search for encrypt and/or hacked) and you’ll soon see that FileZilla’s developers are not people whose software you would want to use.

I wish I’d read your original post 10 days ago – it would’ve saved me SO much hassle and a stack of work changing accounts and loading site backups. Thanks for bringing it to others’ attention though! Please, please, please, heed these warnings – however “safe” you believe your machines to be!

Paul

By: Siddharth

Siddharth — Wed, 16 Dec 2009 23:04:57 +0000

Why not do what Firefox does and have a master password and use that to create a hash and key to decode the stored (encrypted) passwords?

This is a major security risk and should be handled.

By: Emilio

Emilio — Sun, 13 Dec 2009 01:08:05 +0000

That it is transmitted in plain text is a silly excuse if you ask me.

IF the user wants to store the password then the application should do its best to protect the user and in this case it means to use reasonable encryption which is not rocket science anymore.

Now anyone can just open the archive and steal your passwords, in fact malware and viruses steal passwords this way.

Shameless omission! being open source is no excuse for laziness.

By: Cum am scapat de injectionul javascript <script>/GNU GPL/ try{window.onload

Sat, 12 Dec 2009 04:31:12 +0000

[...] face troianul asta? Fura parolele de ftp memorate de Filezilla (sunt salvate in clar intr-un xml) si Total Commander (parole criptate reversibil) – probabil si alti clienti de ftp – si [...]