full-disclosure - Re: Security issue in Filezilla3.0.9.2:passwordsare stored in plain text (sitemanager.xml)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 22 Apr 2008 14:22:17 -0400
From: "Joey Mengele" <joey.mengele@...hmail.com>
To: full-disclosure@...ts.grok.org.uk, groffg@...design.com
Subject: Re: Security issue in
	Filezilla3.0.9.2:passwordsare stored in plain text (sitemanager.xml)

Groffg,

On Tue, 22 Apr 2008 13:02:34 -0400 "Garrett M. Groff" 
<groffg@...design.com> wrote:
>Joey,
>
>The topic write-ups for data compression and cryptography (go to 
>that page 
>in lieu of "encryption") are reasonably good. You can then branch 
>to other 
>sources for the sake of verification via cross referencing. That 
>should help 
>to elucidate the substantial difference between encrypting data 
>and 
>compressing data.
>

Reasonably good? Says who? Chairman Mao?

>As far as Wikipedia being a scholarly source, I'd say that 
>scholars will 
>choose many sources, Wikipedia among them. Someone [citation 
>needed!] once 
>commented about Wikipedia that it has 10 times the information as 
>an 
>encyclopedia volume but with a 10% reduction in accuracy. Indeed, 
>one would 
>be wise to cross reference any information gleaned from Wikipedia 
>that is to 
>be used for anything more substantial than satisfying mere 
>curiosity. But 
>using Wikipedia as an initial resource doesn't seem like a bad 
>idea to me.
>

To you? What is your credibility?

>Coming back to the topic at hand, I hope that this will wrap up 
>your concern 
>over the perceived weakness in FileZilla (which, as it turns out, 
>is simply 
>an innate weakness of using FTP).
>


I disagree. The flaw that I have discovered still lies in the 
FileZilla implementation of FTP. Until a SCHOLARLY source can 
contradict my findings, I do not anticipate anyone on this list or 
elsewhere swaying me. Thanks for your time but it is back to the 
grill for me.

>- G

J

--
Domain Registration - Click Here
http://tagline.hushmail.com/fc/Ioyw6h4eGFYt7Q1wJHR5TOWufyDJ9N2AyTvZsoMA0s5JVfXtoN8hwE/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/