full-disclosure - Re: Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <8518.1208550253@turing-police.cc.vt.edu>
Date: Fri, 18 Apr 2008 16:24:13 -0400
From: Valdis.Kletnieks@...edu
To: Joey Mengele <joey.mengele@...hmail.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Security issue in Filezilla 3.0.9.2:passwords
	are stored in plain text (sitemanager.xml)

On Fri, 18 Apr 2008 16:16:59 EDT, Joey Mengele said:

> Then how do you explain the security offered by section 3.4.3 of 
> RFC959? Or did you just skip over that...


      3.4.3.  COMPRESSED MODE

         There are three kinds of information to be sent:  regular data,
         sent in a byte string; compressed data, consisting of
         replications or filler; and control information, sent in a
         two-byte escape sequence.  If n>0 bytes (up to 127) of regular
         data are sent, these n bytes are preceded by a byte with the
         left-most bit set to 0 and the right-most 7 bits containing the
         number n.

If you think run-length-encoding compression is security, you're even less
clued than I thought.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/