full-disclosure - Re: Security issue in Filezilla 3.0.9.2:passwordsare stored in plain text (sitemanager.xml)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 21 Apr 2008 13:51:54 -0400
From: "Micheal Cottingham" <techie.micheal@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Security issue in Filezilla
	3.0.9.2:passwordsare stored in plain text (sitemanager.xml)

But, but, feet are tasty.

I can't believe people are commenting in here not knowing that FTP is
plaintext. Any infosec 101 book will tell you this. Along with telnet.
Don't use them, use the secure alternatives, such as FTPS or SFTP
(which is indeed a subprocess of SSH, look at sshd.conf if you don't
believe me, nevermind that it was already covered) and SSH in place of
telnet. Those protocols are specifically meant to replace their
insecure counterparts.

Here's a few references on this "discovery."

http://forum.filezilla-project.org/viewtopic.php?f=2&t=5906&p=20285&hilit=xml+plaintext#p20285
http://forum.filezilla-project.org/viewtopic.php?f=4&t=1328&p=4660&hilit=xml+plaintext#p4660

If you don't want your passwords stored in this manner, remember your
passwords or use a password manager.

On Mon, Apr 21, 2008 at 12:57 PM,  <Valdis.Kletnieks@...edu> wrote:
> On Mon, 21 Apr 2008 12:04:41 EDT, Joey Mengele said:
>  > I think you are mistaken. Perhaps you have an outdated version of
>  > the document in question?
>
>  No, it is you that is sadly mistaken.
>
>  IETF RFCs are not versioned.  If substantial changes are made, the
>  document is re-issued with a new number.  And you'd know that if you
>  had actually spent any significant time reading RFCs.
>
>  Hint: When arguing about the contents of an RFC, it's usually advisable
>  to actually have found and read said RFC before opening your mouth in order
>  to insert your foot.
>
>
>
>
> _______________________________________________
>  Full-Disclosure - We believe in it.
>  Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>  Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/