full-disclosure - Re: Filezilla's silent caching of user's credentials

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTi=gND-AcHavq=g2F4yQi9Wu+6iCsCSixv5cAJVv@mail.gmail.com>
Date: Thu, 14 Oct 2010 01:57:03 +0200
From: Christian Sciberras <uuf6429@...il.com>
To: michaelslists@...il.com
Cc: full-disclosure@...ts.grok.org.uk, Mutiny <mutiny@...inbeardsucks.com>
Subject: Re: Filezilla's silent caching of user's
	credentials

If the encryption key stays on the same PC, there is absolutely no security
in that. Given that this is open source, security through obscurity can't
even start working (-> encrypting local files with a local key / using
custom algo == security through obscurity).

I think it ought to stay plaintext and people limit access to this file
whenever possible.
It's hardly a trivial matter to delete this file....if an attacker can
search for and read this file, a user could search for the same file and
delete it.

Fortunately, for the poor souls out there that allow read access to their
drives, computer forensics haven't caught up yet (and probably won't in the
near future).

My 2 cents.

Chris.

On Thu, Oct 14, 2010 at 12:41 AM, silky <michaelslists@...il.com> wrote:

> On Wed, Oct 13, 2010 at 2:33 PM, Mutiny <mutiny@...inbeardsucks.com>
> wrote:
> > The issue is that someone gained access to that file.  You sharing your
> > drives over the internet with read privileges?  You have other
> > vulnerable software being leveraged to read that file?  Would you prefer
> > they MD5'd it?  It sounds like your issue is that your password is
> > stored.  I mean, they moved your encrypted password from passwd to
> > shadow for a reason, but that doesn't change the fact that it's stored
> > and if someone doesn't need access to shadow or passwd, they shouldn't
> > have it.
> >
> > Stop logging into your FTP server from a public terminal with Filezilla.
>
> Rubbish.
>
> The passwords should be encoded so-as to avoid trivial searching. End
> of story. It takes 10 minutes to do from a development point of view,
> and there is no excuse.
>
> --
> silky
>
> http://dnoondt.wordpress.com/
>
> "Every morning when I wake up, I experience an exquisite joy — the joy
> of being this signature."
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/