Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What are the security risks in passing passwords in ftp URLs. For instance internet explorer takes in a url of the form ftp://username:password@someserver.com.

  1. Is the url transmitted in plain text?
  2. Can a man in the middle (or proxy server) view the request and see the password?
  3. Are there more secure ways/clients that encrypts the password across the wire?
share|improve this question

1 Answer 1

up vote 2 down vote accepted
  1. Yes
  2. Yes
  3. Yes. Almost all other ways are more secure
    Check out sftp and scp
share|improve this answer
1  
Indeed. Yes, Yes and Yes. And as a fourth point: FTP is bloody annoying on the network. Workarounds (passive mode or a FTP aware firewall) are almost always needed. –  Hennes Jul 21 '12 at 14:35
    
Can you recommend any web hosting company that provides sftp or equivalent? –  adentum Jul 21 '12 at 19:48
    
@adentum - All honourable web hosts with shell/root access should already provide this, if not change web host. –  Nifle Jul 21 '12 at 21:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.