Filezilla or WinSCP save password in plain text which is unsecured on public machines. Is there any FTP client can save and encrypt password so that people using it only can access to FTP but not able to see password? Thanks!
feedback
|
|
Eventually ends up by using WinSCP which encrypt (or hash?) password and save in registry. So it's not easy to see plain text pwd. | |||
feedback
|
|
If you're connecting via FileZilla's Site Manager, there's an option below the password field to prevent saving the password. If you use Quickconnect, the password is saved encrypted in the XML file, and you can click the drop-down menu on the right and clear the history. Then the password will not be stored in the XML file. Where is the evidence that FileZilla saves plaintext passwords? Assuming you don't clear and empty the history, the password is only saved if you have this setting in the filezilla.xml file: This is in the FileZilla installation directory, normally under Program Files, but if you can edit the file and change the setting to 0, the last-used site's password won't be saved at all. | |||
feedback
|
|
If you can use the password, you can decrypt it as well, by using the same algorithm as the program uses. Even if you do not know the algorithm, you still can sniff the plain-text authentication using Wireshark. | |||
|
feedback
|
|
FileZilla developers said that OS should secure passwords for you , but what if someone got acces to your PC (direct acces , without hacking , just sitting in your chair) and looks at your passwords in that SiteManager's XML ? | |||||
feedback
|
