Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Filezilla or WinSCP save password in plain text which is unsecured on public machines. Is there any FTP client can save and encrypt password so that people using it only can access to FTP but not able to see password? Thanks!

share|improve this question
    
I had a look at Filezilla's bug tracker and there has been a lot of argument about this. The Filezilla coders argue that there's no point as your OS should guard all your passwords for you. Encrypting them once your machine has a keylogger installed makes no difference. is.gd/6RdTl –  Iain Jan 23 '10 at 8:09

6 Answers 6

up vote 4 down vote accepted

Eventually ends up by using WinSCP which encrypt (or hash?) password and save in registry. So it's not easy to see plain text pwd.

share|improve this answer
1  
Note: Master Password option is not enabled by default, after enabling it only it will encrypt password securely. –  Morbia Feb 17 '12 at 9:53

FileZilla developers said that OS should secure passwords for you , but what if someone got acces to your PC (direct acces , without hacking , just sitting in your chair) and looks at your passwords in that SiteManager's XML ?

share|improve this answer
1  
The password is not stored in plain text. –  Ramhound Oct 12 '11 at 19:29
2  
Password IS stored in plain text (FileZilla case). If you use FileZilla , look into your C:\Users\your_username\AppData\Roaming\FileZilla\sitemanager.xml file and see how your passwords are stored. –  Wrong Nov 20 '11 at 1:51

If you can use the password, you can decrypt it as well, by using the same algorithm as the program uses. Even if you do not know the algorithm, you still can sniff the plain-text authentication using Wireshark.

share|improve this answer

With WinSCP you can enable password encryption using master password:
http://winscp.net/eng/docs/master_password

share|improve this answer

Cyberduck for Windows stores passwords (Wiki) encrypted using the System.Security.Cryptography.DataProtector API.

share|improve this answer

If you're connecting via FileZilla's Site Manager, there's an option below the password field to prevent saving the password.

If you use Quickconnect, the password is saved encrypted in the XML file, and you can click the drop-down menu on the right and clear the history. Then the password will not be stored in the XML file.

Where is the evidence that FileZilla saves plaintext passwords?

Assuming you don't clear and empty the history, the password is only saved if you have this setting in the filezilla.xml file:

<Item name="Last Server dont save pass" type="numeric">0</Item>

This is in the FileZilla installation directory, normally under Program Files, but if you can edit the file and change the setting to 0, the last-used site's password won't be saved at all.

share|improve this answer
    
Thanks. However, when having tens of site in Site Manager, I definitely don't want to memorize all pwds. I am just looking for a FTP client that can encrypt saved pwd to prevent from others easily seeing the pwd in plain text configuration files. That's it. WinSCP use a master pwd to guard all saved pwd in Site Manager. However, is there any other client can even do encryption with out a master pwd? –  Stan Jan 23 '10 at 20:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.