I have web hosting account with what seems to be a reputable and security-conscious hosting company (Siteground). I'm using 2-factor authentication to log in to my account with them, HTTPS for my site, and SSH to move files to and from the server. However, the account also has what appears to be unencrypted FTP access which can't be disabled. I assume they know what they're doing but it seems like this leaves an unnecessary security risk:
- If I log in via FTP, my password could be compromised since someone could see it in plain text. I can just not use FTP, but it seems like it would be safer to just not allow the connection at all.
- Someone could brute-force their way into my account my guessing password, and the 2FA or SSH keys used for other access to the account would be moot.
Like I said, the company seems to know what it's doing in other ways, so am I missing something?