3

I have a Windows (8 Consumer Preview) PC and a Macbook (OS X Lion). Sometimes, I'd want to pause working on a project leave my Windows PC at my room connected to my college's intranet, and keep working somewhere else (in the campus) with the same files, and I don't want the hassle of carrying a USB/uploading to FTP/waiting Dropbox to sync big files etc. so I just want direct access to my project files over the network. However, I'm concerned about the safety of this approach. I've set the sharing settings to my workspace's directory such as: my own account (that I use to log onto my PC) has full access to the files, and I've removed all the permissions (including list dir and read) from the Everyone "user". I can SMB-connect to my PC over the network successfully with my PC credentials and it works perfectly, but is my data (including BOTH my files and my credentials) safe from eavesdropping. The network is completely unsecure (unsecured regular WiFi, just as in a coffee shop) and I need to rely on the safety at a higher layer. Is there any? If not, are there any alternatives (given my requirement previously)?

Thanks, Can.

1 Answer 1

6

No; the LM and NTLM algorithms have been broken many times. Only NTLMv2 (if the server enforces its usage) is somewhat strong against casual sniffers, but it can be broken quickly by a bruteforce attack. Only Kerberos (used in Active Directory domains) is sufficiently strong, but it requires extra infrastructure which you generally don't have.

However, regardless of which authentication method you use, the SMB protocol doesn't support encryption and will transfer your files in plain text, so it is not recommended to use over public Internet except through a VPN.

Edit (2023): SMBv3 supports encryption – for everything except the authentication handshake – so if you use SMBv3 with Kerberos and the server has encryption set to mandatory, then you're OK. However, it still does not protect NTLM. (SMB-over-QUIC would help here, if it weren't an Azure-only feature.)

An alternative is SFTP, the SSH file transfer protocol. There are several SSH servers for Windows (I prefer Bitvise WinSSHd), and many SFTP clients for both Windows (WinSCP) and OS X (if I recall correctly – Transmit, Cyberduck, OSXFUSE).

4
  • For me, SFTP has also been much faster than SMB; transferring files at 7 MB/s over 100Mbit LAN while SMB could only reach 2 MB/s. (I could not test with Win7/8, however, which support an allegedly much improved SMBv2 protocol.) Jun 13, 2012 at 21:02
  • Not enough to to write up a full answer but I also wanted to mention FTPS (Ftp over SSL) This is implemented in FileZilla and I am sure many others. Jun 13, 2012 at 21:02
  • 2
    @ScottChamberlain: True, but unfortunately FTPS shares the downsides of both FTP and SSL, making it rather inconvenient for a NATed personal server. FTP requires forwarding several ports for the data connections; smart routers can do that automatically, but not when the connection is encrypted. At the same time, the security of SSL greatly depends on how the server certificate is verified, since a home PC will probably use a self-signed cert... Jun 13, 2012 at 21:06
  • 1
    As introduced with Windows 8, SMB 3.0 now includes encryption, and Samba supports it. You can force it by setting client/server min protocol = SMB3
    – Ashley
    Jun 3, 2018 at 16:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .