Re: CRIME FTP

From: Seth Arnold (sarnold@private)
Date: Wed May 07 2003 - 11:03:17 PDT

  • Next message: Mark Grigsby: "Re: CRIME FTP"

    On Wed, May 07, 2003 at 09:49:12AM -0700, Keith Proffitt wrote:
    > Does anyone know if FTP (File Transfer Protocol) can have password 
    > protection to prevent inappropriate access?
    > Or is FTP by nature not protected by authentication? Keith Proffitt
    
    FTP only has password-protected access, though by tradition passwords
    are not checked for the user named "anonymous". (Also by tradition,
    people's email addresses are generally used as the password.)
    
    FTP's problem is that the password and data is sent in clear text,
    susceptible to sniffing by intermediaries. (Active or passive.) A VPN is
    one simple solution. Perhaps a better generic solution is to use sftp,
    part of the OpenSSH project. (There are Windows sftp clients.) This will
    prevent the password from being sent in the clear over the wire.
    
    -- 
    Is Shock-and-Awe so different from Terror?
    
    
    



    This archive was generated by hypermail 2b30 : Wed May 07 2003 - 11:43:17 PDT