FileZilla stores passwords as plaintext.

eXor

eXor

eXor

Soldato
Joined
13 Nov 2002
Posts
3,589
I'm sure this is ancient news to some, but I just stumbled upon this information today. :o

Malware that target FileZilla must be having a field day. :eek:

I am not affected as I try and avoid letting programs save my passwords.

In the case of FileZilla, I've always used:

Code: 
Logon Type: Interactive
and
Code: 
Protocol: SFTP - SSH File Transfer Protocol

The passwords are stored in \Users\YourUserName\AppData\Roaming\FileZilla\sitemanager.xml

Below is an entry for a ficticious site that I created. The password is omgitstrue :
Code: 
        <Server>
            <Host>127.0.0.1</Host>
            <Port>2222</Port>
            <Protocol>1</Protocol>
            <Type>0</Type>
            <User>ftp</User>
            <Pass>omgitstrue</Pass>
            <Logontype>1</Logontype>
            <TimezoneOffset>0</TimezoneOffset>
            <PasvMode>MODE_DEFAULT</PasvMode>
            <MaximumMultipleConnections>0</MaximumMultipleConnections>
            <EncodingType>Auto</EncodingType>
            <BypassProxy>0</BypassProxy>
            <Name>SMH</Name>
            <Comments></Comments>
            <LocalDir></LocalDir>
            <RemoteDir></RemoteDir>
            <SyncBrowsing>0</SyncBrowsing>omg
        </Server>
 
If you don't use SFTP and only use FTP then your password will be transmitted in plain text.

Also saved passwords in Firefox and Chrome are stored in plain text.
 
I never let applications save my passwords unless they use a decent form of encryption. WinSCP stores passwords in plaintext, at least it warns the user and forces them to read a prompt before saving.

If malware were to get onto your system, it would probably use a keylogger to grab the master password.

Firefox users can enable master password which will encrypt all sensitive data.
 
FireFTP is the better FTP client anyway and I'd recommend it all day long although it's only usable if you use Firefox/Waterfox/Iron etc.
 
If you're going to use FireFTP, enable FF master password or everything will be stored in plaintext.
 
I know it's not good to have passwords stored in plain text, but you can't really be that bothered if you are using something as insecure as FTP in the first place; your credentials are already passed in plain text every time you log on to your chosen FTP server.
 
Hellsmk2 said:
I know it's not good to have passwords stored in plain text, but you can't really be that bothered if you are using something as insecure as FTP in the first place; your credentials are already passed in plain text every time you log on to your chosen FTP server.
Click to expand...

Is there a free solution ?
 
Hellsmk2 said:
I know it's not good to have passwords stored in plain text, but you can't really be that bothered if you are using something as insecure as FTP in the first place; your credentials are already passed in plain text every time you log on to your chosen FTP server.
Click to expand...

Encrypted FTP does exist.
 
Thanks, that's actually really handy, now I can backup my list of sites! I use SSH with private certs stored in keypass with keyagent plugin so nothing sensitive in there.
 
You must log in or register to reply here.
Back
Top Bottom