Trojan found in Filezilla downloaded from SourceForge

Post by icebraining » Thu, Dec 03, 2015, 12:43 PM UTC

vermilingua wrote: post #59

StavrosK wrote: post #54

Earlier quoted context omitted.

Why can the passwords not be hashed?

FTP is inherently insecure, everything is transmitted in plaintext. Because the server cannot check a password against a hash (due to the limitations of FTP), the client needs to store the password, and can't keep only a hash. That being said, Base64 is woefully inadequate, just google 'base64 decode'; and this response (from someone who appears to be a contributor) is just not a defence.

Post by chanux » Thu, Dec 03, 2015, 12:55 PM UTC

bigbugbag wrote: post #70

agildehaus wrote: post #24

SourceForge and Filezilla are both on their way out, hence their owners desire to monetize their remaining users while they still can. WinSCP is a decent alternative. As is Swish: http://www.swish-sftp.org/ https://github.com/alamaison/swish

A decent alternative to filezilla would have to be cross-platform, neither swish nor winscp are (they're win only). An alternative to sourceforge implies not using sourceforge but swish does.

Post by kuschku » Thu, Dec 03, 2015, 12:57 PM UTC

icebraining wrote: post #91

vermilingua wrote: post #59

Earlier quoted context omitted.

FTP is inherently insecure, everything is transmitted in plaintext. Because the server cannot check a password against a hash (due to the limitations of FTP), the client needs to store the password, and can't keep only a hash. That being said, Base64 is woefully inadequate, just google 'base64 decode'; and this response (from someone who appears to be a contributor) is just not a defence.

If the server checked against a client-provided hash, the hash would become the password , and the attacker could just use the hash as-is to login to the server. Hashing on the client solves nothing.

Post by eli » Thu, Dec 03, 2015, 1:06 PM UTC

scrollaway wrote: post #34

joahua wrote: post #29

Earlier quoted context omitted.

FWIW, Google Groups powers email distribution lists for Gmail for Work. Or at least, the two are strongly linked. At this point, unlike Reader, there's real cash behind the functionality. It's possible they could just fold it into Gmail, I guess, but with other mail interfaces like Inbox popping up in the Google ecosystem it seems if anything they're trying not to shoehorn too much more into a flagship product. My gu…

That's interesting, but it doesn't reassure me much. The infrastructure behind Groups may be in use, it doesn't stop Google from shutting the UI down.

Post by kylegordon » Thu, Dec 03, 2015, 1:12 PM UTC

vermilingua wrote: post #59

StavrosK wrote: post #54

Earlier quoted context omitted.

Why can the passwords not be hashed?

FTP is inherently insecure, everything is transmitted in plaintext. Because the server cannot check a password against a hash (due to the limitations of FTP), the client needs to store the password, and can't keep only a hash. That being said, Base64 is woefully inadequate, just google 'base64 decode'; and this response (from someone who appears to be a contributor) is just not a defence.