Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

After a bad experience with FTP credentials hacking I decided to start using SFTP and stop having FTP credentials stored in clear on my computer (Filezilla).

I now use FireFTP which encrypts credentials. However I was wondering how hard is it for a hacker to hack FireFTP credentials file?

share|improve this question
2  
If you're going to use SFTP exclusively, look into setting up your accounts with a public/private key exchange rather than a password. It's safer, and ssh in general already supports locking a private key with a passphrase. –  Shadur Mar 26 '13 at 7:54

1 Answer 1

up vote 1 down vote accepted

Encrypted is certainly better than plain text.

Storing a password in the app, however, still has some issues in my mind. By doing so, you are essentially allowing anyone with control of your computer (the "hacker" in your question) to access your FTP server without credentials. At that point, they really don't need to decrypt your passwords at all... They can just log in and compromise the files on the server without ever knowing the password.

My recommendation is always to use a password manager that supports 2 factor authentication. Store your passwords there instead of within various apps written by various persons using varying levels of encryption.

Or use keys as @shadur pointed out in comments above... Protected with a pass phrase.

share|improve this answer
    
This doesn't answer the question... –  Terry Chia Mar 26 '13 at 7:50
    
Fair enough... I added some more reasoning. –  BrianAdkins Mar 26 '13 at 11:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.