Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

After a bad experience with FTP credentials hacking I decided to start using SFTP and stop having FTP credentials stored in clear on my computer (Filezilla).

I now use FireFTP which encrypts credentials. However I was wondering how hard is it for a hacker to hack FireFTP credentials file?

share|improve this question
If you're going to use SFTP exclusively, look into setting up your accounts with a public/private key exchange rather than a password. It's safer, and ssh in general already supports locking a private key with a passphrase. – Shadur Mar 26 '13 at 7:54
up vote 2 down vote accepted

Encrypted is certainly better than plain text.

Storing a password in the app, however, still has some issues in my mind. By doing so, you are essentially allowing anyone with control of your computer (the "hacker" in your question) to access your FTP server without credentials. At that point, they really don't need to decrypt your passwords at all... They can just log in and compromise the files on the server without ever knowing the password.

My recommendation is always to use a password manager that supports 2 factor authentication. Store your passwords there instead of within various apps written by various persons using varying levels of encryption.

Or use keys as @shadur pointed out in comments above... Protected with a pass phrase.

share|improve this answer
This doesn't answer the question... – Terry Chia Mar 26 '13 at 7:50
Fair enough... I added some more reasoning. – BrianAdkins Mar 26 '13 at 11:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.