Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Recently, an increasing number of people have started advising moving away from FileZilla. However, the only reason I can see for this is that FileZilla stores the connection information in a completely unencrypted form, but as Mozilla says - surely it is the job of the operating system to protect the configuration files?

So, is there any other reason why I should no longer use FileZilla, as I've never had any problems with it? Somebody mentioned to me that the way it works isn't secure either, but I think they were just getting confused over the fact FTP transmits passwords in plain text anyway.

share|improve this question
2  
What people are advising this? –  bgvaughan Jul 24 '13 at 2:42
    
@bgvaughan I don't know specifically but I've had family members tell me they've read it on blogs and I've read a few forum posts myself. –  Andy Jul 24 '13 at 10:41

3 Answers 3

up vote 26 down vote accepted

FileZilla per se isn't inherently insecure. Yes, it's storing passwords in plaintext, but the alternatives are only slightly more secure. You see, encrypting the credentials requires an encryption key which needs to be stored somewhere. If a malware is running on your user account, they have as much access to what you (or any other application running at the same level) have. Meaning they will also have access to the encryption keys or the keys encrypting the encryption keys and so on.

Your best option here is to disable password storage in FileZilla

disable-password-save-filezilla

Then start using KeePass to store your account credentials. There are also many guides on the Internet about how to integrate KeePass with FileZilla. Doing this, you're storing the encryption key somewhere where malware don't have access; you're storing the encryption key (or rather, the password from which the encryption key is derived) in your brain.

Finally (and perhaps this is a bit outside the scope of your question), please make sure you move away from FTP in favor of SFTP.

share|improve this answer
    
Thank you for your answer - I thought this would be the case. I just wanted to check that FileZilla wasn't doing anything else that was compromising my security. As for moving away from FTP, I have that covered thank you. –  Andy Jul 22 '13 at 13:02

Unless your alternative has an option where you need to provide a password (which is used to encrypt your settings containing IPs and credentials), I wouldn't see why you would need to migrate away.

If you are migrating from one application to another, you need to make sure why (in detail) the new application is better than the previous application.

share|improve this answer
    
Thanks for the answer, basically what a thought. So would you actually recommend anything over FileZilla? –  Andy Jul 22 '13 at 13:03
1  
I use filezilla but I don't save my passwords in there, like Adnan says you are better of with using a password manager. If you trust your OS enough (for instance if you are using full disk encryption and no one else has access to your machine) then you might be ok as well. (allthough I wouldn't store any passwords for super critical production machines in it) –  Lucas Kauffman Jul 22 '13 at 13:05
    
Ok, thanks for your reply. I think this is what I will do too (password manage solution). –  Andy Jul 22 '13 at 13:14

It may be because they recently made deals to start bundling malware with their downloads, and one of their developers has given people real bad attitude, claiming things from it's not malware to it's not his decision to quips like you can choose not to install it once you first install the malware laden installer.

https://forum.filezilla-project.org/viewtopic.php?t=30240

It could be the passwords stored in plain text, but I really doubt that's so much an issue to the security crowd as bundling malware in the installer, adding options that nuke all your passwords poorly in the quickconnect bar, and just the recently poor attitude towards people trying to complain about these recent-ish changes. The attitude seems to be that you can always opt out of the malware install options if you know what your doing, once you download the malware laden installer.

share|improve this answer
1  
The adware is bundled with the installer offered by Sourceforge. You can still download the unbundled installer from FileZilla servers by clicked "Show all download options". –  Adnan Oct 17 '13 at 6:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.