MobileRead Forums - View Single Post

geekmaster · 03-13-2012, 04:44 PM

EDIT: What ixtab said, except the long geekmaster version with all the extra "supporting" information ..

Most "respectable" internet service providers and web hosts do not even ALLOW FTP logins anymore, like since 1999 or shortly thereafter:

Excerpt from Wikipedia:
FTP was not designed to be a secure protocol—especially by today's standards—and has many security weaknesses. In May 1999, the authors of RFC 2577 listed a vulnerability to the following problems:
Bounce attacks
Spoof attacks
Brute force attacks
Packet capture (sniffing)
Username protection
Port stealing
FTP is not able to encrypt its traffic; all transmissions are in clear text, and usernames, passwords, commands and data can be easily read by anyone able to perform packet capture (sniffing) on the network. This problem is common to many of the Internet Protocol specifications (such as SMTP, Telnet, POP and IMAP) that were designed prior to the creation of encryption mechanisms such as TLS or SSL. A common solution to this problem is to use the "secure", TLS-protected versions of the insecure protocols (e.g. FTPS for FTP, TelnetS for Telnet, etc.) or a different, more secure protocol that can handle the job, such as the SFTP/SCP tools included with most implementations of the Secure Shell protocol.

Although on an unshared USBnet connection, it would not matter as much as long as we have no viruses or spyware sniffing our Windows network interfaces, and we all know how secure Windows is, don't we?

EDIT: And with the modern secure transfer protocols, we do not have to worry about corrupting our transferred binary data by forgetting to set BINARY transfer mode, as was all too common with FTP.

03-13-2012, 04:44 PM	#6
geekmaster Carpe diem, c'est la vie. Posts: 6,433 Karma: 10773668 Join Date: Nov 2011 Location: Multiverse 6627A Device: K1 to PW3	EDIT: What ixtab said, except the long geekmaster version with all the extra "supporting" information .. Most "respectable" internet service providers and web hosts do not even ALLOW FTP logins anymore, like since 1999 or shortly thereafter: Excerpt from Wikipedia: FTP was not designed to be a secure protocol—especially by today's standards—and has many security weaknesses. In May 1999, the authors of RFC 2577 listed a vulnerability to the following problems: Bounce attacks Spoof attacks Brute force attacks Packet capture (sniffing) Username protection Port stealing FTP is not able to encrypt its traffic; all transmissions are in clear text, and usernames, passwords, commands and data can be easily read by anyone able to perform packet capture (sniffing) on the network. This problem is common to many of the Internet Protocol specifications (such as SMTP, Telnet, POP and IMAP) that were designed prior to the creation of encryption mechanisms such as TLS or SSL. A common solution to this problem is to use the "secure", TLS-protected versions of the insecure protocols (e.g. FTPS for FTP, TelnetS for Telnet, etc.) or a different, more secure protocol that can handle the job, such as the SFTP/SCP tools included with most implementations of the Secure Shell protocol. Although on an unshared USBnet connection, it would not matter as much as long as we have no viruses or spyware sniffing our Windows network interfaces, and we all know how secure Windows is, don't we? EDIT: And with the modern secure transfer protocols, we do not have to worry about corrupting our transferred binary data by forgetting to set BINARY transfer mode, as was all too common with FTP. Last edited by geekmaster; 03-13-2012 at 05:57 PM.