Subject: [ftpext] Hello, firewall draft and password protection

From: Paul Ford-Hutchinson <[email-masked]>
Date: Mon, 28 Jun 2010 15:42:09 +0100

Firstly, hello FTP-EXTers - hope you're all well.

Secondly, I have been asked about the current status of:
    draft-fordh-ftp-ssl-firewall-07 FTP/TLS Friendly Firewalls 2005-10-21 
(
http://www.ford-hutchinson.com/~fh-1-pfh/draft-fordh-ftp-ssl-firewall-07.txt
)

As far as I'm concerned, this document has outlived its usefulness.  The 
war between firewalls and secure protocols has died right down now and I 
don't think this draft is needed any more.  If, however, others disagree, 
then I'm happy for it to be resurrected.

Finally, there is another thread on this list stating that TLS is overkill 
for protecting passwords in FTP.  To which I have two replies:

1) implementing TLS isn't hard for server only authentication - the http 
world has managed it, I don't see why FTP should be any harder.
2) please, please think very carefully before calling for a new security 
mechanism to be created and deployed - such things are notoriously 
difficult to do correctly.

Cheers,
Paul
--

Paul Ford-Hutchinson (Author - RFC4217)

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 28 Jun 2010 18:04:19 +0200

> world has managed it, I don't see why FTP should be any harder.

There are tons of issues in the HTTP world with invalid certificates.

> difficult to do correctly.

All authentication protocols (HTTP basic auth, PPP CHAP, IMAP, ...) use challenge/response mechanisms for password-based logins. Surely one can be reused.

---

From: Daniel Stenberg <[email-masked]>
Date: Mon, 28 Jun 2010 19:46:07 +0200 (CEST)

On Mon, 28 Jun 2010, Iljitsch van Beijnum wrote:

> All authentication protocols (HTTP basic auth, PPP CHAP, IMAP, ...) use 
> challenge/response mechanisms for password-based logins. Surely one can be 
> reused.

I trust you meant that to be HTTP Digest auth, as Basic is not 
challenge/response.

-- 

  / daniel.haxx.se

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 28 Jun 2010 20:23:29 +0200

> I trust you meant that to be HTTP Digest auth, as Basic is not challenge/response.

Of course, thanks.