Subject: [ftpext] FTP password protection?

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 23 Jun 2010 12:55:50 +0200

I could easily have missed this, but as far as I know, FTP has no provisions to protect passwords used for logging in against interception.

In my opinion, this is the main reason non-anonymous FTP is problematic, and I think defining a login mechanism that doesn't expose cleartext passwords would be a good addition to FTP.

---

From: Daniel Stenberg <[email-masked]>
Date: Wed, 23 Jun 2010 13:10:17 +0200 (CEST)

On Wed, 23 Jun 2010, Iljitsch van Beijnum wrote:

> In my opinion, this is the main reason non-anonymous FTP is problematic, and 
> I think defining a login mechanism that doesn't expose cleartext passwords 
> would be a good addition to FTP.

Isn't RFC4217, FTP with TLS good enough for this?

-- 

  / daniel.haxx.se

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 23 Jun 2010 13:13:28 +0200

> Isn't RFC4217, FTP with TLS good enough for this?

That would be one solution, but it seems like overkill, especially as users have to set up a certficate. The fact that FTP with TLS isn't used (much? at all?) in practice suggests that something less ambitious might be helpful.

---

From: Daniel Stenberg <[email-masked]>
Date: Wed, 23 Jun 2010 13:36:37 +0200 (CEST)

On Wed, 23 Jun 2010, Iljitsch van Beijnum wrote:

> That would be one solution, but it seems like overkill, especially as users 
> have to set up a certficate. The fact that FTP with TLS isn't used (much? at 
> all?) in practice suggests that something less ambitious might be helpful.

For just adressing the plain text password it might be overkill, yes. But it 
is an existing, working, implemented and deployed approach...

And I must disagree with you. I (as author of a client-side implementation) 
find it used quite a lot.

-- 

  / daniel.haxx.se