Slashdot Mirror
10 Years Later: FileZilla Adds Support For Master Password That Encrypts Your Logins (bleepingcomputer.com)
An anonymous reader writes: "Following years of criticism and user requests, the FileZilla FTP client is finally adding support for a master password that will act as a key for storing FTP login credentials in an encrypted format," reports BleepingComputer. "This feature is scheduled to arrive in FileZilla 3.26.0, but you can use it now if you download the 3.26.0 (unstable) release candidate from here." By encrypting its saved FTP logins, FileZilla will finally thwart malware that scrapes the sitemanager.xml file and steals FTP credentials, which were previously stolen in plain text. The move is extremely surprising, at least for the FileZilla user base. Users have been requesting this feature for a decade, since 2007, and they have asked it many and many times since then. All their requests have fallen on deaf ears and met with refusal from FileZilla maintainer, Tim Kosse. In November 2016, a user frustrated with Koose's stance forked the FileZilla FTP client and added support for a master password via a spin-off app called FileZilla Secure.
Encrpypt using Russian gear? You are a fuhl!
Normally I'd defend the developer, but not in this case. FileZilla took advantage of users and potentially harmed them by participating in the DevShare program. That said, it should have been forked a long time ago to cut out a developer participating in DevShare.
I've found WinSCP to be better than FileZilla especially since so many providers offer SFTP now anyway. I don't store my passwords so the master password thing is not an issue to me. Don't store passwords if you don't want them to be found.
Filezilla is so behind the times I switched to Transmit on the mac and have never looked back
The problem with slashdot is that most of its users were bullied and stuffed into lockers as kids!
Still use FileZilla? For real, I'm curious. I haven't heard of anyone using it or talking about it in what feels like a decade.
I am frequently befuddled at what Slashdot decides is good content. An editor hurting to hit their end of month quota for articles?
"Criticism" huh?
Yep. It's free and easy, and sometimes even helpful.
Well it's free
Yep. Free software. Yay.
why is the developer obligated to do anything?
The developers are not obligated to do anything.
Don't like it?
I don't use Filezilla and do not have a strong opinion regarding this feature.
Fork it and add your own functionalty.
It looks like that is what solved the problem.
It's pretty fucking arrogant to think the developer is on the hook to add your oh-so-desired feature when you're not paying him.
That would be pretty arrogant. Do you or anyone you know feel that way? Or are you just creating a strawman so that you can argue against it?
You didn't say this exactly, but you seem to be implying that nobody should be allowed to criticize free software. If you were to say that, I would say bullshit, if you don't want your work criticized then don't share it. Everyone is free to give their opinion, to which you can choose to utilize it to make a better product or you can ignore it.
By encrypting its saved FTP logins, FileZilla will finally thwart malware that scrapes the sitemanager.xml file and steals FTP credentials, which were previously stolen in plain text.
You've got to be kidding me.
#DeleteChrome
I'm not disagreeing with you at all (in fact I completely agree), but SF dropped DevShare last year. However, I'd bet BizX comes with it's own boatload of issues.
filezilla's still a thing? its 2017 for christs sake.
who uses FTP? isn't SCP the thing?
Some drink at the fountain of knowledge. Others just gargle.
Yawn. Who cares. Filezilla is adware. It is *not* free software. Does anyone still use it? Why bother when there is truly free software that works just as well or better.
Quite an experience to live in fear, isn't it? That's what it is to be a slave.
I wince any time I have to access a logged account on a server with FTP. Isn't the password sent over the wire unencrypted? FTP has been replaced by SCP for a reason.
If I am wrong please correct me.
The fact that they have near daily updates (Basically every time i turn on filezilla, there is a new client), I am extremely surprised that they wouldn't handle feature requests promptly. What the hell are all the damn updates for then?? NO software can be THAT buggy!
But back in the day, I do remember them implementing a suggestion I pushed for which was the addition of autoban. So I considered them quite responsive.
And for saying "filezilla is DYING!" that hasnt been my experience. I thought it was considered the de-facto standard because: 1) they offer a client on virtually every platform and 2) its the ftp client that ninite installs. Most people who arent using filezilla, are using browser based FTP and locking out their accounts with unstandard behaviour. So i like being able to tell literally anyone, to just go to one website to get a great free ftp client.
I personally don't save passwords in an ftp client in the first place. Perhaps that was why it was not a popular suggestion. The people who are concerned with security enough to know what a master password would do, and yet still want to store their passwords inside the program instead of in their head or document, has got to be a small group. I know its envogue for password managers now and maybe thats why he implemented it.
This is really just a positive story for open source software in general. You can have a program constantly maintained for so long that it can accumulate 10 year old feature requests that ACTUALLY GET IMPLEMENTED! hooray!
-
I bet the developer still refuses to add auto upload on save for external third party editors like every other FTP client has had for at least a decade.
did they encrypt passwords only, or addresses and account names etc. as well?
Why would anybody still use it?
It turned into spyware years ago and WinSCP is 3000% better.
No sig today...
And grab some popcorn! Its great entertainment.
I guess the dude doesn't realize that no security is perfect. You don't need to be the best, you just don't want your tool to be low hanging fruit for for easy automated credential theft.
Maybe he'll get chased by a bear one day.
How anyone is using such a sensitive program as a file transfers' one written by a retard this big is just beyond possible comprehension.
I've never used it, but I've been on the receiving end of the retardedness after a graphics designer I worked with got all the FTPS/SFTP credentials he had stored in FileZilla, without the rest of the team knowing it (we told her to use WinSCP), stolen when her computer got infected by malware. Multiple sites were defaced and plenty of other issues had to be handled (spamlists removal, massive password resets, etc..) because an egotistical retard didn't want to implement such a simple and basic security feature.
Just concede your point.
It's free software.
I've found WinSCP to be better than FileZilla especially since so many providers offer SFTP now anyway.
Note that Filezilla support SFTP too.
I don't store my passwords so the master password thing is not an issue to me. Don't store passwords if you don't want them to be found.
Even better :
don't use passwords. Use Public Keys pairs.
(Filezilla supports them, and can use Putty's key agent to handle them)
(I'm sure that WinSCP can too, just didn't bother to check).
Best part : you can then completely switch off the support for password on the SSH/SFTP server.
Your server is then (obviously) immune to brute force / password guessing.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I guess there's still hope for FileZilla Server to eventually get SFTP support before I die. It's quite astonishing that this "obvious" feature of file transfer server software hasn't been implemented yet (despite the FileZilla Client having had SFTP support for years). I mean, it's "only" been 13 years since the feature was originally requested - easily beating the master password encryption feature request by a full 3 years. And, yep, someone recently suggested closing the SFTP feature request because Tim Kosse has done nothing about it for well over a decade :-(
Spyware? What? Do you have *any* proof for this? I run a firewall and I never noticed FileZilla connecting anywhere else than the SFTP sites I'm using (I have auto update checks disabled).
If you have viable proof, please post. Otherwise don't spread FUD.
And WINSCP is absolutely not better. The plaintext password issue was my only real concern with FileZilla, otherwise it's extremely convenient imho.