Slashdot Mirror
10 Years Later: FileZilla Adds Support For Master Password That Encrypts Your Logins (bleepingcomputer.com)
An anonymous reader writes: "Following years of criticism and user requests, the FileZilla FTP client is finally adding support for a master password that will act as a key for storing FTP login credentials in an encrypted format," reports BleepingComputer. "This feature is scheduled to arrive in FileZilla 3.26.0, but you can use it now if you download the 3.26.0 (unstable) release candidate from here." By encrypting its saved FTP logins, FileZilla will finally thwart malware that scrapes the sitemanager.xml file and steals FTP credentials, which were previously stolen in plain text. The move is extremely surprising, at least for the FileZilla user base. Users have been requesting this feature for a decade, since 2007, and they have asked it many and many times since then. All their requests have fallen on deaf ears and met with refusal from FileZilla maintainer, Tim Kosse. In November 2016, a user frustrated with Koose's stance forked the FileZilla FTP client and added support for a master password via a spin-off app called FileZilla Secure.
"Criticism" huh? Well it's free - why is the developer obligated to do anything? Don't like it? Fork it and add your own functionalty. It's pretty fucking arrogant to think the developer is on the hook to add your oh-so-desired feature when you're not paying him. Reminds me of that Louis CK joke about people that complain about less-than-perfect cell phone service - "Climb some trees with some hubcaps and you make one"
Encrpypt using Russian gear? You are a fuhl!
I've found WinSCP to be better than FileZilla especially since so many providers offer SFTP now anyway. I don't store my passwords so the master password thing is not an issue to me. Don't store passwords if you don't want them to be found.
Filezilla is so behind the times I switched to Transmit on the mac and have never looked back
The problem with slashdot is that most of its users were bullied and stuffed into lockers as kids!
Still use FileZilla? For real, I'm curious. I haven't heard of anyone using it or talking about it in what feels like a decade.
I am frequently befuddled at what Slashdot decides is good content. An editor hurting to hit their end of month quota for articles?
"Criticism" huh?
Yep. It's free and easy, and sometimes even helpful.
Well it's free
Yep. Free software. Yay.
why is the developer obligated to do anything?
The developers are not obligated to do anything.
Don't like it?
I don't use Filezilla and do not have a strong opinion regarding this feature.
Fork it and add your own functionalty.
It looks like that is what solved the problem.
It's pretty fucking arrogant to think the developer is on the hook to add your oh-so-desired feature when you're not paying him.
That would be pretty arrogant. Do you or anyone you know feel that way? Or are you just creating a strawman so that you can argue against it?
You didn't say this exactly, but you seem to be implying that nobody should be allowed to criticize free software. If you were to say that, I would say bullshit, if you don't want your work criticized then don't share it. Everyone is free to give their opinion, to which you can choose to utilize it to make a better product or you can ignore it.
By encrypting its saved FTP logins, FileZilla will finally thwart malware that scrapes the sitemanager.xml file and steals FTP credentials, which were previously stolen in plain text.
You've got to be kidding me.
#DeleteChrome
filezilla's still a thing? its 2017 for christs sake.
who uses FTP? isn't SCP the thing?
Some drink at the fountain of knowledge. Others just gargle.
Yawn. Who cares. Filezilla is adware. It is *not* free software. Does anyone still use it? Why bother when there is truly free software that works just as well or better.
Quite an experience to live in fear, isn't it? That's what it is to be a slave.
I wince any time I have to access a logged account on a server with FTP. Isn't the password sent over the wire unencrypted? FTP has been replaced by SCP for a reason.
If I am wrong please correct me.
The fact that they have near daily updates (Basically every time i turn on filezilla, there is a new client), I am extremely surprised that they wouldn't handle feature requests promptly. What the hell are all the damn updates for then?? NO software can be THAT buggy!
But back in the day, I do remember them implementing a suggestion I pushed for which was the addition of autoban. So I considered them quite responsive.
And for saying "filezilla is DYING!" that hasnt been my experience. I thought it was considered the de-facto standard because: 1) they offer a client on virtually every platform and 2) its the ftp client that ninite installs. Most people who arent using filezilla, are using browser based FTP and locking out their accounts with unstandard behaviour. So i like being able to tell literally anyone, to just go to one website to get a great free ftp client.
I personally don't save passwords in an ftp client in the first place. Perhaps that was why it was not a popular suggestion. The people who are concerned with security enough to know what a master password would do, and yet still want to store their passwords inside the program instead of in their head or document, has got to be a small group. I know its envogue for password managers now and maybe thats why he implemented it.
This is really just a positive story for open source software in general. You can have a program constantly maintained for so long that it can accumulate 10 year old feature requests that ACTUALLY GET IMPLEMENTED! hooray!
-
I bet the developer still refuses to add auto upload on save for external third party editors like every other FTP client has had for at least a decade.
did they encrypt passwords only, or addresses and account names etc. as well?
And grab some popcorn! Its great entertainment.
I guess the dude doesn't realize that no security is perfect. You don't need to be the best, you just don't want your tool to be low hanging fruit for for easy automated credential theft.
Maybe he'll get chased by a bear one day.
How anyone is using such a sensitive program as a file transfers' one written by a retard this big is just beyond possible comprehension.
I've never used it, but I've been on the receiving end of the retardedness after a graphics designer I worked with got all the FTPS/SFTP credentials he had stored in FileZilla, without the rest of the team knowing it (we told her to use WinSCP), stolen when her computer got infected by malware. Multiple sites were defaced and plenty of other issues had to be handled (spamlists removal, massive password resets, etc..) because an egotistical retard didn't want to implement such a simple and basic security feature.
Just concede your point.
It's free software.
I've found WinSCP to be better than FileZilla especially since so many providers offer SFTP now anyway.
Note that Filezilla support SFTP too.
I don't store my passwords so the master password thing is not an issue to me. Don't store passwords if you don't want them to be found.
Even better :
don't use passwords. Use Public Keys pairs.
(Filezilla supports them, and can use Putty's key agent to handle them)
(I'm sure that WinSCP can too, just didn't bother to check).
Best part : you can then completely switch off the support for password on the SSH/SFTP server.
Your server is then (obviously) immune to brute force / password guessing.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I guess there's still hope for FileZilla Server to eventually get SFTP support before I die. It's quite astonishing that this "obvious" feature of file transfer server software hasn't been implemented yet (despite the FileZilla Client having had SFTP support for years). I mean, it's "only" been 13 years since the feature was originally requested - easily beating the master password encryption feature request by a full 3 years. And, yep, someone recently suggested closing the SFTP feature request because Tim Kosse has done nothing about it for well over a decade :-(