Slashdot Mirror
10 Years Later: FileZilla Adds Support For Master Password That Encrypts Your Logins (bleepingcomputer.com)
An anonymous reader writes: "Following years of criticism and user requests, the FileZilla FTP client is finally adding support for a master password that will act as a key for storing FTP login credentials in an encrypted format," reports BleepingComputer. "This feature is scheduled to arrive in FileZilla 3.26.0, but you can use it now if you download the 3.26.0 (unstable) release candidate from here." By encrypting its saved FTP logins, FileZilla will finally thwart malware that scrapes the sitemanager.xml file and steals FTP credentials, which were previously stolen in plain text. The move is extremely surprising, at least for the FileZilla user base. Users have been requesting this feature for a decade, since 2007, and they have asked it many and many times since then. All their requests have fallen on deaf ears and met with refusal from FileZilla maintainer, Tim Kosse. In November 2016, a user frustrated with Koose's stance forked the FileZilla FTP client and added support for a master password via a spin-off app called FileZilla Secure.
I've found WinSCP to be better than FileZilla especially since so many providers offer SFTP now anyway. I don't store my passwords so the master password thing is not an issue to me. Don't store passwords if you don't want them to be found.
Filezilla is so behind the times I switched to Transmit on the mac and have never looked back
The problem with slashdot is that most of its users were bullied and stuffed into lockers as kids!
"Criticism" huh?
Yep. It's free and easy, and sometimes even helpful.
Well it's free
Yep. Free software. Yay.
why is the developer obligated to do anything?
The developers are not obligated to do anything.
Don't like it?
I don't use Filezilla and do not have a strong opinion regarding this feature.
Fork it and add your own functionalty.
It looks like that is what solved the problem.
It's pretty fucking arrogant to think the developer is on the hook to add your oh-so-desired feature when you're not paying him.
That would be pretty arrogant. Do you or anyone you know feel that way? Or are you just creating a strawman so that you can argue against it?
You didn't say this exactly, but you seem to be implying that nobody should be allowed to criticize free software. If you were to say that, I would say bullshit, if you don't want your work criticized then don't share it. Everyone is free to give their opinion, to which you can choose to utilize it to make a better product or you can ignore it.
By encrypting its saved FTP logins, FileZilla will finally thwart malware that scrapes the sitemanager.xml file and steals FTP credentials, which were previously stolen in plain text.
You've got to be kidding me.
#DeleteChrome
My whole company has standardized on it. I can go to any PC in the building and find Filezilla. To be fair, they standardized on it perhaps 7 years ago. But hey, it still works.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
who uses FTP? isn't SCP the thing?
Some drink at the fountain of knowledge. Others just gargle.
I wince any time I have to access a logged account on a server with FTP. Isn't the password sent over the wire unencrypted? FTP has been replaced by SCP for a reason.
If I am wrong please correct me.
Yes, it is. On the main site I can download the source code and compile it, something I've had to do when the pre-built Linux binaries didn't work on older distros. The software license is GPL v2.
How the fuck is it NOT free software? If you're still referring to it as adware, I'm assuming it's because of the partnership with SourceForge which bundled adware in certain versions of the software (of which you could easily still download a clean version if you knew what you were doing). That program ended quite a while ago. Of course, you'd know this if you bothered to be more understanding and check if what you actually typed matched reality, but that's too much work. Hatred is easier.
The fact that they have near daily updates (Basically every time i turn on filezilla, there is a new client), I am extremely surprised that they wouldn't handle feature requests promptly. What the hell are all the damn updates for then?? NO software can be THAT buggy!
But back in the day, I do remember them implementing a suggestion I pushed for which was the addition of autoban. So I considered them quite responsive.
And for saying "filezilla is DYING!" that hasnt been my experience. I thought it was considered the de-facto standard because: 1) they offer a client on virtually every platform and 2) its the ftp client that ninite installs. Most people who arent using filezilla, are using browser based FTP and locking out their accounts with unstandard behaviour. So i like being able to tell literally anyone, to just go to one website to get a great free ftp client.
I personally don't save passwords in an ftp client in the first place. Perhaps that was why it was not a popular suggestion. The people who are concerned with security enough to know what a master password would do, and yet still want to store their passwords inside the program instead of in their head or document, has got to be a small group. I know its envogue for password managers now and maybe thats why he implemented it.
This is really just a positive story for open source software in general. You can have a program constantly maintained for so long that it can accumulate 10 year old feature requests that ACTUALLY GET IMPLEMENTED! hooray!
-
Our corporate software center allows all users to install Filezilla with just two clicks! I think it might be there because some employees use it to transmit big files to clients. Ok, honestly, I don't know why it's there.
FileZilla has its faults, but being adware is NOT one of them. It was one of many victims (GIMP and VLC were others) of third party mirror sites like SourceForge that decided to make some additional money by bundling crapware with downloads, often without the knowledge of the projects involved. Unless you've been sourcing your software from a particularly shady mirror site, this bundling was usually made pretty clear during the install process, such as the screenshot in the link.
UNIX? They're not even circumcised! Savages!
Why would anybody still use it?
It turned into spyware years ago and WinSCP is 3000% better.
No sig today...
So you clearly don't use Filezilla.
I use Filezilla extensively on Linux and I gar-on-tee you theres NO ads here.... Couldn't say about the Winblows version, as I quit fucking with Microsoft crap over 7 years ago.....
THANK YOU, Edward Snowden!! Americans owe you a debt of gratitude (whether they know it or not..)
Actually, the maintainer of FileZilla repeatedly defended this practice of SourceForge in their forums. He also made money from the bundled software. He insisted repeatedly in the forums that it was not malware, and that people were free to choose not to install them. I think *technically* they were not malware, but they were certainly unwanted by the vast majority of the people who installed them.
I do believe that the program has been ended (by SourceForge's action, not by FileZilla), but FileZilla does now have ads on the new version screen. I think it is fair to call it ad-supported.
I've found WinSCP to be better than FileZilla especially since so many providers offer SFTP now anyway.
Note that Filezilla support SFTP too.
I don't store my passwords so the master password thing is not an issue to me. Don't store passwords if you don't want them to be found.
Even better :
don't use passwords. Use Public Keys pairs.
(Filezilla supports them, and can use Putty's key agent to handle them)
(I'm sure that WinSCP can too, just didn't bother to check).
Best part : you can then completely switch off the support for password on the SSH/SFTP server.
Your server is then (obviously) immune to brute force / password guessing.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I guess there's still hope for FileZilla Server to eventually get SFTP support before I die. It's quite astonishing that this "obvious" feature of file transfer server software hasn't been implemented yet (despite the FileZilla Client having had SFTP support for years). I mean, it's "only" been 13 years since the feature was originally requested - easily beating the master password encryption feature request by a full 3 years. And, yep, someone recently suggested closing the SFTP feature request because Tim Kosse has done nothing about it for well over a decade :-(