Filezilla's silent caching of user's credentials

[Dr. Zhivago]

Filezilla stores all the credentials you've ever used (in a plain text format) of every site you've logged into. Ever. The developers refuse to fix the issue as well. Guess I'll stop using this software now...

Hi all,

As some of you may or may not be aware, the popular (and IMHO one of the
best) FTP/SCP program Filezilla caches your credentials for every host you
connect to, without either warning or ability to change this without editing
an XML file. There have been quite a few bug and features requests filed,
and they all get closed or rejected within a week or so. I also posted
something in the developer forum inquiring about this, and received this
response:

"I do not see any harm in storing credentials as long as the rest of your
system is properly secure as it should be."

Source: http://forum.filezilla-project.org/v...hp?f=3&t=17932

To me this is not only concerning, but also completely un-acceptable. The
passwords all get stored in PLAIN TEXT within your %appdata% directory in an
XML file. This is particularly dangerous in multi-user environments with
local profiles, because as we all know physical access to a computer means
it's elementary at best to acquire information off it. Permissions only work
if your operating system chooses to respect them, not to mention how simple
it is *even today* to maliciously get around windows networks using
pass-the-hash along with network token manipulation techniques.

There has even been a bug filed that draws out great ways to psudo-mitigate
this using built-in windows API calls, but it doesn't seem to really be
going anywhere. This really concerns me because a number of my coworkers and
friends were un-aware of this behavior, and I didn't even know about it
until I'd been using it for a year or so. All I really want to see is at the
very least just some warning that Filezilla does this.

Source: Full Disclosure

[Galmok]

Thanks for the heads up. Could we avoid this problem by changing the XML file to read-only? Or make a directory in that name? The usual tricks to avoid writing to a file.

[caveman-jim]

[erek]

JonZ,
Rage3D Technical Artist


?

[Dr. Zhivago]

Thanks for the heads up. Could we avoid this problem by changing the XML file to read-only? Or make a directory in that name? The usual tricks to avoid writing to a file.

Shrugs...

[RAY16]

Pretty lame that there's no option to disable it and that it's not stored in an encrypted file. Lucky for me I only connect to the small FTP account my ISP gives me and just use it as temporary storage for unimportant image files.

[FiggyG]

I hope you don't like using Pidgin in that case.

[Uber_Tiny]

Problem with this is that the company just ignores the issue. I think it would have been best dealt with if they had come up with a reasoning why it's like that, or actually encrypt the stuff and fix the issue. This could potentially cause a lot of harm on a website and as I use it for just that means it makes me think twice on using their software.

[caveman-jim]

This behaviour should be disclosed clearly, to not be is suspicious to my mind. Once it's clearly disclosed then their point regarding correctly configuring your PC becomes valid; it's not suitable for use in a lot of environments, and you need to either manually clean up after it or protect the folder in some manner (permissions, etc.).

[mbeeston]

wow.. a picture the sums up how i feel about said picture, your good.

[nutcrackr]

I actually had put filezilla on a new computer and found this text file with passwords etc. Helpful when I forgot the passwords to an FTP server. I didn't really think about the security issues at the time.