10 Years Later: FileZilla Adds Support For Master Password That Encrypts Your Logins (bleepingcomputer.com) 82
An anonymous reader writes: "Following years of criticism and user requests, the FileZilla FTP client is finally adding support for a master password that will act as a key for storing FTP login credentials in an encrypted format," reports BleepingComputer. "This feature is scheduled to arrive in FileZilla 3.26.0, but you can use it now if you download the 3.26.0 (unstable) release candidate from here." By encrypting its saved FTP logins, FileZilla will finally thwart malware that scrapes the sitemanager.xml file and steals FTP credentials, which were previously stolen in plain text. The move is extremely surprising, at least for the FileZilla user base. Users have been requesting this feature for a decade, since 2007, and they have asked it many and many times since then. All their requests have fallen on deaf ears and met with refusal from FileZilla maintainer, Tim Kosse. In November 2016, a user frustrated with Koose's stance forked the FileZilla FTP client and added support for a master password via a spin-off app called FileZilla Secure.
Re: (Score:3, Informative)
Why would anybody still use it?
It turned into spyware years ago and WinSCP is 3000% better.
Do you have a point? (Score:1)
"Criticism" huh?
Yep. It's free and easy, and sometimes even helpful.
Well it's free
Yep. Free software. Yay.
why is the developer obligated to do anything?
The developers are not obligated to do anything.
Don't like it?
I don't use Filezilla and do not have a strong opinion regarding this feature.
Fork it and add your own functionalty.
It looks like that is what solved the problem.
It's pretty fucking arrogant to think the developer is on the hook to add your oh-so-desired feature when you're not paying him.
That would be pretty arrogant. Do you or anyone you know feel that way? Or are you just creating a strawman so that you can argue against it?
You didn't say this exactly, but you seem to be implying that nobody should be allowed to criticize free software. If you w
Re: Do you have a point? (Score:5, Informative)
Naming the developer is less of a deal here than you think - he has been notorious for years because of his stance on this matter. He has rejected patches from third parties trying to fix the deficiency, something which finally led to the fork a year or so ago. Oh, the person who forked the project had suffered a breach where the lack of this feature was a major contributing factor.
I don't use FileZilla and never have, but for me the whole sordid tale raises a question mark against projects of this kind: Any project of this nature is substantially ego driven, the programmer is donating time and energy to provide a service. The problem is when that ego leads him (99% are male) to leave unnecessary deficiencies in the "product"? I'm running an old linux distribution on a machine in my internal network because an important tool was updated around 18 months ago to remove support for something I use a lot. It is a personality clash between the owners of two projects. My old version works.
Look at the decisions Firefox has made recently, I consider some of them to be sabotage, vandalism.
Re: Do you have a point? (Score:5, Informative)
Someone thanked the developer for adding this feature (after filing a request for it 9 years ago), and he replies
"I'm glad you like a feature that doesn't even increase security."
I hope to never meet or interact with this person, as it is highly frustrating to even read about this interchange from my position of removal (not a filezilla user).
Link here: https://forum.filezilla-project.org/viewtopic.php?f=3&t=64&start=1005#p156191
Re: (Score:1)
I'm waiting for Archie and Gopher version (Score:2)
who uses FTP? isn't SCP the thing?
Re: (Score:2)
who uses FTP? isn't SCP the thing?
Filezilla does SCP as well as SFTP, and FTPS.
There are less and less things using plain FTP, mainly anonymous public file repositories.
But they support full FTP authentication none the less.
Since the vast majority of the transfer protocols it supports are encrypted specifically to not send your password in plain-text, it is fairly important to store them encrypted locally too if you will be storing them at all.
Makes little since not to store FTP passwords right along with the others in the same place and wo
I use WinSCP now (Score:2)
Re: (Score:2)
Can it resume downloads and uploads?
Re: (Score:2)
Re: (Score:2)
Interesting! So, it can resume transfers for SCP? I will need to check it out again.
Re: (Score:2)
Re: (Score:2)
Cool. In the past, I wasn't able to resume download and upload files with SCP, SFTP, etc.
Re: (Score:1)
Also WinSCP is not Adware. Some people may prefer Filezilla for that reason. Filezilla is better if you like being served ads. WinSCP does not include Astromenda.
Re:I use WinSCP now (Score:4, Insightful)
Re:I use WinSCP now (Score:4, Insightful)
Re: (Score:2)
Yeah I guess it's a Windows thing. The developers wanted to make some extra cash with bundled adware, but I think they left Linux and Mac users alone. The Windows version still has the bundled adware when you download it from the link you posted.
The only way to avoid the adware on Windows is to compile the binary yourself from the source code or maybe use the Chocolatey package. There used to be download links that avoided the malware infected versions but those were taken down a long time ago. Presumably b
Re: (Score:2)
Re: (Score:2)
The news was the Sourceforge was adding adware to the packages and the one that caused the outrage was FZ. Is not the developers that added the adware on their side, they might have signed up for the Ad program offered by SF which they dumped once they realized whats was all about.
Also because I even got to download one of the bundled installers for FZ on windows and the AV picked the Adware package. Easily removed with 7z and FZ installed cleanly afterwards.
Re: (Score:2)
AND if you don't use Windows anymore, WinSCP is a non-starter, and as far as I'm concerned, Filezilla is the best ftp/scp/ftps client for Linux....
Re: (Score:2)
SFTP (Score:2)
I've found WinSCP to be better than FileZilla especially since so many providers offer SFTP now anyway.
Note that Filezilla support SFTP too.
I don't store my passwords so the master password thing is not an issue to me. Don't store passwords if you don't want them to be found.
Even better :
don't use passwords. Use Public Keys pairs.
(Filezilla supports them, and can use Putty's key agent to handle them)
(I'm sure that WinSCP can too, just didn't bother to check).
Best part : you can then completely switch off the support for password on the SSH/SFTP server.
Your server is then (obviously) immune to brute force / password guessing.
Transmit (Score:2)
Filezilla is so behind the times I switched to Transmit on the mac and have never looked back
Re: (Score:2)
Filezilla is so behind the times I switched to Transmit on the mac and have never looked back
$34 seems like a bit much for an ftp/sftp app...
Re: (Score:1)
Possible responses:
1) He's a Mac user. He's used to overpaying for basic functionality.
2) If he was a Windows user, I bet he would have paid for WinRAR, too.
Re: (Score:2)
Re: (Score:2)
Behind on the times? What is it that Filezilla is missing? A frigging like button or something?
Re: (Score:3)
My whole company has standardized on it. I can go to any PC in the building and find Filezilla. To be fair, they standardized on it perhaps 7 years ago. But hey, it still works.
Re: (Score:2)
Holy crap (Score:5, Insightful)
By encrypting its saved FTP logins, FileZilla will finally thwart malware that scrapes the sitemanager.xml file and steals FTP credentials, which were previously stolen in plain text.
You've got to be kidding me.
Re: (Score:3)
Thankfully pidgin has disappeared into irrelevance with the rise of cell phone messaging; they still store their passwords in plain text.
Re: (Score:2)
Pidgin became irrelevant for two reasons -- in the following order chronologically:
1) The developers only wanted to add features they personally were interested in, and their desires didn't correspond to those of anyone else who used the program.
2) IM networks taking protocols private.
Re: (Score:1)
Yes, how dare they use XML when they could have used SQLite and JSON like Firefox or instead do it like Chrome on Windows where Microsoft is expected to do the right thing.
Storing passwords on a system where those passwords can be accessed by software without user interaction doesn't strike me as very secure. Then again, if malware is on the system you probably have already lost, so the keychain encryption schemes help against attacks on turned off/logged out devices.
The integration of a password manager su
Re: (Score:1)
THEY (the original Filezilla devs) DIDN'T do that... Someone else forked Filezilla and added that feature.. Read the article ffs
Filezilla = Adware (Score:1)
Yawn. Who cares. Filezilla is adware. It is *not* free software. Does anyone still use it? Why bother when there is truly free software that works just as well or better.
Re:Filezilla = Adware (Score:4, Informative)
Yes, it is. On the main site I can download the source code and compile it, something I've had to do when the pre-built Linux binaries didn't work on older distros. The software license is GPL v2.
How the fuck is it NOT free software? If you're still referring to it as adware, I'm assuming it's because of the partnership with SourceForge which bundled adware in certain versions of the software (of which you could easily still download a clean version if you knew what you were doing). That program ended quite a while ago. Of course, you'd know this if you bothered to be more understanding and check if what you actually typed matched reality, but that's too much work. Hatred is easier.
Re: (Score:1)
How the fuck is it NOT free software?
Well I guess it's free in the sense that all malware is free.
If you're still referring to it as adware, I'm assuming it's because of the partnership with SourceForge which bundled adware in certain versions of the software (of which you could easily still download a clean version if you knew what you were doing).
In all versions. There are no longer any binaries available that are not adware/malware. Yes what you are saying used to be true some years ago, but it is not true anymore. Also don't blame Sourceforge. Filezilla specifically chose to have Sourceforge bundle the adware because it makes money for them. They openly admitted it and had no plans to make any changes despite the complaints.
Yes if you are willing to go through the trouble of compiling th
Re: (Score:3)
Re: (Score:1)
Actually, the maintainer of FileZilla repeatedly defended this practice of SourceForge in their forums. He also made money from the bundled software. He insisted repeatedly in the forums that it was not malware, and that people were free to choose not to install them. I think *technically* they were not malware, but they were certainly unwanted by the vast majority of the people who installed them.
I do believe that the program has been ended (by SourceForge's action, not by FileZilla), but FileZilla does
Re: (Score:3)
So you clearly don't use Filezilla.
Re: (Score:2)
I use Filezilla extensively on Linux and I gar-on-tee you theres NO ads here.... Couldn't say about the Winblows version, as I quit fucking with Microsoft crap over 7 years ago.....
Not using SCP? (Score:2)
I wince any time I have to access a logged account on a server with FTP. Isn't the password sent over the wire unencrypted? FTP has been replaced by SCP for a reason.
If I am wrong please correct me.
Re: (Score:2)
I wince any time I have to access a logged account on a server with FTP.
For anything other than, for example public FTP software downloads, most people who use FileZilla use SFTP. The fools at WordPress still use FTP for auto-updating. Though SFTP is an option, noobs will probably use FTP.
But why do hosting companies even allow it? It's got to be a HUGE vector, and although hosting companies generally will not take any responsibility for hacked sites that they host (and why should they), it's got to be a Help Desk pain in the ass.
Re: (Score:2)
Re: (Score:2)
That you don't appear to know this and yet feel free to opine on the matter tells me that you need to turn in your geek card at the door immediately, and leave Slashdot forever. Never come back.
I would tell you to go fuck yourself, but as you are an over-weight neck-beard situated in a darkened basement where you consume copious quantities of Mountain Dew and Cheetos, I assume you already fuck yourself.
Re: (Score:2)
Cheers!
How pretentious. Are you enjoying your quiche Lorraine and over-oaked Chardonnay?
Re: (Score:2)
How is FTP *MORE* of a pain in the ass to the helpdesk than SFTP? The only thing they have to do is manage password resets. It's just as easy to do that for FTP as it is for SFTP.
From the resulting account hacks was my thinking, but I can't confirm that.
Hard to believe (Score:3)
The fact that they have near daily updates (Basically every time i turn on filezilla, there is a new client), I am extremely surprised that they wouldn't handle feature requests promptly. What the hell are all the damn updates for then?? NO software can be THAT buggy!
But back in the day, I do remember them implementing a suggestion I pushed for which was the addition of autoban. So I considered them quite responsive.
And for saying "filezilla is DYING!" that hasnt been my experience. I thought it was considered the de-facto standard because: 1) they offer a client on virtually every platform and 2) its the ftp client that ninite installs. Most people who arent using filezilla, are using browser based FTP and locking out their accounts with unstandard behaviour. So i like being able to tell literally anyone, to just go to one website to get a great free ftp client.
I personally don't save passwords in an ftp client in the first place. Perhaps that was why it was not a popular suggestion. The people who are concerned with security enough to know what a master password would do, and yet still want to store their passwords inside the program instead of in their head or document, has got to be a small group. I know its envogue for password managers now and maybe thats why he implemented it.
This is really just a positive story for open source software in general. You can have a program constantly maintained for so long that it can accumulate 10 year old feature requests that ACTUALLY GET IMPLEMENTED! hooray!
Maybe FileZilla Server can add SFTP support... (Score:2)
I guess there's still hope for FileZilla Server to eventually get SFTP support before I die. It's quite astonishing that this "obvious" feature of file transfer server software hasn't been implemented yet (despite the FileZilla Client having had SFTP support for years). I mean, it's "only" been 13 years [filezilla-project.org] since the feature was originally requested - easily beating the master password encryption feature request by a full 3 years. And, yep, someone recently suggested closing the SFTP feature request because Tim