On 29.06.2012 17:13, Steve Dowe wrote:


Obviously, for FZ, you need two-way encryption/decryption.


But this is also no problem, just create a Master-Password and use
encryption based on that.


If you start FileZilla you have to enter the Master-Password and then
you can connect to all available accounts.


This might not be bulletproof but it gave you some time to detect that
your machine was compromised and change your passwords.


Bye.


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Archive: 4FEDC8FC.8000808@concepts-and-training.de">http://lists.debian.org/4FEDC8FC.8000808@concepts-and-training.de

On 29/06/12 16:25, Denis Witt wrote:

> This might not be bulletproof but it gave you some time to detect that
> your machine was compromised and change your passwords.

Maybe not, but what is?

At the same time, with all this talk of passwords stored as plain text
etc, it's not a great hurdle to set up a local, encrypted loopback
device that mounts in your local file system. You could even mount it
at ~/.filezilla, and then run up FZ for the first time.

Such a device would require a password to unlock/mount, so the "window"
where unencrypted data is vulnerable could be minimised...

http://www.howtoforge.com/encrypt-your-data-with-encfs-debian-squeeze-ubuntu-11.10

--
Steve Dowe

Warp Universal Limited
http://warp2.me/sd


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 4FEDCBDE.8010109@warpuniversal.co.uk">http://lists.debian.org/4FEDCBDE.8010109@warpuniversal.co.uk

On 29.06.2012 17:13, Camaleón wrote:


The point is that software can't be 100% secure. So when possible it is
a good idea to have more than one security layer.



Even if that extra layer is of no help because you leave your computer
open and accessible to anyone? Then you're wasting your time and your
computer resources, security has to sit between useful and effectiveness,
otherwise you're losing the battle.


FileZilla could use a Master-Password to encrypt the Account-Passwords.
So if you start FZ you enter the Master-Password (and may define a time
so that FZ will forgot the Master-PW after some time, when it's still open).



A bug in Apache my cause someone to get access to you FileZilla
-Settings.



I wonder how that can happen...


It was just an example.

Another example, a colleague of yours have SSH-Access on your machine.
Also you allow some commands he can run with sudo. Did you know that
chmod is enough so he could start a shell with root credentials? And I
don't talk about suid.


What I'm trying to say is that our machines are pretty much very complex
and it is very easy to overlook things.



At the moment this would be a big problem, if the file is encrypted the
problem is still there but you have some additional time to change your
passwords. Good thing.



Good thing for a corner case. But the bad thing here is that someone can
access your Filezilla settings from you Apache, though.


Sure. But if there is a bug (or misconfiguration) it might be possible
to do so. If it was a misconfiguration it is your own fault, of course.



Really? I would more worry about the remote servers listed in my
FileZilla-Config (if there are any), because they might belong to
customers, friends, etc. I might get worried about my Backups as I want
to restore my compromised system.



You change the password for your FTP user accounts and that's all. Gee, I
wonder in what way users are using their linux systems that don't store
any important data on them, only for multimedia playing? :-P


No, but the really important data is encrypted in a way so even if my
machine is running all the time the container isn't accessible all the time.



Humans are making mistakes, a false impression of protection may lend
you to such mistakes, this is true. That's one reason why we don't run
background Virus-Checks on our machines (mails are being scanned and you
can do on demand checks for USB media, etc.).



I do check the files I donwload from the web, regardless they are going
to be opened from windows or linux, e-mails are also scanned by means of
ClamAV and USB keys are not anutomatically mounted thus can be also
easily analyzed first.


That's the scenario I tried to point out above.


But it is easy to tell users that all files from those medias may be
evil. It's much harder to tell them that their programs might store
sensible data in a way that isn't secure. At least this is much harder
than for the FileZilla guys to store passwords encrypted.



Curiously enough is not only Filezilla who takes the path for not
encrypting the user credentials so there has to be a reason in behind for
that to happen so often...


Laziness? Why did last.fm stores the passwords of their users as
MD5-Hash without salting them?



Anyway, aren't most of us still using plain pop3 and smtp connections
with no message encryption at all? Who are we blaming? >;-)


Most of my messages are not encrypted because the receiving end isn't
capable of that. But my Credentials will only be transmitted when the
connection is secure (even if the MTA is in the same network).



Again, there are files in my servers (e.g., ssl keys) and also my Mutt



SSL/SSH Keys should have a password or should be stored in some kind of
encrypted container.



IIRC you have to remove the password so Apache can make use of it so
finally the security relies on the file perms (only root can read it).


This is true for Apache SSL but in fact I don't care a lot about my
HTTPS keyfiles, if they got compromised I revoke them. And if you really
want to fake a certificate you might can have this easier through
companies like DigiNotar.


SSL is pretty much snakeoil nowadays, but it's better than nothing.


An encrypted container wouldn't help a lot here, because I assume your
MUA is running most of the day, right? So the container has to be open

all the time and any malware could read

the file.



In my case it is launched on demand. My main MUA is Thunderbird.


Do you use a Master-Password? If so, then guess what? All your passwords
stored in TB are saved encrypted. Nice feature, isn't it?



Do you want us to remove the ethernet cord? ;-)



Would be a nice thing from a security point of view, that's why I
mentioned comfort and performance.



There's still dangerous USB flash drives and the always evil CD/DVD and
floppy disks... you never know.


Of course you have to get rid of those drives as well. Also your USB,
Firewire and Thunderbolt ports. eSATA? Well, that's evil. Are there any
known typewriter security holes?


I know at least two companies where no machine has optical/floppy drives
and USB ports. Also you can't send them E-Mails with ZIP-Files, etc.
attached. It's a f*cking nightmare and I really don't know how they can
work like this.


Anyway I think we're going pretty much offtopic. My point is that it
would be a nice feature for FZ (and other tools) to store passwords more
secure. And I don't like the attitude of the developers saying that it's
not their problem if someone could read the file who isn't allowed to.
At least as such a feature is rather easy to implement and won't affect
the user experience in a bad way.


Bye.


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Archive: 4FEDD417.7070607@concepts-and-training.de">http://lists.debian.org/4FEDD417.7070607@concepts-and-training.de

On 29.06.2012 17:38, Steve Dowe wrote:


At the same time, with all this talk of passwords stored as plain text
etc, it's not a great hurdle to set up a local, encrypted loopback
device that mounts in your local file system. You could even mount it
at ~/.filezilla, and then run up FZ for the first time.


And afterwards I have to unmount the device. This might work rather fine
on a Linux system but on Windows (and FZ is available for Windows)...


Also you have to know that FZ stores PW unencrypted and you need to know
where this information has been stored.


It would be nicer if the application does this stuff automatically. And
I don't care if they encrypt the passwords on their own or using some
kind of Keychain-Tool like most of the Tools for MacOS do.


But storing plain text passwords is bad behaviour and anyone who do this
have to be blamed for that.


Bye.


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Archive: 4FEDD652.8070905@concepts-and-training.de">http://lists.debian.org/4FEDD652.8070905@concepts-and-training.de

On 29/06/12 17:22, Denis Witt wrote:
> And afterwards I have to unmount the device. This might work rather fine
> on a Linux system but on Windows (and FZ is available for Windows)...

I believe the same thing might be achieved on Windows, using TrueCrypt.

--
Steve Dowe

Warp Universal Limited
http://warp2.me/sd


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 4FEDD9F9.9050205@warpuniversal.co.uk">http://lists.debian.org/4FEDD9F9.9050205@warpuniversal.co.uk

On Fri, 29 Jun 2012 18:13:11 +0200, Denis Witt wrote:

> On 29.06.2012 17:13, Camaleón wrote:
>
>>> The point is that software can't be 100% secure. So when possible it
>>> is a good idea to have more than one security layer.
>
>> Even if that extra layer is of no help because you leave your computer
>> open and accessible to anyone? Then you're wasting your time and your
>> computer resources, security has to sit between useful and
>> effectiveness, otherwise you're losing the battle.
>
> FileZilla could use a Master-Password to encrypt the Account-Passwords.
> So if you start FZ you enter the Master-Password (and may define a time
> so that FZ will forgot the Master-PW after some time, when it's still
> open).

Yes, they can as well as they can also encrypt the current user settings
from the XML file but they don't want to. Period and full stop.

There are another solutions out there you can go with if you don't feel
confident enough on the Filezilla approach :-)

(...)

> What I'm trying to say is that our machines are pretty much very complex
> and it is very easy to overlook things.

It has been always so, Filezilla is not inventing nothing anew.

>> Good thing for a corner case. But the bad thing here is that someone
>> can access your Filezilla settings from you Apache, though.
>
> Sure. But if there is a bug (or misconfiguration) it might be possible
> to do so. If it was a misconfiguration it is your own fault, of course.

What if... or what if...?

We can spend the remaining day elucubrating about possible case scenarios
but we all know about them. This is nothing more than a developer and
user election.

>> You change the password for your FTP user accounts and that's all. Gee,
>> I wonder in what way users are using their linux systems that don't
>> store any important data on them, only for multimedia playing? :-P
>
> No, but the really important data is encrypted in a way so even if my
> machine is running all the time the container isn't accessible all the
> time.

Well done but I'm afraid you fit the 1% of the users that do so. I, by
the way, store thousand of plain text based e-mail messages (mbox)
containing passwords for many Internet services. If I were paranoid
enough, I'd only use hard disk encryption but this is still not in my to-
do list.

>> I do check the files I donwload from the web, regardless they are going
>> to be opened from windows or linux, e-mails are also scanned by means
>> of ClamAV and USB keys are not anutomatically mounted thus can be also
>> easily analyzed first.
>
> That's the scenario I tried to point out above.

And despite all the precautions I take, I have no problems with having a
password stored in clear text ;-)

>> Curiously enough is not only Filezilla who takes the path for not
>> encrypting the user credentials so there has to be a reason in behind
>> for that to happen so often...
>
> Laziness? Why did last.fm stores the passwords of their users as
> MD5-Hash without salting them?

No, developers are not lazy but practical: they simply don't want to use
weak methods to handle this.

>> Anyway, aren't most of us still using plain pop3 and smtp connections
>> with no message encryption at all? Who are we blaming? >;-)
>
> Most of my messages are not encrypted because the receiving end isn't
> capable of that. But my Credentials will only be transmitted when the
> connection is secure (even if the MTA is in the same network).

Again, you must pertain to the 1% of the users that do that ;-)

Anyway, if the recipient does not use a secure protocol to download the
data (pop3s/imaps), the security chain is broken and thus useless, you
see now why devels are not lazy? Because you can't just take control of
all ;-)

>>> SSL/SSH Keys should have a password or should be stored in some kind
>>> of encrypted container.
>
>> IIRC you have to remove the password so Apache can make use of it so
>> finally the security relies on the file perms (only root can read it).
>
> This is true for Apache SSL but in fact I don't care a lot about my
> HTTPS keyfiles, if they got compromised I revoke them. And if you really
> want to fake a certificate you might can have this easier through
> companies like DigiNotar.
>
> SSL is pretty much snakeoil nowadays, but it's better than nothing.

That's the kind of reasoning software developers do: "if there's no 100%
secure system, why should *I* bother"?

>>> An encrypted container wouldn't help a lot here, because I assume your
>>> MUA is running most of the day, right? So the container has to be open
>> all the time and any malware could read
>>> the file.
>
>> In my case it is launched on demand. My main MUA is Thunderbird.
>
> Do you use a Master-Password?

Nope. How annoying...

> If so, then guess what? All your passwords stored in TB are saved
> encrypted. Nice feature, isn't it?

I really don't care. If I were in a windows machine, I'd be a bit
worried ;-)

>> There's still dangerous USB flash drives and the always evil CD/DVD and
>> floppy disks... you never know.
>
> Of course you have to get rid of those drives as well. Also your USB,
> Firewire and Thunderbolt ports. eSATA? Well, that's evil. Are there any
> known typewriter security holes?

And don't forget the BIOS!

Okay... I better return back to my cave, dust my typewritting machine and
problem solved.

> I know at least two companies where no machine has optical/floppy drives
> and USB ports. Also you can't send them E-Mails with ZIP-Files, etc.
> attached. It's a f*cking nightmare and I really don't know how they can
> work like this.

When you work in a corporate environment, disabling the external devices
is a must. The biggest hole in a computer system is always the user.
Always.

> Anyway I think we're going pretty much offtopic. My point is that it
> would be a nice feature for FZ (and other tools) to store passwords more
> secure. And I don't like the attitude of the developers saying that it's
> not their problem if someone could read the file who isn't allowed to.
> At least as such a feature is rather easy to implement and won't affect
> the user experience in a bad way.

Nah, developers are made of different stuff and they rarely listen to
their users... and hey, it's open source! You can hire a programmer, make
a fork ("FileZilla-S" for secure) and add all the enhancements you want ;-
P

Greetings,

--
Camaleón


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: http://lists.debian.org/jskmhd$68h$16@dough.gmane.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

damn, why can't postbox answer to the list instead of the posters email?

Camaleón schrieb:

> Yes, they can as well as they can also encrypt the current user
> settings from the XML file but they don't want to. Period and full
> stop.

True. Sad, but true.

>> What I'm trying to say is that our machines are pretty much very
>> complex and it is very easy to overlook things.

> It has been always so, Filezilla is not inventing nothing anew.

Jep, but they could respect this and give the user a little bit of extra
security.

(...)

>> No, but the really important data is encrypted in a way so even if
>> my machine is running all the time the container isn't accessible
>> all the time.

> Well done but I'm afraid you fit the 1% of the users that do so. I,
> by

True. Another reason for FZ to help those 99%. (Hey, cool, I'm the 1%,
where is my money? )

> the way, store thousand of plain text based e-mail messages (mbox)
> containing passwords for many Internet services. If I were paranoid

And so do I, at least on my Phone which I can't encrypt.

> enough, I'd only use hard disk encryption but this is still not in my
> to- do list.

I use HDD encryption for everything that I could loose or what might get
stolen, like our RDX-Backup-Drives I have in my bag anytime. Also all
Notebooks, some USB-Sticks and USB-Drives.

>>> I do check the files I donwload from the web, regardless they are
>>> going to be opened from windows or linux, e-mails are also
>>> scanned by means of ClamAV and USB keys are not anutomatically
>>> mounted thus can be also easily analyzed first.
>> That's the scenario I tried to point out above.

> And despite all the precautions I take, I have no problems with
> having a password stored in clear text ;-)

Just because you are NOT paranoid that doesn't mean that they are not
after you.

>>> Curiously enough is not only Filezilla who takes the path for
>>> not encrypting the user credentials so there has to be a reason
>>> in behind for that to happen so often...
>> Laziness? Why did last.fm stores the passwords of their users as
>> MD5-Hash without salting them?

> No, developers are not lazy but practical: they simply don't want to
> use weak methods to handle this.

What's weaker, password encryption, file access rights or both of it
together? For little effort.

But, you're right. Developers are usually not lazy, at least our aren't.
Sometimes they might didn't have enough time to implement the next
security layer, but I don't know if this apply to FZ as well.

>>> Anyway, aren't most of us still using plain pop3 and smtp
>>> connections with no message encryption at all? Who are we
>>> blaming? >;-)
>> Most of my messages are not encrypted because the receiving end
>> isn't capable of that. But my Credentials will only be transmitted
>> when the connection is secure (even if the MTA is in the same
>> network).

> Again, you must pertain to the 1% of the users that do that ;-)

> Anyway, if the recipient does not use a secure protocol to download
> the data (pop3s/imaps), the security chain is broken and thus
> useless, you see now why devels are not lazy? Because you can't just
> take control of all ;-)

I don't care about the transport of the content. It's like sending
postcards. But I care about my password. We're using LDAP and my
Mail-Password is also my System-Login.

>> SSL is pretty much snakeoil nowadays, but it's better than
>> nothing.

> That's the kind of reasoning software developers do: "if there's no
> 100% secure system, why should *I* bother"?

Why are they developing *BSD? Why should I bind some of my Services to
localhost if I have a firewall?

(...)

> Okay... I better return back to my cave, dust my typewritting machine
> and problem solved.

You got a cave? How comfortable.

> When you work in a corporate environment, disabling the external
> devices is a must. The biggest hole in a computer system is always
> the user. Always.

I think it depends on the company size and the company culture. We are
23 people at the moment and everybody can bring in his own devices and
connect them to our network and machines (WLAN is separated from the
LAN, only Internet-Access, it's not encrypted but you have to use a
captive portal to log in).

The deal is that if you for example has VPN access within you device you
have to inform me in case of loss, so I could disable the accounts for
that device. Also your device should have a remote delete function and a
password protection is mandatory. My users understand those rules and
take care of them. But yes, I guess I'm lucky.

>> Anyway I think we're going pretty much offtopic. My point is that
>> it would be a nice feature for FZ (and other tools) to store
>> passwords more secure. And I don't like the attitude of the
>> developers saying that it's not their problem if someone could read
>> the file who isn't allowed to. At least as such a feature is rather
>> easy to implement and won't affect the user experience in a bad
>> way.

> Nah, developers are made of different stuff and they rarely listen to
> their users...

But they should. They can get a lot of valuable feedback. Ok, our
developers are mainly developing for the people at our company and have
to work with them every day. That's making some kind of difference. I
can imagine as OpenSource-Developer you get a lot of bullshit requests.

> and hey, it's open source! You can hire a programmer, make a fork
> ("FileZilla-S" for secure) and add all the enhancements you want ;-

Forking a program for a single little feature doesn't make a lot of
sense to me. Either you will have to patch the upstream version every
now and then or you end up with a Fork that doesn't get any new
features, also it might confuses some users.

Bye.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJP7fwaAAoJEGqblLUjc3f4kdcH/0FmkD7aAs++33v0nd9RML/O
V13l3xLzRf7Vm4sLvzcrbvyCouFnVnCnjbUWsLJw2wNEaKNPk9 MXcUHTcXyXkhHD
Cal+/txA70RbiEAByyCjz7gd2C1MnQ9RDCGf3k4w3qTnOLISxRkIEfU oeEoUrU6O
dXexGJea7Cf8diP4DHKtMQKstWROHrjOhH47KBJPo0nTeGt4ld n3SvpW9CC6Bs/C
MYZOw6+aJBDewKUbh3JllfDF2xoCHrYQrPUJAllSJI+3Wi8uza bOPduyd8WsnUZ5
aHMFt+v1TT30YBA++DSp8zpM8ZydDdUy2qjNWPZx5L3V2kI3DG v3ZOOmLaeh0cc=
=EoMX
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 4FEDFC1E.9080902@concepts-and-training.de">http://lists.debian.org/4FEDFC1E.9080902@concepts-and-training.de

On Vi, 29 iun 12, 18:13:11, Denis Witt wrote:
>
> Anyway I think we're going pretty much offtopic. My point is that it
> would be a nice feature for FZ (and other tools) to store passwords
> more secure. And I don't like the attitude of the developers saying
> that it's not their problem if someone could read the file who isn't
> allowed to. At least as such a feature is rather easy to implement
> and won't affect the user experience in a bad way.

What happened to "do one thing and do it well"? As far as I understand
FileZilla is good FTP client, why should it re-implement a keychain?

Kind regards,
Andrei
--
Offtopic discussions among Debian users and developers:
http://lists.alioth.debian.org/mailman/listinfo/d-community-offtopic

On 30/06/12 02:02, Lisi wrote:

On Friday 29 June 2012 10:28:11 Denis Witt wrote:

I have brakes and drive safely, so an airbag


isn't essential.


And do all the speed louts see you coming and say: "We mustn't overtake on
this blind corner. The driver coming towards me on what is now the same side
of the road as I am on is a good driver. I must backtrack in time and not
overtake because good drivers don't have accidents."? I consider all the
modern improvements in safety essential, and with each of them have been an
early adopter.


Please get your attributions correct - that was my statement.

I don't have an airbag, and I'm still here, so I stand by it. We haven't
had airbags for most of the 100ish year history of the car, but we have
had brakes, and they've generally been regarded as essential. The safety
record hasn't been perfect, of course, but the tradeoff has been
considered acceptable, or cars would have been banned.


I also stand by the bit that says I'd keep an airbag if I had one, for
the reasons you give.


Richard


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Archive: 4FEE4A4A.7070000@walnut.gen.nz">http://lists.debian.org/4FEE4A4A.7070000@walnut.gen.nz

On 29/06/12 21:28, Denis Witt wrote:

On 29.06.2012 03:16, Richard Hector wrote:


> If your account is hosed, well, go to their second argument: "2.
> don't get the malware in the first place" ;-)

Great Argument, btw. Oh, I got an Airbag on my car, get rid of the
brakes please. I don't need them anymore.



That's the wrong way round. I have brakes and drive safely, so an airbag
isn't essential. Which isn't to say I'd get it removed if I had one.


Maybe, seat belts are also not essential, but in many countries the
usage is mandatory, for a good reason.


Agreed. And airbags may become compulsory too. As long as they're well
engineered, of course; having explosives go off during a crash needs to
be managed carefully.


But the question is one of priority. Avoiding crashing (good/adequate
brakes, tyres, suspension, roads etc etc) should come before saving you
if you do (seatbelts, airbags, ambulances etc etc). It's always a good
idea to have both types, of course, because preventative measures are
unlikely to ever be perfect.


Richard


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Archive: 4FEE4CC8.4000707@walnut.gen.nz">http://lists.debian.org/4FEE4CC8.4000707@walnut.gen.nz