Is a file any 'safer' when FTPed inside a plain old zip file then if it was FTPed as a txt file

Question

For example, a csv of demographic data. Over Plain FTP (not SFTP or FTPS or WebDav).

Answer 1

Assuming it's unencrypted, it's marginally safer, but not by much.

You've got the advantage that it's a much smaller file, so there's less time to intercept, and as Chris says, they'd have to capture the entire file. The biggest advantage you have is that there are quite a few programs that scan for keywords, and if it's zipped, then they won't be able to see them. It's not hard to extract a zip file from a stream, but you've got to have a reason to do so, and you wouldn't get it just with an automated keyword program.

So overall, it's marginally more secure, but if the data is at all important (or, as it sounds in your case, confidential), then encrypt it. Either pull it down an encrypted tunnel (VPN, SFTP, SCP, etc), or just encrypt the zip file.

Answer 2

If the ZIP file itself has encryption, then it's "safer" - otherwise, no, not really. It's still an unencrypted connection - it would just result in one more step of anyone sniffing the traffic having to figure out where the archive starts and ends.

Also, the attacker would need to capture the entire file, notwithstanding parity being used in the archive.

Answer 3

secure for eavesdroppers. Someone intercepting the contents of the csv file inside of the zip. Not transport integrity

No. Compression will fool rudimentary scanners, but it isn't a substitute for encryption. Given that most commercial games now employ compressed pseudo-filesystems that are used as random-access devices for storing data, it's pretty clear that a dedicated attacker would be able to intercept and decode the zip file.

"Stock" zip encryption is laughable as well - there are commercial, legal crackers you can purchase for cheap (cheap being enough money to buy lunch for two or three people). I would not trust zip encryption for securing data against a dedicated attacker.

If you have a need to move files securely, I would really look into something like scp over SSH instead of ftp, if possible. There are clients for Windows, Linux, OS X, and even smartphones.

If SSH is not an option, look into using PGP/GPG to pre-encrypt the file for transmission, and then issue the key to the appropriate party. This has the added advantage over FTP in that you have the option to securely email it to your recipient without worry of intercept (the file is well encrypted) and it can be re-transmitted repeatedly as needed.

---

Revisited with some alternatives...

You could look at setting up https:// services to handle this.

If you want to go old-skool, look at doing a SneakerNet, i.e. load data onto media, transport said media in person, deliver media to intended recipient. A lot more secure from eavesdropping, and you'll definitely know when you're being "attacked".

Answer 4

The only reason I can think of that it would be any safer is that there is less time to intercept it.

But it is the kind of safety like the small print on the back of an sales slip.

Answer 5

What you talk about safer, are you talking about the file being intercepted by someone else, or are you talking about file being transmitted without any modifications? A zip file has some basic checksums and so it would be slightly more difficult for a man in the middle to modify the payload in transit.

Answer 6

Please don't use the words "safe" and "ftp" in one sentence.

Someone intercepting the traffic can be unzipping the file even while it's still being transferred, thanks to the way zip files are constructed. No, there is no safety to be gained. Even if the file is encrypted it will simply take longer to open.