Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For example, a csv of demographic data. Over Plain FTP (not SFTP or FTPS or WebDav).

share|improve this question
2  
What do you mean by 'safer'? As in transport integrity, or secure from eavesdroppers? –  Chris S Jun 4 '10 at 20:02
    
secure for eavesdroppers. Someone intercepting the contents of the csv file inside of the zip. Not transport integrity. –  FTP Newbie Jun 4 '10 at 20:05
add comment

6 Answers

secure for eavesdroppers. Someone intercepting the contents of the csv file inside of the zip. Not transport integrity

No. Compression will fool rudimentary scanners, but it isn't a substitute for encryption. Given that most commercial games now employ compressed pseudo-filesystems that are used as random-access devices for storing data, it's pretty clear that a dedicated attacker would be able to intercept and decode the zip file.

"Stock" zip encryption is laughable as well - there are commercial, legal crackers you can purchase for cheap (cheap being enough money to buy lunch for two or three people). I would not trust zip encryption for securing data against a dedicated attacker.

If you have a need to move files securely, I would really look into something like scp over SSH instead of ftp, if possible. There are clients for Windows, Linux, OS X, and even smartphones.

If SSH is not an option, look into using PGP/GPG to pre-encrypt the file for transmission, and then issue the key to the appropriate party. This has the added advantage over FTP in that you have the option to securely email it to your recipient without worry of intercept (the file is well encrypted) and it can be re-transmitted repeatedly as needed.


Revisited with some alternatives...

You could look at setting up https:// services to handle this.

If you want to go old-skool, look at doing a SneakerNet, i.e. load data onto media, transport said media in person, deliver media to intended recipient. A lot more secure from eavesdropping, and you'll definitely know when you're being "attacked".

share|improve this answer
add comment

Please don't use the words "safe" and "ftp" in one sentence.

Someone intercepting the traffic can be unzipping the file even while it's still being transferred, thanks to the way zip files are constructed. No, there is no safety to be gained. Even if the file is encrypted it will simply take longer to open.

share|improve this answer
add comment

What you talk about safer, are you talking about the file being intercepted by someone else, or are you talking about file being transmitted without any modifications? A zip file has some basic checksums and so it would be slightly more difficult for a man in the middle to modify the payload in transit.

share|improve this answer
    
The concern is focused on being intercepted. Other folks are using language like "Is the data being transferred in the clear?". –  FTP Newbie Jun 4 '10 at 20:03
    
By 'folks' I mean those project stakeholders concerned about the security of the data inside the zip. –  FTP Newbie Jun 4 '10 at 20:04
1  
Simple answer then. From a practical standpoint there is really no difference. –  Zoredache Jun 4 '10 at 20:35
1  
If you're worried about the file contents being intercepted, why in the world are you using FTP? Or why aren't you just encrypting it first? It can't be too important if you're not encrypting it and are transferring it over plain FTP... –  Bart Silverstrim Jun 4 '10 at 21:27
1  
Anything set over FTP is in the clear unless it is itself encrypted. In any case the authentication information for FTP is passed "in the clear". –  BillThor Jun 5 '10 at 2:10
add comment

Assuming it's unencrypted, it's marginally safer, but not by much.

You've got the advantage that it's a much smaller file, so there's less time to intercept, and as Chris says, they'd have to capture the entire file. The biggest advantage you have is that there are quite a few programs that scan for keywords, and if it's zipped, then they won't be able to see them. It's not hard to extract a zip file from a stream, but you've got to have a reason to do so, and you wouldn't get it just with an automated keyword program.

So overall, it's marginally more secure, but if the data is at all important (or, as it sounds in your case, confidential), then encrypt it. Either pull it down an encrypted tunnel (VPN, SFTP, SCP, etc), or just encrypt the zip file.

share|improve this answer
add comment

The only reason I can think of that it would be any safer is that there is less time to intercept it.

But it is the kind of safety like the small print on the back of an sales slip.

share|improve this answer
add comment

If the ZIP file itself has encryption, then it's "safer" - otherwise, no, not really. It's still an unencrypted connection - it would just result in one more step of anyone sniffing the traffic having to figure out where the archive starts and ends.

Also, the attacker would need to capture the entire file, notwithstanding parity being used in the archive.

share|improve this answer
    
@Dentrasi - Keywording is easy enough as well; if this is going over FTP, all they need to do is watch for a GET/PUT command or the start of a ZIP file header (0x04034b50 or 0x02014b50) and start capturing packets then. –  Chris Peredun Jun 4 '10 at 20:21
    
Of course, it's child's play to pull a file out of an unencrypted stream, but if you're looking for keywords, rather than files, it might slip past. However, as I said, the extra security is marginal. –  Dentrasi Jun 5 '10 at 21:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.