Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

ftp is regarded as an insecure protocol because it sends the password in clear text rather than in encrypted form like other protocols provide.

My question is: if I connect to my web host from my home computer (which consists of 1 computer and 1 router with direct connection to the internet); would this still be insecure ? I mean, my computer does not belong to any network from which some other networked computer could listen on my traffic to steal my username & password, right ?

share|improve this question
2  
Complain to your web hosting company. Remind them it is 2010 and that ftp is almost 40 years old, and they just might want to consider offering support for something secure. –  Zoredache Oct 27 '10 at 18:58
    
But you are in a networked environment. You are connecting to a networked environment (Your ISP) over a networked environment (The Internet). You are now part of this (logical) network. –  Stefan Lasiewski Oct 27 '10 at 21:46
add comment

6 Answers

up vote 5 down vote accepted

If your server is remote, then your credentials are moving unencrypted through many other devices before reaching it, as they are going across the Internet, which is the ultimate (inter)network.

share|improve this answer
add comment

If it's going over the internet (which it is) then if it's being transmitted in plain text (which for plain ftp it is) then it's insecure.

The fact that your home computer isn't connected to a network (other than your router) doesn't make any difference.

If you have no choice but use plain FTP then tbh I wouldn't worry too much about someone somehow sniffing your traffic (assuming you're using an encrypted connection to your router if you're using wireless), but I would make the password as strong as possible and make it unique so if it's compromised only your web host access is compromised.

share|improve this answer
add comment

Where is your web server?

If your web server is on the same local network, sitting behind the same firewall then you don't have a problem.

If your web server is on the internet, then you would be sending your password in plain text across the internet to the web server - there are plenty of places it could be intercepted in between.

One special case here is if you have a VPN connection between you and the web server, in which case the password would be encrypted across the internet, but I imagine you don't have this.

Any web host worth its salt should allow you to use SFTP or SCP to transfer files securely. Frankly, any web host who only offers FTP for file transfer is a liability to itself, its customers and the commmunity at large.

share|improve this answer
add comment

try a traceroute to your ftp server. the network that exists between each hop between your pc and your ftp server allows for a possible sniffing point for someone (or gov't agency) to see your cleartext credentials without your knowledge.

share|improve this answer
add comment

Yes, anything over the internet that doesn't have a layer of security (for example, you use a secure VPN) is not secure.

Does your webhost provide any other means of connecting to it, for example, via SSH? This might be a question to ask your host if you are concerned about security. If it is your own host, consider setting up your own ssh server (Linux and Mac operating systems have an SSH server usually built right in or, use http://www.freesshd.com/ for Windows).

There are a couple of free hosts out there that provide SSH to their service. Most SSH clients have a built in file-transfer ability.

share|improve this answer
add comment

hell yeah! I agree with @phoebus. I am probably looking at it right now...tell me what it is so I can compare with what I am seeing :)...just freaking with ya...

Ask your provider what they offer for secure connection. That may depend on what OS they are running and if it's shared hosting etc. If you have a dedicated server you can setup your

  1. SFTP
  2. Certificate
  3. VPN - OpenVPN
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.