-1

Suppose I have a text file with confidential information. I want to transfer from American facility to the france facility via sftp set up in a website.

Is the file transfer secure?

2
  • 2
    What, exactly does "sftp set up in a website" mean?
    – freiheit
    Sep 11, 2011 at 21:07
  • 1
    If in doubt why not simply use any one of the myriad available methods to encrypt the data? Sep 13, 2011 at 23:18

5 Answers 5

0

From the wikipedia article: SSH File Transfer Protocol

The protocol itself does not provide authentication and security; it expects the underlying protocol to secure this. SFTP is most often used as subsystem of SSH protocol version 2 implementations, having been designed by the same working group. However, it is possible to run it over SSH-1 (and some implementations support this) or other data streams. Running SFTP server over SSH-1 is not platform independent as SSH-1 does not support the concept of subsystems. An SFTP client willing to connect to an SSH-1 server needs to know the path to the SFTP server binary on the server side.

so it really depends on the way you set this up.

Read the whole article if you are interested.

0

As Davide Piras pointed out SFTP or more precisely the underlying SSH protocol can be quite secure.

But if I understood you correctly you want to use some kind of web-based SFTP client. That means that you also have to secure the connection between your client and the web-site you're using to transfer the file.

Rather than trying to get transport security right (which you should do none the less) you should encrypt the data itself (e. g. with PGP or GnuPG), transfer that encrypted file and finally decrypt it on the target system.

1
  • That's what I told my co-workers
    – hidden
    Sep 13, 2011 at 22:52
0

While SSL and TLS differ in ways that make them inoperable with each other, they are generally considered equal in terms of security. The main difference is that, while SSL connections begin with security and proceed directly to secured communications, TLS connections first begin with an insecure “hello” to the server and only switch to secured communications after the handshake between the client and the server is successful. If the TLS handshake fails for any reason, the connection is never created.

If you use Windows (like I do) , this being the case, instead of a FTPS server (such as FileZilla), you probably just want a SFTP capable, non-TLS, server (which is based on SSH) such as NULL FTP Server or what I use: WinSSHD with Tunnelier client.

0

In day-to-day work, I'd be comfortable transferring unencrypted data via SFTP. The transport protects it.

With FTP, regardless of whether the data is encrypted or not, you just shouldn't use it. FTP doesn't encrypt the authentication details. The username and password is transmitted in plaintext, and you end up compromising your account info.

-3
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.IO;
using System.Security.Cryptography;

namespace Encryption
{
    class Program
    {
        static void Main(string[] args)
        {
            EncryptFile(@"C:\a.txt", @"C:\b.txt","password");
            DecryptFile(@"C:\b.txt", @"C:\decrypted.txt",@"password");
        }
        public static void EncryptFile(string inputFile, string outputFile,string password)
        {

            try
            {

                UnicodeEncoding UE = new UnicodeEncoding();
                byte[] key = UE.GetBytes(password);

                string cryptFile = outputFile;
                FileStream fsCrypt = new FileStream(cryptFile, FileMode.Create);

                RijndaelManaged RMCrypto = new RijndaelManaged();

                CryptoStream cs = new CryptoStream(fsCrypt,
                    RMCrypto.CreateEncryptor(key, key),
                    CryptoStreamMode.Write);

                FileStream fsIn = new FileStream(inputFile, FileMode.Open);

                int data;
                while ((data = fsIn.ReadByte()) != -1)
                { 
                    cs.WriteByte((byte)data); 
                }


                fsIn.Close();
                cs.Close();
                fsCrypt.Close();
            }
            catch(Exception e)
            {
                Console.WriteLine(e);
            }
        }

        public static void DecryptFile(string inputFile, string outputFile,string password)
        {

            {


                UnicodeEncoding UE = new UnicodeEncoding();
                byte[] key = UE.GetBytes(password);

                FileStream fsCrypt = new FileStream(inputFile, FileMode.Open);

                RijndaelManaged RMCrypto = new RijndaelManaged();

                CryptoStream cs = new CryptoStream(fsCrypt,
                    RMCrypto.CreateDecryptor(key, key),
                    CryptoStreamMode.Read);

                FileStream fsOut = new FileStream(outputFile, FileMode.Create);

                int data;
                while ((data = cs.ReadByte()) != -1)
                    fsOut.WriteByte((byte)data);

                fsOut.Close();
                cs.Close();
                fsCrypt.Close();

            }
        }

    }
}
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .