Password is publicly displayed on export

[Tyron]

If I export my connections list, which have some passwords stored, the XML generated has the passwords publicly displayed. I think there should be, at least, an obfuscation on that, since its easy to find out someones' password (which is obfuscated in the program) just by exporting its connections and looking through the XML.

[Tim Kosse]

Obfuscation won't be implemented as it offers no additional security.

The real question is, how comes somebody else has access to your private data in the first place?

[Tyron]

Well, I'm afraid to tell that I think this question is still valid, and it can be a huge difference for people who is concerned about their security to choose wheter use FileZilla or not.

Assume that your are working on your notebook in your office, in which you have all your particular sites stored (which is perfectly possible if you are a freelancer). Then, you need to go to the toilet and forgets to lock your PC!

In other softwares where your password is kept stored, such as email applications, if anyone tries to check your messages in the meanwhile, the person will stop doing this as soon as you get back to your PC, as he won't have your passwords. On the other hand, if he finds the password of your sites, it can save to a pendrive, and take a look at them with no hurry, as it can be made on his PC. Then, he'll be able to see your files, your security holes, your DB's user and password.

Maybe obfuscation won't offer additional security. In that case, make the passwords not-exportable! Simple as that!

[Tim Kosse]

Then, you need to go to the toilet and forgets to lock your PC!

It's the equivalent of leaving your home without locking the door. Even if you would store everything inside your home in nice little safes, the burglar would just install cameras so that he will get your combination when you open your safe the next time.

[Tyron]

Well, I see that this discussion is pointless...

the burglar would just install cameras so that he will get your combination when you open your safe the next time.

I think I would notice some cameras in my home that I didn't install. That's the point... Exporting passwords is a completely untraceable i.e. you'll never find out someone may be accessing your files.

If I am that wrong, just answer me: why you can't you recover yours Outlook's or Thunderbird's accounts passwords, even if you export your settings? Why does Google requires that you reenter your password before entering the Account Setting's Page, even if you have just authenticated? (Try entering in your Gmail, and then point your browser to ​https://www.google.com/dashboard/. What happens?!).

Not exporting the passwords is the best way out of this problem. Unfortunately, it seems that this solution is not even considered by the team. Such a pity.

[Rojanu]

Having passwords in plain text doesn't help at all, I am having difficulty understanding your attitude on this issue. It is clearly a user requirement and an additional barrier for people who are trying to get to user passwords, one way or the other.

In Bug ​http://trac.filezilla-project.org/ticket/3226, the comment suggest that the client never hashed the passwords but in FZ2 they weren't plain text either.

I even come across some site advising people on this security issue

​http://www.tech-evangelist.com/2009/06/08/filezilla-alert-trojan-virus/?PHPSESSID=a8df8463581cb0cfaaf6a358efe88fc9

​http://www.tech-evangelist.com/2009/05/09/backup-filezilla-settings/

​http://www.icpep.org/filezilla-saved-passwords/

Please fix this bug/introduce a new feature.

[Fred Lange]

I'm surprised how Filezilla stores passwords locally, which is very unsecure. This is why I switched to WinSCP and use SFTP for all file transfers on a client's ​mma training website.

[semeichaclxew]

Hi. Can you help me? In that case, make the passwords not-exportable! Simple as that!
Semeicha @ ​no fax payday loan

[rguglerii]

Not exporting the passwords is the best way out of this problem. Unfortunately, it seems that this solution is not even considered by the team. Such a pity.
Venice @ ​Cash advances loans.

[Dino]

Today, get a loan in 1 hour, but we need to know how to get better ​commercial mortgage rates. With deception on the part of banks. I take from this site
I hope I helped you!

[Dino]

We help to ​quit smoking. Lets do it with us

[Eva]

I am happy that this bug is now fixed, Filezilla is awesome! Always was and always will be. Thanks to the staff for the awesome work they are doing.
Dave @ ​jak poderwac dziewczynę

[Velociped]

In order to work together on the website, I exported the settings to a colleague and sent the FileZilla.xml file as an email attachment.

I was then quite surprised that he already had access to the server, although I hadn't even given him the password yet!
As I have seen, the PW is base64 encoded in FileZilla.xml!

<Pass encoding="base64">xxx</Pass>

Needless to say, we had to change the server password immediately!
And yes, it was a bit naive of me to send the settings unencrypted by email.

Of course, it is convenient if the PW is included in the file. But I would prefer it if you had to enter the password again.
Because the argument that nobody has unauthorized access to your computer anyway is no longer valid in today's world, where even well-protected company networks are hacked and data is stolen.

Especially as the solution in this case is simple: do not include the PW in the export file or replace it with a dummy password. :-)

Version used: FileZilla_3.66.5_macos-x86.app.tar.bz2, MacOS Ventura 13.6.4

[Tim Kosse]

In the settings dialog you can configure a master password or outright disable saving of passwords.