FTP and secure password management

by Alastair McDermott

Posted: 15 years ago 3 replies

PROGRAMMING

Hi folks,

Like many developers with multiple clients websites to take care of, I use a secure password manager (in my case, KeePass). I usually have at least 4 userpass cominations per client site - database, ftp, primary email, CMS admin, and then sometimes a Gmail address, hosting CP, secondary users for above services, etc. (I'm very happy with KeePass for password management.)

My main concern is FTP - I'm currently using FileZilla, which you probably know refuses to encrypt stored passwords. So I'm left with either not storing the passwords along with the rest of the connection data (and copying out of KeePass every time I login), or storing it insecurely as plain text (even if I use sFTP etc to do the actual transfers). I find this a bit frustrating, and while I understand why the developer holds the principle of not encrypting the password, it is awkward. If FileZilla wasn't so good it would be easier - I'd just look for an alternative.

What do you guys do? Any tips, workarounds, etc?

#ftp #management #password #secure

RobKonrad 15 years ago

You could create an encrypted container - using TrueCrypt, for example - and Set FileZilla to store all PWs there.

That would mean you 'd have to open the container before each working session, but at least in case your comp gets lost/stolen/whatever, PWs are safe.

Cheers,
Rob
- [ 1 ] Thanks
Signature

================================================== ===
This blog is awesome: http://www.robkonrad.com/blog. Read it.
================================================== ===
{{ DiscussionBoard.errors[5251616].message }}
Alastair McDermott 15 years ago

I've been playing with TrueCrypt a bit - I think I'm going to implement something like this. Wonder if it's usable out of Dropbox - that could be cool.
- Thanks
{{ DiscussionBoard.errors[5251907].message }}
garcia17 Banned 15 years ago

[DELETED]

{{ DiscussionBoard.errors[5252519].message }}
- RobKonrad 15 years ago
  
  Originally Posted by garcia17
  
  i'm sorry for my bad english but i'm italian
  
  Thank you for your valuable contribution to this thread! :rolleyes:
  
  As for Dropbox and Truecrypt:
  
  The problem is that dropbox auto-syncs a file is changed.
  Truerypt containers are basically one massive file (e.g. 1 GB) with a lot of files in them.
  Dropbox cannot look in the encrypted container (of course), so even if you change one word in a small text file in that container, it will sync the FULL container.
  
  So technically, it's possible, but I would not recommend it for large containers.
  
  As for FTP logins - that can be a very, very small container, so it's absolutely doable.
  
  There *are* some security concerns though, as *theoretically* the fact that dropbox saves old container versions might make the container breakable... but this is more of a theoretical concern.
  
  More here
  
  Dropbox and Truecrypt Files « Dropbox Forums
  
  cheers,
  Rob
  
  Thanks
  
  Signature
  
  ================================================== ===
  This blog is awesome: http://www.robkonrad.com/blog. Read it.
  ================================================== ===
  
  {{ DiscussionBoard.errors[5253727].message }}