Filezilla's silent caching of user's credentials

[dave b]

Am I the only person who finds it ironic that the same measures
leveraged against closed source projects have to be employed against
some open source projects?

Yet another example, complete with a public pissing contest: "XSS in
Squirrelmail plugin 'Virtual Keyboard'",
http://seclists.org/fulldisclosure/2010/Oct/45

XSS are lame but they can be used to steal your email, money from your
bank, administrative password to systems.... etc. [0]
If you get pwned by lame, you still are pwned.

This is an alarming trend in open source software, and
diametrically opposed to the claims of "more eyes equates
to more secure"", "open source software is more secure",
and "open source software fixes bugs faster than other
software models".

Open source != good.
What makes open source projects successful is the people usually want
to contribute and are *involved*. "Real quality means making sure that
people are proud of the code they write, that they're involved and
taking it personally. " Linus.

We are all human so ... get over this open source is $better/$worse
than proprietary code. We can submit patches to open source projects,
they might not be accepted. With proprietary software you can't see
how crap component X really is (codewise) but usually it will show up
in use.
The real problem is a lack of awareness in the value of testing code.
Test things that should *fail*, that should *pass* and that shouldn't *work*.
Also, remember you are not testing code for the sake of validation,
but so you know the behaviour of your system matches what you expect.

"I do not see any harm in storing credentials as long as the
rest of your system is properly secure as it should be."
Source:(http://forum.filezilla-project.org/viewtopic.php?f=3&t=17932)
[SNIP]

This is always an issue... how do you keep passwords?
You can 'encrypt them' but to get access they have to be decrypted.
How good should the protection be...
imho desktop keychains are better than in-app level storage.
In most cases no amount of 'protection' will protect a system which
has been owned by an attacker.


[0] https://blogs.apache.org/infra/entry/apache_org_04_09_2010

--
I do desire we may be better strangers. -- William
Shakespeare, "As You Like It"

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[coderman]

Post by dave b
...
This is always an issue... how do you keep passwords?

you wrap the foundation in FDE with secure bootloader. <insert discuss
the complex trade-off's of this tangent to mutual satisfaction.>

add a dash of privileged key memory representation manangement to seed
the application / domain level password authorized key utilization
within distinct. bonus points for capabilities model or well executed
rule base.

crypted qubes with elegant structure of key management is beauty.
alas, key management is always crux and bleeds you... pick your
reactive or proactive blood letting wisely.


... or ball point pen on personage.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Christian Sciberras]

Or just in plain text under your bed.


*sigh*

Post by coderman

Post by dave b
...
This is always an issue... how do you keep passwords?

you wrap the foundation in FDE with secure bootloader. <insert discuss
the complex trade-off's of this tangent to mutual satisfaction.>
add a dash of privileged key memory representation manangement to seed
the application / domain level password authorized key utilization
within distinct. bonus points for capabilities model or well executed
rule base.
crypted qubes with elegant structure of key management is beauty.
alas, key management is always crux and bleeds you... pick your
reactive or proactive blood letting wisely.
... or ball point pen on personage.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/