Mozilla Stops FTP Support in Firefox 90

'A post on Mozilla's security blog calls FTP "by now one of the oldest protocols still in use" — and it's suffering from "a number of serious security issues." The biggest security risk is that FTP transfers data in cleartext, allowing attackers to steal, spoof and even modify the data transmitted. To date, many malware distribution campaigns launch their attacks by compromising FTP servers and downloading malware on an end user's device using the FTP protocol. Aligning with our intent to deprecate non-secure HTTP and increase the percentage of secure connections, we, as well as other major web browsers, decided to discontinue support of the FTP protocol. Removing FTP brings us closer to a fully-secure web which is on a path to becoming HTTPS only and any modern automated upgrading mechanisms such as HSTS or also Firefox's HTTPS-Only Mode, which automatically upgrade any connection to become secure and encrypted do not apply to FTP. The FTP protocol itself has been disabled by default since version 88 and now the time has come to end an era and discontinue the support for this outdated and insecure protocol — Firefox 90 will no longer support the FTP protocol.' -- source: https://news.slashdot.org/story/21/07/24/0213220 There is always FileZilla: https://filezilla-project.org/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

On Sun, 25 Jul 2021 18:15:07 +1200, Peter Reutemann quoted:
'The biggest security risk is that FTP transfers data in cleartext ...'
And passwords as well. There was FTP-over-SSL/TLS, but it was a nightmare to set up. As I suppose befits a retrofitted kludge. Best practice today is, if you need to do unauthenticated downloads, use HTTPS. For authenticated uploads and downloads, SFTP (which runs over SSH) is much simpler to set up than FTP anyway. If you need to do really large reliable point-to-point file transfers, like multi-gigabytes, an interesting possibility is to use BitTorrent. The sender creates a .torrent file and sends that to the recipient, and to nobody else. To make it really secure, encrypt the data file and ensure only the legitimate recipient has the decryption key.
participants (2)
-
Lawrence D'Oliveiro
-
Peter Reutemann