Victims of Gumblar and similar drive-by-download exploits have had their FTP credentials stolen by harvesting them from data-stores used by applications like FileZilla and Dreamweaver.
FileZilla stores the information you enter into the
Site Manager and if you use the
Normal Logintype and enter a username and password, those are stored in an XML file in plain-text. A safer practice with FileZilla is to choose
Interactive for the Logontype. That way, you will be prompted for them when you connect. Then use
Edit | Clear private data... when you end your session to clear out the quickconnect history and reconnect information.
Don’t like having to remember logon credentials? Why not use a respectable, dedicated password manager. One popular free/open-source password manager is
KeePass. Take advantage of it’s random password generator. This will generate some very ugly passwords you’ll never remember, but you can use its copy/paste or the auto-type feature to make entering your credentials easy. Use its Password Profiles to tailor the generated password to match the schemes used by the different websites you frequent. Save the profile and use it next time you change your password. Use the password expiration feature to remind you to change your password. If you try it and like it you can make a donation to the project.
You can carry your KeePass environment with you on a secure USB stick like
IronKey or
SafeStick so you’ll always have it with you.
Since we’re talking about password theft, here are some other things to keep in mind:
Don’t use your browser’s ability to “remember” logon credentials. Why would you rely on the browser’s password security mechanism when we know browsers are heavily targeted and continually found to have security holes?
Don’t sign into your sensitive accounts from untrusted computers like “convenient” kiosks. If you’re on travel and you MUST have access to your accounts, try a product like
IronKey and look into their optional Secure Sessions Service.
Don’t access accounts you want to keep secure without using some type of encryption channel such as SSL or TLS, not even from your own computer; this goes for FTP accounts as well.
Remember, security and convenient access are often competing goals; you have to weigh one against the other and decide which is more important to you.
QK
