Why SFTP password is base64 encrypted ?

[Plug-fr]

Hi,

As I use remote NAS with SFTP server to bachup my datas, I note the password is base64 encoded in the FFS cloud command :

lien.png (9.06 KiB) Viewed 16161 times

I’m worried about this behavior.

Aren’t the SFTP commands not already encrypted by FreeFileSync before before being sent through the internet ?

I guess only an FFS developer can answer this question. I'm new on this forum and I don't know if FFS developpers are on this forum...

Thank's

[LeoW]

They are. Not one of them.

[therube]

"Fake pwd for forum" ;-).
(Before I looked, I was going to say you should remove from here, & change... heh.)

So locally if someone had access (or remotely if you've been hacked), someone could view (& easily) "decrypt" your (obscured) password. I while (basically) stored as "plain text" locally, what would be sent via SFTP would be encrypted - you'd better hope :-).


(This would not be the case with FTP [non-SFTP].)

[Plug-fr]

As you proved, it is easy to decipher base64. So what's the interest to use it ?

From my point of view I DO NOT see why. And this is the reason why I ask a developper.
I hope the developper who write this code knows why... and agrees to tell me :)

[Zenju]

Aren’t the SFTP commands not already encrypted by FreeFileSync before before being sent through the internet ?

Yes, SFTP is TLS-encrypted, and so is everything that is sent over the SSH connection.

As I use remote NAS with SFTP server to bachup my datas, I note the password is base64 encoded in the FFS cloud command :
lien.png
I’m worried about this behavior.

This is so that your coworker doesn't see your password when looking over your shoulder.

[Plug-fr]

Hi Zenju and thank for your answer

Ok for

the man looking over my shoulder

But what about the man accessing my computer ?
As said "Therube", this password is stored in base64 locally (in the ffs_gui file).

It's a security hole.

Can you think about a solution protecting acces to the ffs_gui file ?

Thank's for develop this very good tool

[xCSxXenon]

You should be protecting your computer so they can't access your computer.

[Zenju]

There is the "prompt during login" password option.

[Plug-fr]

thank you again.

I discover this option recently and it seems good.

However I had to delete few passwords in the GlobalSettings.xml file, recorded I suppose before I use the option.