Comments on: Security treat: the ftp address, username and password of your website’s server broadcasted over the Internet http://fgiasson.com/blog/index.php/2005/07/29/security_treat_the_ftp_address_username/ Sat, 17 Jul 2010 23:32:24 -0400 http://wordpress.org/?v=2.8.6 hourly 1 By: Fred http://fgiasson.com/blog/index.php/2005/07/29/security_treat_the_ftp_address_username/comment-page-1/#comment-304 Fred Mon, 01 Aug 2005 16:10:38 +0000 #comment-304 Hello Sudar,<br /> <br /> Yup, in fact, probably all stats services able to publicaly broadcast the stats are "vulnerable".<br /> <br /> <br /> Yup, it is also true for the session ID. However, this one is the problem of the webdeveloper. It depends on how his system is builded and how he handle the sessions ID.<br /> <br /> Salutations,<br /> <br /> Fred<br /> Hello Sudar,

Yup, in fact, probably all stats services able to publicaly broadcast the stats are “vulnerable”.

Yup, it is also true for the session ID. However, this one is the problem of the webdeveloper. It depends on how his system is builded and how he handle the sessions ID.

Salutations,

Fred

]]> By: Sudar http://fgiasson.com/blog/index.php/2005/07/29/security_treat_the_ftp_address_username/comment-page-1/#comment-303 Sudar Mon, 01 Aug 2005 04:44:02 +0000 #comment-303 Hi Fred,<br /> <br /> Even sitemeter has the same problem. It is not only limited to FTP username and password even session id which are passed in the url can be retrived if the stats are opened as public<br /> Hi Fred,

Even sitemeter has the same problem. It is not only limited to FTP username and password even session id which are passed in the url can be retrived if the stats are opened as public

]]> By: Fred http://fgiasson.com/blog/index.php/2005/07/29/security_treat_the_ftp_address_username/comment-page-1/#comment-302 Fred Sat, 30 Jul 2005 14:55:27 +0000 #comment-302 Hello Alex,<br /> <br /> Definitely. It could be a good fix. The problem I see is that people would not know what the feature is for, then would not use it. Another solution should be to trick the HTTP request's header to hide the came from URL field (or something like that, I do not remember of the exact name of the field) of the HTTP request.<br /> <br /> Salutations,<br /> <br /> Fred Hello Alex,

Definitely. It could be a good fix. The problem I see is that people would not know what the feature is for, then would not use it. Another solution should be to trick the HTTP request’s header to hide the came from URL field (or something like that, I do not remember of the exact name of the field) of the HTTP request.

Salutations,

Fred

]]> By: Fortrel http://fgiasson.com/blog/index.php/2005/07/29/security_treat_the_ftp_address_username/comment-page-1/#comment-301 Fortrel Fri, 29 Jul 2005 18:40:32 +0000 #comment-301 Hmm... That's an interesting problem. <br /> <br /> Another option would be for the AceFTP software to have a property like "Root URL" to specify where is the content of the FTP site available on the web. So if you ask for a preview of, let say "/home/mysite/public_html/index.html", it knows that this is available online at "http://www.mysyte.com/index.html". It would do the translation for you and use the HTTP protocol, instead of using the FTP protocol. <br /> <br /> (This last sentence reads ok, but if you stop and think about it, the "P" of HTTP and FTP stands for "protocol" so it becomes pretty redundant!) :-)<br /> <br /> Alex Hmm… That’s an interesting problem.

Another option would be for the AceFTP software to have a property like “Root URL” to specify where is the content of the FTP site available on the web. So if you ask for a preview of, let say “/home/mysite/public_html/index.html”, it knows that this is available online at “http://www.mysyte.com/index.html”. It would do the translation for you and use the HTTP protocol, instead of using the FTP protocol.

(This last sentence reads ok, but if you stop and think about it, the “P” of HTTP and FTP stands for “protocol” so it becomes pretty redundant!) :-)

Alex

]]>