Why is this done?

[volcano]

Sorry if this has been posted elsewhere before..Search returned nothing.

I was just browsing throug hmy CPanel control panel when I went into the "FTP Account Maintenance" section.

To my shock, my clear text password is in the URL that links to the FTP download of the logfiles!

ftp://myaccount_logsassword@ftp.myserver/myserver.com

Will this be changed in the future?

[SarcNBit]

When using standard FTP, your password is transmitted in plain text. You need to know your password to login to your cpanel right? So what is the big deal?

I agree that unamew combinations should not be sent via URL links under any circumstances and I understand your concern that your password is "on display" for anyone that might be walking by, but FTP is a security issue anyway you slice it.

[jandafields]

Originally posted by SarcNBit
When using standard FTP, your password is transmitted in plain text. You need to know your password to login to your cpanel right? So what is the big deal?

I agree that unamew combinations should not be sent via URL links under any circumstances and I understand your concern that your password is "on display" for anyone that might be walking by, but FTP is a security issue anyway you slice it.

But, according to cpanel, all our passwords are stored as a 1-way hash, so how does cpanel know our password? It must be stored as plain-text on the server!!! This is VERY BAD

[chirpy]

n/m

[jandafields]

With the password being embedded into the links, that causes the password to be saved in the Internet Explorer history. This is different than sniffing the password when you type it in...

[jandafields]

Originally posted by thaphantom
I believe it is stored in a cookie, when u log out or close the browser the cookie gets eaten byt the cookiemonster

That is only if you click on File -> Login As...

CPanel is embedding it into the url, which is added to the history.

[jandafields]

Originally posted by thaphantom
only if you use the ftp logs. which opens an ftp conection.

That's exactly what I have been talking about...

[SarcNBit]

Originally posted by jandafields
With the password being embedded into the links, that causes the password to be saved in the Internet Explorer history.

I thought IE was no longer supporting that method.

[jandafields]

Actually, I read that earlier today somewhere (IE not allowing that syntax anymore). Another good reason to get rid of the password in the links (just let IE prompt you for it)...

[bouncer]

Just another reason why you should log in to cpanel using the secure connection

[rockstar]

Why not use a free piece of software that is more reliable than Microshaft? FileZilla is free, works like a champ and is a hell of a lot more stable than the crap that MS puts out there.