Re: Secure file transfer

evans@xxxxxxxxxxxxxxxxxxx wrote:


In Core FTP, is it better to use AUTH SSL or SSH/SFTP?


SSL. SSH/SFTP only protects the data transfer channel, not the command channel.

This may (or not) have a bearing on it. When I connected using AUTH
SSL, the connection script said:

...
AUTH SSL
500 This security scheme is not implemented
...

It then went on with the connection. I contacted the people who are
hosting my account and the first guy said that :

"That error message is misleading, it means that the ssl cannot be
authenticated but it will still use the encryption layer."


Well, are you doing implicit or explitic SSL authentication?

In Winscp, which only uses SSH (and I have that enabled in my
account), One of the fields in the login screen is "Private Key File".
Core FTP did not have such a field. In any case, what happens if I
leave that field blank?


Nothing.

Is my password and data going out unencrypted if I have not set up a
private key?


No. It just means that the server cannot authenticate you, that is, the server doesn't know who he's talking to. A malicious user might insert commands on the command channel on your behalf without being detected.
.

Relevant Pages

  • Re: Secure file transfer
    ... SSH/SFTP only protects the data transfer channel, not the command channel. ... SSL, the connection script said: ... are you doing implicit or explitic SSL authentication? ...
    (comp.security.misc)
  • Re: Secure file transfer
    ... ssh encrypts everything passing between ... SSL, the connection script said: ... commands on the command channel on your behalf without being detected. ...
    (comp.security.misc)
  • Re: Mixed Mode Authentication in .net 2.0
    ... There are two parts to SSL, which is why this can be confusing. ... encryption and authentication of the server. ... ADFS supports a component called the federation service proxy which is ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Search not working
    ... Management>Authentication Providers>Edit Authentication, does not provide the ... ability to indicate whether the web application is using SSL or not. ... I changed IIS Authentication for the web site back to Integrated ... I have installed an SSL certificate and required SSL ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: Can SSL sessions be compromised?
    ... the proxy machine -- if I enable local cookies for authentication this ... your "SSL server" machine may be trying to catch some simple types of ... information carried by the digital certificates was ... clicking on any RFC number, brings up that RFC in the lower RFC summary ...
    (comp.security.misc)