MD4/5, SHA1 Password Encryption


FTP passwords and security risks
The File Transfer Protocol (FTP) uses usernames and passwords passed in cleartext to authenticate clients to servers (via the USER and PASS commands). Except for services such as "anonymous" FTP archives, this represents a security risk whereby passwords can be stolen through monitoring of local and wide-area networks. This either aids potential attackers through password exposure and/or limits accessibility of files by FTP servers who cannot or will not accept the inherent security risks.

One-Time Password System
The One-Time Password (OTP) System uses a secret pass-phrase to generate a sequence of one-time (single use) passwords. With this system, the user's secret pass-phrase never needs to cross the network at any time such as during authentication or during pass-phrase changes. Thus, it is not vulnerable to replay attacks. Added security is provided by the property that no secret information need be stored on any system, including the server being protected.

IglooFTP PRO implementation of the OTP System
IglooFTP PRO offers the most complete implementation of the OTP System, being the only FTP Client to support the SHA1 encryption method in addition to the MD4/5 methods. And because IglooFTP PRO is able to automatically detect if a FTP server supports any of these methods, it will allow you to use encrypted passwords each time they can be used.
To enable the use of encrypted passwords, just set the Password Encryption method in the Preferences dialog box.


Help Index