Hacker News new | past | comments | ask | show | jobs | submit login

ftps exists. The solution to http wasn't getting rid of it, it was pushing for more https.

I'm not saying there weren't good reasons to get rid of ftp support, but that doesn't seem like one.




Surprising how many people don't know about ftps. FTP with SSL.


It's very obscure. Most things (mostly shared hosting lol) went straight to SSH's SFTP instead.


SFTP is mainly a *NIX thing. And it's a terrible hack built on top of a protocol meant to be something really different.

Also, while in theory SFTP can be as secure as FTPS, in practice it's not. How many people really check that the server public key signature it's the correct one? You know that annoying message that appears the first time you connect to a server and you have to say yes and if you don't it will not let you continue?

Not checking that give you the same security as having a HTTPS/FTPS server with a self signed certificate. You trust blindly the identity of the server, but there could be someone doing a man in the middle and stealing all your data. In that situation, FTPS is more secure, mainly because you need a valid TLS certificate that will give you some guarantee about the identity of the server.


At least in the pre-Let'sEncrypt era, lots of the shared hosting providers that gave you SFTP as an upgrade over plaintext FTP also used self-signed certs for their HTTPS admin panels :D

Server identity keys can be checked using SSHFP DNS records signed with DNSSEC, but that is not really mainstream unfortunately.


It's because there's multiple versions which are fundamentally incompatible.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: