Filezilla secure keys are cached in the registry

Submitted by statement on July 10, 2008 - 7:39pm

I have a login for a SFTP connection, and I got a prompt that the secure key was to be cached in the registry.

The key is left behind is

HKEY_CURRENT_USER\Software\SimonTatham

I assume it's PuTTys doing, and would much prefer this key to be exported/imported, and removed from the registry on exit.

Thanks

( categories:

)

John T. Haller (Homepage) - July 10, 2008 - 7:47pm

It is indeed PuTTY's doing (for the unfamiliar, FileZilla uses PuTTY to do SFTP using the file fzsftp.exe).

Any idea if this can be used to spoof something later? (i.e. - is it a security issue or merely a leaving data behind issue?)

I have a working fix. I'll post it shortly for a pre-release test.

EDIT - Nope, not a true security issue... but it does essentially leave a trail of what servers you've connected to via SFTP.

Live with purpose.

John T. Haller (Homepage) - July 10, 2008 - 9:53pm

Live with purpose.

statement - July 11, 2008 - 1:49am

Just tested it and the registry keys are properly imported and exported.

Thanks

Applications