Subject: SKey logon to ftp

From: Peter Hawkins <[email-masked]>
Date: Tue, 9 May 95 16:53:39 PDT

Below is my problem of the day.  Care to take
a stab at it?

User Requirement:

  To distribute files that contain
  sensitive information to a selected
  group of 200 people.

  User is uncomfortable with encrypting files
  and does not want to use it.

Possible solutions:

  I wish user would encrypt files and allow me
  to use a regular old ftp server, but it seems
  to be out of the question.

  User thinks logon and password for ftp would
  be secure enough.  Shaaaaa right!

  I'm starting to like the idea of a "Secure Key"
  type of logon to wu-ftp.  Have any of you done
  this?  Other ideas?

Example:

  Logon: Username
  Challenge: 1234412
  Password: Generated key from challenge key

Pete
--
EDS - C4 Technology West
Bellevue, Washington
[email-masked]

---

From: [email-masked] (Dave Wolfe)
Date: Wed, 10 May 1995 08:33:09 -0500 (CDT)

[ Peter Hawkins writes: ]
>   be secure enough.  Shaaaaa right!

Point out to the user that ftp always sends user ID and password in the
clear, even over public networks, so any tcp sniffer can easily filter
packets for USER and PASS identifiers to obtain logons complete with
passwords. Insist on encryption or get agreement that the data isn't
worth protecting.

-- 
 Dave Wolfe    *Not a spokesman for Motorola*  (512) 891-3246
 Motorola MMTG  6501 Wm. Cannon Dr. W. OE112  Austin  TX  78735-8598