Quote:
|
Originally Posted by tuff
as i said, its much harder to steal an ip, than to steal a cert and sites.dat prolly stored in the same place
|
This is false information. To steal certificate you need access to computer, and if certificate is stored in certificate store (which could be in remote loaction) - administrator level privileges. While to steal ip you need one of the following: access to computer, access to one of the routers between client and server or access to same ip range. Also, encrypting certificate and/or sites.dat is not such a bad idea (afaik. ffxp allows encryption of sensitive information)
And just like harm mentioned earlier, script may store arbitary data to both user and group databases. Adding ip/ident checks is rather trivial (though I don't personally see much use for ident check nowdays)
Implementation of client certificate check is trivial on both openssl and SSPI, and I've actually done this on both. On passive mode transfers, it's also neccessity for site to authenticate data connections as well, if site does not restrict data connection to allow access only from ip that control connection originates from.