FlashFXP Forums - View Single Post - FlashFXP or WS-FTP Pro??????

chotaire · 12-02-2004, 10:06 AM

I've been a longtime (registered) user of WS_FTP Pro for a couple of years. Once I really tested FlashFXP, things were clear to me.

FlashFXP had tons of more options completely unknown to WS_FTP. Things like FXP (very useful for both professional and kiddie use), SSL Encryption, Queueing and much more has been a part within FlashFXP much longer than in WS_FTP (if they implemented it at all).

One day, I wrote a HOWTO on secure FTP transfers and I tested all currently available FTP clients that claim SSL functionality. WS_FTP Pro (7.0) completely lost during my tests because at that time, they only offered 40bit data and control connections, and no FXP (SSL or not) at all. Since that day, I have never been using WS_FTP again, and I never regretted it.

I'm not affiliated to IniCom in any way, so I dare saying: FlashFXP has always been and probably will always be more advanced, with a better interface and a better support.

Here's a sniplet of my past-time HOWTO (it's already some years old so the data is no longer correct, e.g. FlashFXP can do more than 168bit SSL today):

-----
FlashFXP 1.4.4 build 849 (best client, will do 168bit data, control and allow FXP = PERFECT)
CuteFTP Pro 2.0 (client is quite ok, will do 168bit data and control = EXCELLENT)
WS_FTP Pro 7.5* (client is good, will do 168bit data and control = EXCELLENT)
WS_FTP Pro 7.0* (client is very good, will do 40bit data and control = OK)
IglooFTP Pro Win/Linux (client seems ok, will do 40 bit data and control = OK)
pftp Linux (client is buggy hacking, but will do 168bit data and control = EXCELLENT)
There are more clients such as lftp (Linux), ftp-tls (Unix) and SecureFTP, but they're untested.
-----

Again, the data is not uptodate and this is only a short sniplet from my HOWTO. Should I ever rewrite the HOWTO, I will make it available to all users. It includes complete instructions for both servers and clients how to set up a secure FTP server. For FlashFXP, there are screenshots etc.

One thing I want you to know though... Using PGP for file transfers is kinda hoax. Files get encrypted before being uploaded and the only way people can download this is to use the same FTP client or do it manually. This is nothing else than a normal file encryption and actually hasn't much to do with an FTP client, it seems a lame trick to get customers believe they are buying an FTP client with ultimate security. However, remember one thing... all that gets encrypted is the files BEFORE you put them onto the server, so the connection itself stays completely unencrypted (e.g. username and password can still be sniffed). Forget about crap like that, you don't even need WS_FTP to do things like this, all you need is a free PGP program. Also, if you are e.g. uploading files to a webserver, the files can NOT be used if encrypted by PGP. You would have to log onto the server by SSH and decrypt the files manually using a command line pgp client. Is this lame?

Use a secure SSL FTP client (or SCP if you are ok with limited functionality) and for the server, use an encrypted filesystem. This way, things are COMPATIBLE and everybody can use your server, no matter what FTP client they have, as long as they support SSL. Or simply said, use FlashFXP and be happy.

See you.

12-02-2004, 10:06 AM
chotaire Member Join Date: Sep 2004 Posts: 82	I've been a longtime (registered) user of WS_FTP Pro for a couple of years. Once I really tested FlashFXP, things were clear to me. FlashFXP had tons of more options completely unknown to WS_FTP. Things like FXP (very useful for both professional and kiddie use), SSL Encryption, Queueing and much more has been a part within FlashFXP much longer than in WS_FTP (if they implemented it at all). One day, I wrote a HOWTO on secure FTP transfers and I tested all currently available FTP clients that claim SSL functionality. WS_FTP Pro (7.0) completely lost during my tests because at that time, they only offered 40bit data and control connections, and no FXP (SSL or not) at all. Since that day, I have never been using WS_FTP again, and I never regretted it. I'm not affiliated to IniCom in any way, so I dare saying: FlashFXP has always been and probably will always be more advanced, with a better interface and a better support. Here's a sniplet of my past-time HOWTO (it's already some years old so the data is no longer correct, e.g. FlashFXP can do more than 168bit SSL today): ----- FlashFXP 1.4.4 build 849 (best client, will do 168bit data, control and allow FXP = PERFECT) CuteFTP Pro 2.0 (client is quite ok, will do 168bit data and control = EXCELLENT) WS_FTP Pro 7.5* (client is good, will do 168bit data and control = EXCELLENT) WS_FTP Pro 7.0* (client is very good, will do 40bit data and control = OK) IglooFTP Pro Win/Linux (client seems ok, will do 40 bit data and control = OK) pftp Linux (client is buggy hacking, but will do 168bit data and control = EXCELLENT) There are more clients such as lftp (Linux), ftp-tls (Unix) and SecureFTP, but they're untested. ----- Again, the data is not uptodate and this is only a short sniplet from my HOWTO. Should I ever rewrite the HOWTO, I will make it available to all users. It includes complete instructions for both servers and clients how to set up a secure FTP server. For FlashFXP, there are screenshots etc. One thing I want you to know though... Using PGP for file transfers is kinda hoax. Files get encrypted before being uploaded and the only way people can download this is to use the same FTP client or do it manually. This is nothing else than a normal file encryption and actually hasn't much to do with an FTP client, it seems a lame trick to get customers believe they are buying an FTP client with ultimate security. However, remember one thing... all that gets encrypted is the files BEFORE you put them onto the server, so the connection itself stays completely unencrypted (e.g. username and password can still be sniffed). Forget about crap like that, you don't even need WS_FTP to do things like this, all you need is a free PGP program. Also, if you are e.g. uploading files to a webserver, the files can NOT be used if encrypted by PGP. You would have to log onto the server by SSH and decrypt the files manually using a command line pgp client. Is this lame? Use a secure SSL FTP client (or SCP if you are ok with limited functionality) and for the server, use an encrypted filesystem. This way, things are COMPATIBLE and everybody can use your server, no matter what FTP client they have, as long as they support SSL. Or simply said, use FlashFXP and be happy. See you.