How is this a "terribly mistake" ? If people use the "Site > Security > Set password" then this program can't decrypt the "sites".
Security through obscurity vs plain text _____ From: [email protected] To: Nagareshwar Talekar [mailto:[email protected]] Cc: Full Disclosure [mailto:[email protected]] Sent: Mon, 09 May 2011 14:21:34 +0200 Subject: Re: [Full-disclosure] New Tool - Flashfxp Password Decryptor Released ! On Mon, 09 May 2011 17:38:30 +0530, Nagareshwar Talekar said: > FlashFXP stores the password for all the configured FTP sessions in > the local file called "sites.dat". Passwords are encrypted with XOR > based encoding mechanism using the magic string as > “yA36zA48dEhfrvghGRg57h5UlDv3″. A magic string of upper/lower/numeric. That just makes Baby Cryptographer Jesus cry... At that point, one has to wonder what *else* FlashFPX does terribly wrong. I'm sure you brilliant guys can find lots of hilarious uses for feeding it an ftp:// URI of your own choosing. :) This e-mail and any attachments may contain confidential material for the sole use of the intended recipient. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of this e-mail or any attachment is prohibited. If you have received this e-mail in error, please contact the sender and delete all copies. Thank you for your cooperation
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
