It’s a truth that does work and many of us who use open-source software daily accept it as such. I'm just asking you to make users more aware of that choice, to help them make enlightened choices.A basic tenet of open-source software security has long been the idea that since the code is open, anyone can look inside to see if there is something that shouldn’t be there.

To conclude, I can understand that by design you want to make your users life easy, but I can't understand that you want to store ssh (sftp) password in plaintext without him knowing about it. So there is 2 solutions : you ask the user the first time at the first use or you put the default value of kiosk mode to 1 (so you still log an history of servers but without the password). In the whole software industry nobody do that, even Micro$oft with Int€rn€t €xplor€r ask before storing a password. Adding that cost you nothing, even in term of 'design' or 'philosophy'.Ģ) When first using this software you don't know your password is gonna be logged in clear text, nothing tell it to you. A lot of people want to change that behaviour of storing the password, and so go to the preference window. It's not an 'advanced' setting, it's a critical setting so you shouldn't hide it in some xml file. I know you can fix that problem with the kiosk mode option in the filezilla.xml file.ġ) This option should be available directly in the preference window of the client gui.

I perfectly understand your reason to do that and I understand it's 'by design'. I know a lot of ticket has been posted about this, but there is a reason for that. So it's about the storage of unencrypted password.

Is filezilla safe ark