Question

My application is downloading a client from my server via FTP. I must use FTP in this case as I made the file on my server forbidden from public use; thus, the only way to download the file is as an administrator which I can do by supplying an username and password to the FTP client. The problem with doing this, though, is that by using Fiddler I can “sniff” out the password sent to the FTP client from c#.

Code:

var downloadFileRequest = (FtpWebRequest)WebRequest.Create("ftp://" + Public.ftp_host + "//" + fileName);
            downloadFileRequest.Credentials = new NetworkCredential(Public.ftp_username, Public.ftp_password);
            downloadFileRequest.Method = WebRequestMethods.Ftp.DownloadFile;
            downloadFileRequest.UseBinary = true;

            ServicePoint sp = downloadFileRequest.ServicePoint;
            sp.ConnectionLimit = 2;

                var downloadResponse = (FtpWebResponse)downloadFileRequest.GetResponse();

                    Stream downloadStream = downloadResponse.GetResponseStream();

Is there some way to download files via FTP without exposing this password?

Thank you,
Evan

Answer 1

Nope. FTP sends credentials plainly. You have to use SFTP or something equivalent.