Password as Cleartext ?

[SvenBent]

It appears that HFZssaves user password as clear text instead as a hash.  Would it be possible to  implant proper hashing with salt in the future?

Also links seems to contain names of folders which is highly snoop able by third party. it would be nice with a randomnesses feature for the links  so avoid snooping as well as deep linking
Basically
When you hit link with name "nasty folder" it should not link to" server/Nasty folder" but instead to "ever/random gible" and the content of "Nasty folder" should be behind that link.
It could randomize it at each start up  and with a certain day interval

[bmartino1]

*I think you mean HFS.. not HFZ...

First
QUOTE:
"It appears that HFS saves user password as clear text instead as a hash"
------------
see link for more info:
http://stackoverflow.com/questions/146146/is-my-form-password-being-passed-in-clear-text

That is default for all/any HTTP web server!... you must encode your own encryption/Login details!
Double chekc the "URL encoding" under HFS menu in expert mode

second, your talking about encoding web links, which is a great feature but not yet available for hfs... but there isa better solution/ handle on this... and controlled by FREE third part software...

I recommend stunnel and this version of HFS:
https://www.stunnel.org/downloads.html

http://www.rejetto.com/forum/hfs-~-http-file-server/for-testing-purpose-hfs-beta-279-including-ssl-tools/msg1059991/#msg1059991

[rejetto]

yes, hashing would be a good idea.  I'm putting it in the to-do list, tho i doubt i will soon find enough time but anyone is welcome contributing of course.
The random url at every startup is beyond my hopes, but consider you can manipulate the names freely without touching the true file system.

bmartino1, even if the protocol doesn't provide you a feature sometimes you can add it.

[SvenBent]

First
QUOTE:
"It appears that HFS saves user password as clear text instead as a hash"
------------
see link for more info:
http://stackoverflow.com/questions/146146/is-my-form-password-being-passed-in-clear-text

That is default for all/any HTTP web server!... you must encode your own encryption/Login details!

I think you are misunderstanding. you link talk about the http request. I'm talking about the password saved on the server.
and its is definitely NOT normal procedure to save them as clear text. Its a huge data breach issues if you store passwords in clear text or encrypted mode. Its been proper way for security reasons to save them as a salted hash for a long time now.

Double chekc the "URL encoding" under HFS menu in expert mode

I'm not sure what you want me to check here. At first look see nothing that that does any of my suggestions

second, your talking about encoding web links, which is a great feature but not yet available for hfs... but there isa better solution/ handle on this... and controlled by FREE third part software...

I recommend stunnel and this version of HFS:
https://www.stunnel.org/downloads.html

http://www.rejetto.com/forum/hfs-~-http-file-server/for-testing-purpose-hfs-beta-279-including-ssl-tools/msg1059991/#msg1059991

I will look into this but it seems to be to just be a vpn tunnels and nothing to do with my sueestions.
It will help against third party snooping but if i undestand correctly it requires software as well on the clients.
The reason Im' using a http file server is to avoid the clients need for special software
Correct me if im wrong


@Rejetto
Sounds good.
i know i can change the name but the url and the apparent name in the html page is still going to be the same
so if the the foldername has to be something understandable so will the url.
If im missing somewhere to have the html link name be different from the actual url im sorry for not reading the documention propperly

[SilentPliz]

***
It will help against third party snooping but if i undestand correctly it requires software as well on the clients.
The reason Im' using a http file server is to avoid the clients need for special software
Correct me if im wrong
***

No, Stunnel is an SSL proxy ... There is only installed on the server side (the client accesses to pages via its own browser in https (TLS ).

[bmartino1]

I think you are misunderstanding.

You are correct, i apologize for my mistake, i thought you were talking about on the webpage and loging in...

These might be of help...
http://crypto.stanford.edu/PwdHash/
https://crackstation.net/hashing-security.htm

[SvenBent]

Thank you both for all the info ill definitely get stunnel up and running as soon as i get control of my domain name again.
Hoping to see a new version of htfs with safe password storing soon.  /cross fingers