Subject: Ftp-WG: FTPS using a Web browser

From: Jeffrey Altman <[email-masked]>
Date: Tue, 16 Oct 2001 09:51:48 -0500

> >Does anybody know if a Web Browser supporting FTPS exist or is in 
> >development ?
> 
> I've yet to see a web browser that supports FTP over TLS - and the name 
> "FTPS" hasn't yet been applied to any particular FTP security 
> implementation.  Granted, if anything is going to be called "FTPS", then it 
> should be the "FTP over TLS" specification currently in internet-draft 
> form.  However, it is also worth noting that a specification for "ftps" 
> URIs should be drafted by the appropriate bodies, and described adequately 
> for future implementors - for instance, in "ftps", should the data transfer 
> as well as the initial command connection be encrypted?  [Almost certainly, 
> yes]  Calling it "ftps" and leaving it up to others to implement is liable 
> to cause the problem that browser implementors, already woefully inadequate 
> in their FTP implementations, may choose to implement the deprecated 
> "implicit SSL connection" syntax, rather than using the more appropriate 
> "AUTH" commands.
> 
> Alun.

Alun:

I believe FTPS refers to the FTP over SSL tunnel which only protected
the command channel.  It should not be used to refer to the current
FTP over TLS specification which uses the AUTH command.  There is no
reason to have a separate URI for that.  The browsers should just
implement the AUTH TLS option and attempt to negotiate it on every
connection.

 Jeffrey Altman * Sr.Software Designer      C-Kermit 8.0 Beta available
 The Kermit Project @ Columbia University   includes Secure Telnet and FTP
 http://www.kermit-project.org/             using Kerberos, SRP, and 
 [email-masked]          OpenSSL.  SSH soon to follow.