6.2 FTP

FTP (file transfer protocol) is a protocol used to transfer files. This protocol was original a popular protocol. However, it is being replaced by HTTP for most Internet-based anonymous file transfer applications. In an anonymous file transfer, the requesting host does not need to authenticate against an account database at the server.

There are several reasons HTTP is replacing FTP for anonymous file transfer. First, HTTP has an option to use HTTPS for secure file transfer. Although FTP can be performed on top of SSL, this combination is less common. The most important reason is that HTTP/HTTPS based file transfer is more user friendly, and there is no need to install any additional software (other than a web browser).

For authenticated file transfer, SSH (see its own section) is replacing FTP. SSH is natively more secure because all traffic is encrypted. In addition, SSH only needs one port, instead of multiple ports. Last, but not least, SSH also allows the use of many different means of authentication.

Generally speaking, plain FTP for authenticated file transfer is considered very insecure because both the username and password are transferred in plain text.