Hacker News Reader

You can't have secure FTP without a certificate and you can't have a certificate without DNS/domain names unless you want to manually add certificates around which is bad UX again.

The ideal situation would be some universal airdrop which will never happen. The next easiest solution is to use cloud storage and send a link to the other person.

View on HN

Yeah, that's fair. I think FileZilla shows who signed the cert, but yeah it still gives that pop-up asking the user to decide and I haven't checked whether they verify that signer against the system CA list. Either way, that's as canon as FTP clients get and since they don't have it, indeed it's mostly opportunistic encryption. (Not that relying on the CA system rather than TOFU'ing or sharing a fingerprint is without problems of its own, but that's a discussion for another thread.)

Reply on news.ycombinator.com