Security / Encryption

Hi all, I am a new user, I was introduced by a friend who told me WinSCP was brilliant...and it is!!
Thanks a lot all.
My question is:
I connect from point A to point B (very far from me) to a friend`s computer. He tells me that the files we transfer, whatever they are, are Encrypted. I am not sure about that. What if someone can get hold of the stream, would he be able to see the files once he, as well, gets WinSCP?
Thanks for your time.

Regards,

K-Island

K-island wrote:

What if someone can get hold of the stream, would he be able to see the files once he, as well, gets WinSCP?

You are talking about 'man-in-the-middle' (MIM or MITM) attacks.

A very complex topic, and I won't claim to understand it either.

But, do a google and you'll find plenty of information on it.

HTH,

Cheers,
Adem

As Adem wrote, this is complex topic, and I'm not going to go too deep here. Just shortly: the stream is encrypted, so it is not easy (if possible at all) see the files. Easier way for attacker is to pretend to be a server and wait for you to connect to him. This way he obtains your password and can use it to connect to real server. That's why WinSCP asks you to confirm the server's public key on the first connection. Because if you unwittingly connect to attacker machine later, the key will change and WinSCP will notice it and warn you. For this work it is important that you, on the first connect, know that you really connected to the right server. For this you should know the server's finger print before the connection and compare it with what WinSCP shows yoy. (It shows it even before it sends your password or other credentials to the server).

Read Putty Documentation for more. For example chapter Verifying the host key.