Security Gap

big enough to drive a truck thru

[grandpa]

I made a discovery that's not pretty. From any browser you can ftp://www.mysite.com and view my mailbox, my directories, my files. Anything can be copied, modified or moved.

In contrast, to use an ftp program to access my site, a password is required. No anonymous logins are allowed.

So what is the solution?

thanks
grandpa

[TheDave]

I think you might have checked the "Save this password" box or something ;)

[grandpa]

Actually, there's is not even a request for a login.

[Krapulator]

What dave said!

Test it from another computer

[dcrombie]

Mmmm... cookies ;)

[bird]

Mmmm... cookies

FTP doesn't use cookies.

But it's indeed most likely the browser storing the password in one way or another.

[TheDoctor]

I made a discovery that's not pretty. From any browser you can ftp://www.mysite.com and view my mailbox, my directories, my files. Anything can be copied, modified or moved.

I doubt that anything can be copied, modified or moved via a browser. Have you tried this?

But I'd move your mailbox right out of directory space if I were you. I'm surprised you have it there anyway. That's a security hazard in its own right.