Let's wrap up by comparing unsecure FTP to FTPS.
Unsecure FTP requires a username and password
combination for client authentication.
And while FTPS also supports this simple method,
administrators can optionally use client-side TLS
certificates for additional security.
Unsecure FTP has no ability to protect the signaling channel,
revealing secret data such as passwords.
FTPS always encrypts the signaling channel after the session is established.
Unsecure FTP also has no mechanism to encrypt the files being transferred,
and FTPS provides four different options,
giving the client the ability to toggle between them using the PROT command.
Unsecure FTP does have a few advantages,
such as its active mode variant working across some NAT devices.
I've personally never seen FTPS active mode work across NAT,
since the NAT device would need to see the client's port command contents.
Last, unsecure FTP is faster and pushes less data on the network,
which might be attractive in time-sensitive or low-bandwidth environments.
FTPS is a bit slower,
given the more rigorous authentication process and overhead of encryption,
as seen in the packet captures.
In the next module,
I'll introduce a popular alternative for securing FTP that doesn't rely on SSL. Stay tuned.