Nah dude that ' s nobodies fault . It should ' ve hit . The last second 3 was gut wrenching but the referees calling a foul on UB for literally doing anything was pathetic . <| sep |> I can ' t be the only that doesn ' t think it hurts to step on legos , can I ? It is comfortable but it doesn ' t hurt . <| sep |> Bennett ? Tkachuk ? Da heck man . <| sep |> Signed up using my Google Apps account without issues . Thanks ! <| sep |> Definitely . She smilesI will make sure to find you later so we can speak more . <| sep |> So I just checked into just how ' secure ' this FileZilla is . TLDR it ' s not secure . First off , I know almost no CC but more or less its pretty easy to read . Programmer left some debug code that I enabled . and built from source pain in the ass by the way . Its using 1 round of SHA 512 . Using the password ' password ' the hash was ' B 109 F 3 BBBC 244 EB 82441917 ED 06 D 618 B 9008 DD 09 B 3 BEFD 1 B 5 E 07394 C 706 A 8 BB 980 B 1 D 7785 E 5976 EC 049 B 46 DF 5 F 1326 AF 5 A 2 EA 6 D 103 FD 07 C 95385 FFAB 0 CACBC 86 ' I verified this was truly one round on a couple sites . Now on to the encryption part . I added my own comments AesFileKeyFile S h a M a s t e r P a ssgenerateKeyForFileconst stdstring fileName AesFileKeyFile keyFile const char strptr fileName . cstr const sizet strsize fileName . size const sizet sizebuf sizeofsha 512 MasterPass strsize uint 8 t buf new uint 8 t memcpybuf , sha 512 MasterPass , sizeofsha 512 MasterPass Copy clear text password to buf memcpybuf sizeofsha 512 MasterPass , strptr , strsize Copy filename to buf uint 8 t hash calcSHA 512 buf , sizebuf , hash Calc SHA 512 of bufferclear text password filename and save in hash uint 8 t outkey uint 8 t outiv memcpyoutkey , hash , sizeofoutkey copy 32 bytes of SHA 512 ' hash ' to outkey memcpyoutiv , hash sizeofoutkey , sizeofoutiv Copy next 16 bytes of ' hash ' to outiv uint 8 t hashfname uint 8 t magic calcSHA 512 const uint 8 tstrptr , strsize , hashfname Getting SHA 512 of filename memcpymagic , hashfname , sizeofmagic copy 16 bytes of sha 512 of file name to magic . keyFile . fname fileName memcpykeyFile . magic , magic , sizeofkeyFile . magic copy magic to keyfile . magic memcpykeyFile . key , outkey , sizeofkeyFile . key copy outkey to keyfile . key memcpykeyFile . iv , outiv , sizeofkeyFile . iv copy outiv to keyfile . iv memsetbuf , 0 , sizebuf delete buf return keyFile AES encryption being used is aes 256 cbc found in aesfile . cpp . Taking the plaintextpassword filename and doing one round of SHA 512 and putting it into the variable hash . aes key first 32 bytes of ' hash ' aes iv next 16 bytes of ' hash '. Not a c programmer so This part still needs to be verified . Like to point out SHA 512 is 64 bytes . key and iv are only using 48 bytes of this hash . Doesn ' t really make a difference developer using it just to generate random data using a password and file name . aes magic first 16 bytes of one round of SHA 512 of the file name . This is static , so magic will never change . This is important because we are still at one round of SHA 512 for the password guessing part . This data would be precalculated before you start crackingUsing standard library mbedtls functions for the encrypt and decrypt of the AES encrypted data . So nothing special there . With a decent GPU card SHA 512 benchmark 1 , 045 MHs , I can ' t find any good benchmarks to go off of for decrypting aes 256 cbc using hashcat . Using similar I would guess it would be around ~ 500 700 KHs . So this would be the bottle neck . So at best , if the ' attacker ' couldn ' t install a keylogger . they could still steal the files and do a offline attack . Just like anything that uses a password . The security is only as good as your password . This is pretty raw data here . Just started less than an hour ago . I am planning to create a working Proof of concept . Once that is all ironed out , I will submit a ticket to hashcat for them to add the algorithm . All the parts are already in hashcat , just have to piece them together . If the developer sees this message . You might want to do an update and change the rounds to a minimum 5000 . Thats the amount of rounds linux uses would drop that number from 1 , 045 MHs to around 129 KHs . Next , I would change the magic number to 10 , 000 rounds of sha 512 of the password . I would suggest using bcrypt but that would require more source files and I don ' t think thats really necessary . I know the file name is part of the SHA 512 process just so the keys are different for each file . That makes sense and you could keep that methodology just increase the rounds so its so painfully slow for someone to do an offline attack .