Editing FileZilla (section)

==Criticism==

===Bundled adware issues===
{{Update|section|date=July 2021|reason=See https://www.howtogeek.com/218764/}}
In 2013 the project's hosting site, SourceForge.net, provided the main download of FileZilla with a [[Download manager|download wrapper]], "offering" [[Adware|additional]] software for the user to install. Numerous users reported that some of the adware installed without consent, despite declining all install requests, or used deception to obtain the user's "acceptance" to install. Among the reported effects are: web browser being [[Browser hijacking|hijacked]], with content, start page and search engines being forcibly changed; popup windows; privacy or [[Spyware|spying]] issues; and sudden shutdown and restart events possibly leading to loss of current work. Some of the adware was reported to resist removal or restoration of previous settings, or were said to reinstall after a supposed removal. Also, users reported adware programs to download and install more unwanted software, some causing alerts by security suites, for being malware.<ref name="Brinkmann" />

The FileZilla webpage offers additional download options without adware installs, but the link to the adware download appears as the primary link, highlighted and marked as "recommended".<ref name="Brinkmann" /><ref>{{cite web|url=https://blog.emsisoft.com/en/12678/mind-the-pup-top-download-portals-to-avoid/|title=Mind the PUP: Top download portals to avoid - Emsisoft - Security Blog|website=blog.emsisoft.com|date=11 March 2015|access-date=8 June 2018}}</ref>

As of 2016, FileZilla displays ads (called sponsored updates) when starting the application. These ads appear as part of the "Check for updates" dialog.<ref>{{cite web|url=https://filezilla-project.org/sponsored_updates.php|title=FileZilla - Sponsored Updates|work=filezilla-project.org|access-date=12 September 2016}}</ref>

In 2018, a further controversy about FileZilla's use of a bundled adware installer caused concern.<ref>{{cite web|url=https://www.bleepingcomputer.com/news/security/filezillas-use-of-bundled-offers-sparks-outrage-from-users/|title=FileZilla's Use of Bundled Offers Sparks Outrage From Users
|work=.bleepingcomputer.com |access-date=6 January 2019}}</ref>

===Plain text password storage===
Until version 3.26 FileZilla stored all saved usernames and passwords as plain text, allowing any malware that had gained even limited access to the user's system to read the data. FileZilla author Tim Kosse was reluctant to add encrypted storage. He stated that it gives a false sense of security, since well-crafted malware can include a [[keylogger]] that reads the master password used to secure the data. Users have argued that reading the master password to decrypt the encrypted storage is still harder than just reading the unencrypted storage.<ref>{{cite web|title=Missing password feature now poses a serious security threat|url=https://forum.filezilla-project.org/viewtopic.php?f=2&t=31521|website=Filezilla forums|access-date=29 May 2017}}</ref> A [[Fork (software development)|fork]] called ''FileZilla Secure'' was started in November 2016 to add encrypted storage.<ref>{{cite web|url=http://www.filezillasecure.com/|title=FileZilla Secure - Dedicated to keeping your FTP passwords secure.|last=FileZillaSecure|work=filezillasecure.com|access-date=23 November 2016}}</ref> In May 2017, encrypted storage was also added to the main version, 10 years after it was first requested.<ref>{{cite web|last1=Cimpanu|first1=Catalin|title=FileZilla FTP Client Adds Support for Master Password That Encrypts Your Logins|url=https://www.bleepingcomputer.com/news/software/filezilla-ftp-client-adds-support-for-master-password-that-encrypts-your-logins/|website=Bleeping Computer|date=26 May 2017|access-date=29 May 2017}}</ref> Kosse maintained that the feature did not really increase security, as long as the operating system is not secure.<ref>{{cite web|title=FileZilla 3 development diary|url=https://forum.filezilla-project.org/viewtopic.php?p=156130#p156130|access-date=29 May 2017}}</ref>