Is that so?

[BikeBoy]

Guys, I just read a post that made me nerveous:

Post:

Hi,

We have a FileaMaker Server 5 on Windows 2000, and about 30 clients on pcs and Macs.

1. I'd like to know if the passwords are sent across the network in clear-text when I open a file on the client (laptop or desktop). Do I work with the hosted file on the server, or is it completely run by a client, and only saved on the server on commit?

2. FileMaker seems to be extremely client-oriented when it comes to performance of scripts. That leads me to the question: are the scripts/calculations processed on the server or on the client?

Thanks

Answer:

Passwords are passed across the network from client to server in the clear i.e. not encrypted in any way.

Is that so? I always thought that passwords are resolved on the client

[BobWeaver]

1. No it's not true. The passwords are not sent in clear text. They are encrypted, but the encryption method is not what I would call industrial strength. The passwords are verified on the client machine.

2. All scripts are processed on the client machines.

[BikeBoy]

Thanks BobWeaver, that makes me feel a bit better.

So the encryption is something like 40-bit, but they are still sent acros the network, then.

Thanks again

[BobWeaver]

So the encryption is something like 40-bit...

No, it's many orders of magnitude weaker than 40 bit encryption. The only redeeming feature is that the algorithm is not public knowledge.

...but they are still sent acros the network, then.

Yes, because the passwords are stored in the files on the server but verified by the client, they must be sent across the network when a client user opens a file.

The official word from FMI is in this tech note:

http://www.filemaker.com/ti/108462.html

[Anatoli]

RE: 2. FileMaker seems to be extremely client-oriented when it comes to performance of scripts. That leads me to the question: are the scripts/calculations processed on the server or on the client?

Apart of indexing everything is processed on client machine.