Replacing Insecure Protocols: Telnet vs SSH, FTP vs SFTP

Many foundational internet protocols were designed in the 1970s and 1980s when security was not a primary concern. Cleartext protocols transmit all data — including usernames, passwords, and sensitive information — in plaintext over the network. Any device on the same network segment, or any system the packets traverse, can capture and read this traffic with freely available tools like Wireshark. In environments with network switches (which normally isolate traffic between ports), ARP spoofing can redirect traffic to an attacker's system, making cleartext protocols dangerous even on 'internal' networks.

Telnet (TCP port 23) provides remote command-line access to systems but transmits everything in plaintext. It has no built-in authentication beyond username/password, which are sent unencrypted. SSH (Secure Shell) (TCP port 22) replaces Telnet with an encrypted, authenticated channel. SSH uses asymmetric key exchange to establish a session key, then encrypts all subsequent communication with symmetric encryption. SSH also authenticates the server (preventing server impersonation) and supports public key authentication (passwordless but more secure than passwords) in addition to password authentication.