“Connect to Server” accepts FTPS URLs but actually connects via plain FTP w/o telling the user!

Originator:p.org
Number:rdar://FB9224153 Date Originated:2021-06-30
Status:Open Resolved:
Product:Finder Product Version:macOS 11.4 Big Sur
Classification:Unexpected / Security Reproducible:Yes
 
## Reproduction
 - macOS 11.4 Big Sur
 - Finder > Main Menu > Go > Connect to server… (⌘-K)
 - Field allows ftps:// scheme. That is FTP in a SSL/TLS tunnel.
See screenshot: Finder Connect To Server FTPS.png
- Click "Connect"

## Expected
- Finder really connects via FTPS

## Actual
- Even though you as the user explicitly requested FTPS, Finder actually falls back to FTP silently!
- That is quite a horrible user experience in regards to https://apple.com/privacy/
- I checked this via Wireshark.org !
See screenshot: FTPS address input in Finder is actually handled as plain FTP without telling the user.png

## Apple documentation / feedback
 - macOS 11 documentation on [Network address formats and protocols on Mac](https://support.apple.com/guide/mac-help/network-address-formats-and-protocols-on-mac-mchlp1654/11.0/mac/11.0) just says:
  > From the Finder, you can connect to FTP servers only with read-only access. To copy files to an FTP server, use an FTP app.
 - So the documentation is correct. Promises nothing about FTPS nor mentions it anyhow.
 - But Finder accepts FTPS input and transforms it to FTP without any warning!

## Proposals
1. Finder warns "You requested a secure connection (FTPS), but Finder supports only unencrypted FTP!"
[ Cancel ] [Use unsafe FTP]
2. The documentation explicitly mentions that FTPS (FTP in a SSL/TLS tunnel) and SFTP (FTP in a SSH) tunnel are not supported by Finder, and that you need 3rd party software for this.

Comments

Added this as a Q & A (with screenshots) at to warn other users too

Beware: macOS Finder “Connect to Server” accepts FTPS URLs (FTP in a SSL/TLS tunnel) but actually connects via plain FTP! https://apple.stackexchange.com/questions/423367

By p.org at June 30, 2021, 7:34 p.m. (reply...)

Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!