Передача файлов sftp безопасный?

From the wikipedia article: SSH File Transfer Protocol

The protocol itself does not provide authentication and security; it expects the underlying protocol to secure this. SFTP is most often used as subsystem of SSH protocol version 2 implementations, having been designed by the same working group. However, it is possible to run it over SSH-1 (and some implementations support this) or other data streams. Running SFTP server over SSH-1 is not platform independent as SSH-1 does not support the concept of subsystems. An SFTP client willing to connect to an SSH-1 server needs to know the path to the SFTP server binary on the server side.

so it really depends on the way you set this up.

Read the whole article if you are interested.

As Davide Piras pointed out SFTP or more precisely the underlying SSH protocol can be quite secure.

But if I understood you correctly you want to use some kind of web-based SFTP client. That means that you also have to secure the connection between your client and the web-site you're using to transfer the file.

Rather than trying to get transport security right (which you should do none the less) you should encrypt the data itself (e. g. with PGP or GnuPG), transfer that encrypted file and finally decrypt it on the target system.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.IO;
using System.Security.Cryptography;

namespace Encryption
{
    class Program
    {
        static void Main(string[] args)
        {
            EncryptFile(@"C:\a.txt", @"C:\b.txt","password");
            DecryptFile(@"C:\b.txt", @"C:\decrypted.txt",@"password");
        }
        public static void EncryptFile(string inputFile, string outputFile,string password)
        {

            try
            {

                UnicodeEncoding UE = new UnicodeEncoding();
                byte[] key = UE.GetBytes(password);

                string cryptFile = outputFile;
                FileStream fsCrypt = new FileStream(cryptFile, FileMode.Create);

                RijndaelManaged RMCrypto = new RijndaelManaged();

                CryptoStream cs = new CryptoStream(fsCrypt,
                    RMCrypto.CreateEncryptor(key, key),
                    CryptoStreamMode.Write);

                FileStream fsIn = new FileStream(inputFile, FileMode.Open);

                int data;
                while ((data = fsIn.ReadByte()) != -1)
                { 
                    cs.WriteByte((byte)data); 
                }


                fsIn.Close();
                cs.Close();
                fsCrypt.Close();
            }
            catch(Exception e)
            {
                Console.WriteLine(e);
            }
        }

        public static void DecryptFile(string inputFile, string outputFile,string password)
        {

            {


                UnicodeEncoding UE = new UnicodeEncoding();
                byte[] key = UE.GetBytes(password);

                FileStream fsCrypt = new FileStream(inputFile, FileMode.Open);

                RijndaelManaged RMCrypto = new RijndaelManaged();

                CryptoStream cs = new CryptoStream(fsCrypt,
                    RMCrypto.CreateDecryptor(key, key),
                    CryptoStreamMode.Read);

                FileStream fsOut = new FileStream(outputFile, FileMode.Create);

                int data;
                while ((data = cs.ReadByte()) != -1)
                    fsOut.WriteByte((byte)data);

                fsOut.Close();
                cs.Close();
                fsCrypt.Close();

            }
        }

    }
}

Хотя SSL и TLS различаются по способам, которые делают их несовместимыми друг с другом, они обычно считаются равными с точки зрения безопасности. Основное отличие состоит в том, что в то время как SSL-соединения начинаются с защиты и переходят непосредственно к защищенной связи, соединения TLS сначала начинаются с небезопасного «приветствия» серверу и переключаются на защищенную связь только после успешного установления связи между клиентом и сервером. Если рукопожатие TLS не удается по какой-либо причине, соединение никогда не создается.

Если вы используете Windows (как я), в этом случае вместо сервера FTPS (такого как FileZilla) вам, вероятно, просто нужен SFTP совместимый, без TLS, сервер (который основан на SSH), такой как NULL FTP Server или то, что я использую: WinSSHD с клиентом Tunnelier .

In day-to-day work, I'd be comfortable transferring unencrypted data via SFTP. The transport protects it.

With FTP, regardless of whether the data is encrypted or not, you just shouldn't use it. FTP doesn't encrypt the authentication details. The username and password is transmitted in plaintext, and you end up compromising your account info.