Support

Yes, the passwords are stored in plain text inside Remote Control's SQLite database. However, if your PC is compromised you can safely assume that ALL your passwords must change. Remote Control supports plain FTP and FTPS (FTP over implicit SSL). Lack of SFTP support is due to restrictions in the networking library used. There is a major rewrite planned, but it will take a long while to be production quality. Another feature planned for 3.1 is adding encryption support for JPA archives, which would further enhance the security of your backup archives, both in transit and when stored anywhere.

I share the same security concerns with you. The reason Remote Control's database is not encrypted is that it is supposed to run unattended, i.e. not wait for your input on launching a backup. So, it all comes down to how secure your PC really is.

The first option is having a dedicated system behind a firewall, with a solid antivirus system and where you do not install anything but updates (and visit no sites). Or use Linux. It is extremely hard to attack Linux systems unless you are a real hacker - and the vast majority of attacks is performed by bots, not humans.

If you are even more paranoid than this, you should consider using Akeeba Backup Professional. You can set it up so that it sends its backup files to Amazon's S3 or DropBox upon completion. This is the safest backup storage method, as the backup file is removed from the server as soon as the backup is complete and no credentials are transferred between your site and your PC.

Regarding the importance of removing backup files from your site, I'd say it's of PARAMOUNT importance. Do you leave your door key under the door mat? If you do, you run the risk of someone picking up the mat, taking the key and entering your house. The same thing goes with a backup file. It contains the keys to your site. If one of your installed components suffers a directory traversal vulnerability, a malicious hacker could in theory exploit this to grab your backup file (or just its first few kilobytes) and extract the database connection information. From that point, it's a hacker's joyride cracking your site. That's why I preach that the safest backup is the one which is stored on three different media BUT NOT on your site. My backups are usually stored on cloud storage, an external hard disk and a flash disk. I never leave them on the server.

You're welcome :) I think all of us computer people share the same paranoia. And as Dale put it the other day, this paranoia has served us well over all those years!