S/Keyｪ is a challenge-response one-time password system developed by Bellcore (S/Key is a trademark of Bellcore). Servers running the S/Key software respond to the USER command with special challenge information that is used only once. The FTP client must respond with a password based on the userﾕs secret password and the challenge information. Since the challenge information is never re-used, the password that the client sends back changes with each session. That makes it impossible for a wiretapper to collect a password that could then be used to access the account.
Fetch offers automatic support for the S/Key system. If Fetch detects the S/Key challenge it transparently computes the one-time password, based on the secret password entered by the user. This is more convenient than using a separate program to perform the calculation. However, because the process is automatic it carries a subtle security risk. If the server for some reason does not issue the S/Key challenge, Fetch will send the secret password over the network without any warning. So users should only rely on this feature to keep their passwords secret if they are sure that they are connecting to a server that is running S/Key.
Fetch now also supports the One Time Password (OTP) system, which supercedes S/Key. See the One-Time Password topic.
