--- title: SCP Overview: Familiar, Simple, Insecure and Slow description: SCP, the familiar file-transfer feature built into SSH, is explained in depth: it is not a standardized protocol but an undocumented mashup of the old RCP... canonical: https://daily.dev/posts/scp-overview-familiar-simple-insecure-and-slow-srxiqgvys twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SCP Overview: Familiar, Simple, Insecure and Slow | daily.dev og:description: SCP, the familiar file-transfer feature built into SSH, is explained in depth: it is not a standardized protocol but an undocumented mashup of the old RCP... og:url: https://daily.dev/posts/scp-overview-familiar-simple-insecure-and-slow-srxiqgvys og:image: https://api.daily.dev/og/posts/srxIQGVYS.png og:image:alt: SCP Overview: Familiar, Simple, Insecure and Slow og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SCP Overview: Familiar, Simple, Insecure and Slow **[Teleport](https://daily.dev/sources/teleport)** · 9 min read · 0 upvotes · 0 comments ## Summary SCP, the familiar file-transfer feature built into SSH, is explained in depth: it is not a standardized protocol but an undocumented mashup of the old RCP protocol tunneled through SSH. Its sequential, synchronous wire protocol makes it slow (a benchmark shows tar-over-ssh 4x faster for 10,000 small files), and OpenSSH's own 8.0 release notes call the scp protocol outdated and recommend SFTP or rsync instead. Known vulnerabilities discovered in 2018 by Harry Sintonen allowed permission changes, arbitrary file overwrites, and terminal escape sequence injection in various SCP clients. Alternatives discussed include SFTP, rsync, Magic Wormhole, Syncthing, and Perkeep, each with different tradeoffs around performance, usability, and use case. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does OpenSSH recommend against using scp for file transfers? OpenSSH's 8.0 release notes state that the scp protocol is outdated, inflexible, and not readily fixable, recommending sftp or rsync instead. This is because scp is based on the old RCP protocol tunneled through SSH, lacks a formal specification, and has had multiple security vulnerabilities, including arbitrary file overwrites and terminal escape sequence injection discovered in 2018. _Developers migrating file-transfer scripts off scp can track protocol changes like this on daily.dev._ ### Is scp or tar over ssh faster for copying many small files? Tar over ssh is significantly faster than scp for transferring large numbers of small files. In a benchmark copying 10,000 files, scp -r took 882.99ms while piping tar through ssh took only 215.68ms, roughly a 4x speedup, because scp's sequential protocol requires an acknowledgement for every single file. _Anyone benchmarking file-transfer tools can follow performance comparisons like this on daily.dev._ ### What security vulnerabilities have been found in scp client implementations? In 2018, researcher Harry Sintonen disclosed multiple vulnerabilities in popular SCP client implementations, including OpenSSH's. These included the ability to modify permissions on directories, overwrite arbitrary files (enabling code execution via files like ~/.ssh/authorized_keys or ~/.bashrc), and inject terminal escape sequences to hide malicious activity from the user. _Teams auditing legacy file-transfer tooling can keep up with disclosures like this on daily.dev._ ## Similar posts on daily.dev - [SCP for Data Exfiltration on Pentests](https://daily.dev/posts/scp-for-data-exfiltration-on-pentests-fzpfx5zlw) · InfoSec Write-ups · 0 upvotes · 0 comments - [tar: a slop-free alternative to rsync](https://daily.dev/posts/tar-a-slop-free-alternative-to-rsync-ozhfv7ncb) · Drew DeVault · 0 upvotes · 0 comments - [Linux Fu: Improving FTP](https://daily.dev/posts/linux-fu-improving-ftp-zanumd21y) · Hackaday · 0 upvotes · 0 comments - [OpenSSH 10.6 released](https://daily.dev/posts/openssh-10-6-released-nov2ongvv) · LWN.net · 0 upvotes · 0 comments - [The one rsync mistake that could destroy your backups](https://daily.dev/posts/the-one-rsync-mistake-that-could-destroy-your-backups-s6biwkbt9) · All Things Open · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/scp-overview-familiar-simple-insecure-and-slow-srxiqgvys) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SCP Overview: Familiar, Simple, Insecure and Slow","url":"https://daily.dev/posts/scp-overview-familiar-simple-insecure-and-slow-srxiqgvys","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/scp-overview-familiar-simple-insecure-and-slow-srxiqgvys"},"datePublished":"2026-08-23T12:23:09.514Z","dateModified":"2026-08-23T12:50:15.726Z","description":"SCP, the familiar file-transfer feature built into SSH, is explained in depth: it is not a standardized protocol but an undocumented mashup of the old RCP...","image":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","thumbnailUrl":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/scp-overview-familiar-simple-insecure-and-slow-srxiqgvys","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ssh","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"SCP Overview: Familiar, Simple, Insecure and Slow"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/scp-overview-familiar-simple-insecure-and-slow-srxiqgvys#faq","mainEntity":[{"@type":"Question","name":"Why does OpenSSH recommend against using scp for file transfers?","acceptedAnswer":{"@type":"Answer","text":"OpenSSH's 8.0 release notes state that the scp protocol is outdated, inflexible, and not readily fixable, recommending sftp or rsync instead. This is because scp is based on the old RCP protocol tunneled through SSH, lacks a formal specification, and has had multiple security vulnerabilities, including arbitrary file overwrites and terminal escape sequence injection discovered in 2018. Developers migrating file-transfer scripts off scp can track protocol changes like this on daily.dev."}},{"@type":"Question","name":"Is scp or tar over ssh faster for copying many small files?","acceptedAnswer":{"@type":"Answer","text":"Tar over ssh is significantly faster than scp for transferring large numbers of small files. In a benchmark copying 10,000 files, scp -r took 882.99ms while piping tar through ssh took only 215.68ms, roughly a 4x speedup, because scp's sequential protocol requires an acknowledgement for every single file. Anyone benchmarking file-transfer tools can follow performance comparisons like this on daily.dev."}},{"@type":"Question","name":"What security vulnerabilities have been found in scp client implementations?","acceptedAnswer":{"@type":"Answer","text":"In 2018, researcher Harry Sintonen disclosed multiple vulnerabilities in popular SCP client implementations, including OpenSSH's. These included the ability to modify permissions on directories, overwrite arbitrary files (enabling code execution via files like ~/.ssh/authorized_keys or ~/.bashrc), and inject terminal escape sequences to hide malicious activity from the user. Teams auditing legacy file-transfer tooling can keep up with disclosures like this on daily.dev."}}]} ```