11 ms·

It allows anyone who knows the default SSH key pair to login as root. How is that not a backdoor? Backdoor definition: "A backdoor is a method, often secret, o

It allows anyone who knows the default SSH key pair to login as root. How is that not a backdoor? Backdoor definition: "A backdoor is a method, often secret, of bypassing normal authentication in a computer system."

TallGuyShort 7y ago
People sometimes read "backdoor" as something intentionally left by an insider for later use by themselves or others.
- microwavecamera 7y ago
  Well Cisco wrote the code so it has to be in some way intentional but it doesn't necessarily mean it was done maliciously though. It could a private developer key used for testing accidentally got pushed out in production code or some poorly thought out management "feature". Regardless it is an epically dumb mistake for a company like Cisco to make on an enterprise product.
  - dngray 7y ago
    > Well Cisco wrote the code so it has to be in some way intentional but it doesn't necessarily mean it was done maliciously though. It could a private developer key used for testing accidentally got pushed out in production code or some poorly thought out management "feature". Regardless it is an epically dumb mistake for a company like Cisco to make on an enterprise product. That someone might not be the company, it might be a developer. It's entirely true that the company says it's not a backdoor, the developer says it's a mistake, but he/she was approached from an external organization. Unless you can provide either way it's impossible to classify it as a backdoor or not.
- mtgx 7y ago
  And what do you think this was? Virtually all router/networking devices have some kind of "hardcoded account" (read:backdoor) and this is only slowly changing. I believe the EU is going to ban the practice soon.
- dngray 7y ago
  > People sometimes read "backdoor" as something intentionally left by an insider for later use by themselves or others. And considering you can never know if someone else knows about it, that means you can never know if it was a backdoor.

TallGuyShort 7y ago

People sometimes read "backdoor" as something intentionally left by an insider for later use by themselves or others.

microwavecamera 7y ago
Well Cisco wrote the code so it has to be in some way intentional but it doesn't necessarily mean it was done maliciously though. It could a private developer key used for testing accidentally got pushed out in production code or some poorly thought out management "feature". Regardless it is an epically dumb mistake for a company like Cisco to make on an enterprise product.
- dngray 7y ago
  > Well Cisco wrote the code so it has to be in some way intentional but it doesn't necessarily mean it was done maliciously though. It could a private developer key used for testing accidentally got pushed out in production code or some poorly thought out management "feature". Regardless it is an epically dumb mistake for a company like Cisco to make on an enterprise product. That someone might not be the company, it might be a developer. It's entirely true that the company says it's not a backdoor, the developer says it's a mistake, but he/she was approached from an external organization. Unless you can provide either way it's impossible to classify it as a backdoor or not.
mtgx 7y ago
And what do you think this was? Virtually all router/networking devices have some kind of "hardcoded account" (read:backdoor) and this is only slowly changing. I believe the EU is going to ban the practice soon.
dngray 7y ago
> People sometimes read "backdoor" as something intentionally left by an insider for later use by themselves or others. And considering you can never know if someone else knows about it, that means you can never know if it was a backdoor.