3 ms·

Wow that nation state is stupid. They embedded the backdoor password right into it. Clearly they should have embedded the hash of the password instead. Then it

by Buge 11y ago

Wow that nation state is stupid. They embedded the backdoor password right into it. Clearly they should have embedded the hash of the password instead. Then it would be unbreakable and no other party would be able to use the backdoor. Hashing passwords is extremely basic security practice.

omni 11y ago
When you're trying to do something secretly, you run into a new tradeoff: doing it the right way vs. doing it in such a way that it doesn't draw attention to itself. It might have been the case that hashing it would have been too flashy.
- relkor 11y ago
  I would imagine it would hook into the existing code that is hashing the passwords... Which suggests that they are not in fact hashing the user inputs and are relying on the client to do that for them.
coldtea 11y ago
>They embedded the backdoor password right into it Or you know, that's just one obvious backdoor they put in, to divert from the other 2-3 non-obvious they have.
- Buge 11y ago
  But one thing the NSA likes to say is that the backdoors they insert are only accessible to them, not to others. For example the DUAL_EC backdoor could only be exploited by the NSA. With this backdoor, now China and everyday criminals can also use it. I see the benefit of inserting multiple backdoors. But none of them should be vulnerable to rival nations.
  - coldtea 11y ago
    >But one thing the NSA likes to say is that the backdoors they insert are only accessible to them, not to others. Which is an empty statement when it comes to security principles. If you've placed a backdoor (and some are blatantly obvious if you look for it, like some SSL issues), then others can use it too. Most backdoors are not of the "we have an encrypted password only we know" variety, but of the purposeful hole to exploit. >I see the benefit of inserting multiple backdoors. But none of them should be vulnerable to rival nations. Except if the idea is to monitor the local population, and you do not care that much if others monitor them too.
- hueving 11y ago
  That's not a good idea if you're hiding a backdoor. The last thing you want is for people to have a reason to audit the code base.

by Buge 11y ago

omni 11y ago

When you're trying to do something secretly, you run into a new tradeoff: doing it the right way vs. doing it in such a way that it doesn't draw attention to itself. It might have been the case that hashing it would have been too flashy.

relkor 11y ago
I would imagine it would hook into the existing code that is hashing the passwords... Which suggests that they are not in fact hashing the user inputs and are relying on the client to do that for them.

coldtea 11y ago

>They embedded the backdoor password right into it Or you know, that's just one obvious backdoor they put in, to divert from the other 2-3 non-obvious they have.

Buge 11y ago
But one thing the NSA likes to say is that the backdoors they insert are only accessible to them, not to others. For example the DUAL_EC backdoor could only be exploited by the NSA. With this backdoor, now China and everyday criminals can also use it. I see the benefit of inserting multiple backdoors. But none of them should be vulnerable to rival nations.
- coldtea 11y ago
  >But one thing the NSA likes to say is that the backdoors they insert are only accessible to them, not to others. Which is an empty statement when it comes to security principles. If you've placed a backdoor (and some are blatantly obvious if you look for it, like some SSL issues), then others can use it too. Most backdoors are not of the "we have an encrypted password only we know" variety, but of the purposeful hole to exploit. >I see the benefit of inserting multiple backdoors. But none of them should be vulnerable to rival nations. Except if the idea is to monitor the local population, and you do not care that much if others monitor them too.
hueving 11y ago
That's not a good idea if you're hiding a backdoor. The last thing you want is for people to have a reason to audit the code base.