3 ms·
You're assuming the attackers care if the backdoor is used by others. If a hash would increase the chances of it being found and you don't care if other attacke
by brazzledazzle 11y ago
You're assuming the attackers care if the backdoor is used by others. If a hash would increase the chances of it being found and you don't care if other attackers discover it, only if the vendor does then it's the right choice.
- ghshephard 11y agoI absolutely assume that if the backdoor was placed by a vendor, they would make sure it was a one-way function. I (perhaps incorrectly) assumed that criminals would want to stick in a hash function, given a choice. I think the explanation, that adding a hash function will attract more attention than a simple strcmp is a good one. As is the desire to stick in something that gets by code review. All signs point to this 100% not being Juniper engineering officially adding a back door, and it being a party doing it without authorization.