3 ms·

Ok, I get it. The message is "don't use backdoors, because they'll inevitably get leaked", which I agree with. Unfortunately, I don't think that's the message

Ok, I get it. The message is "don't use backdoors, because they'll inevitably get leaked", which I agree with. Unfortunately, I don't think that's the message that's being interpreted by the vast majority of readers. I'm delving into opinion territory now, but when the word 'backdoor' is used, aren't most people going to assume that it's an FBI backdoor, instead of a test/development backdoor? This seems like the kind of article that fans the fuels of conspiracy theorists, and no one seems to be doing anything to correct the record.

pipio21 10y ago
I s there any difference between a test/development backdoor and a FBI backdoor?. If you let backdoors in the system, of course the secret services will demand to have it. In fact, backdoors that were put in place because secret services' pressure, will be suited as developer backdoors as an excuse when found by the mainstream. First they install backdoors in systems, in order for MS or the US gobertment to have complete access to any computer in the world, then they worry when the Chinese and Russians find them.
- bradford 10y ago
  I think you're missing my point (and my poor wording probably didn't help). A backdoor that requires physical access isn't a backdoor. If an attacker has such access, you're already screwed. A backdoor that requires administrative privileges isn't a backdoor. If an attacker has such access, you're already screwed. The so-called dev/test 'backdoor' really isn't a backdoor. It's a 'unlock' tool that's required for anyone who's going to engineer the device. My main beef is that this article appears to be re-branding the engineering unlock as a backdoor, and confusion is obviously ensuing. Again, In my original post, I asked "What's the exploit"? and I understand that the existence of an exploit might not be the article's subject, but If you really think that there's a security problem here, I'll ask it again: "What's the exploit?"
  - Nullabillity 10y ago
    > A backdoor that requires physical access isn't a backdoor. If an attacker has such access, you're already screwed. > A backdoor that requires administrative privileges isn't a backdoor. If an attacker has such access, you're already screwed. Then why bother trying to lock it down in the first place?
    - cptskippy 10y ago
      Service providers that wish to provide subsidized devices as part of service contracts usually require that said devices can't be repurposed for the duration of the service contracts. Thus a means is needed to lock a device.
  - mindslight 10y ago
    > A backdoor that requires physical access isn't a backdoor. If an attacker has such access, you're already screwed. The security model of "secure boot" is designed to mitigate physical access, so a private way of circumventing that property is a backdoor. While breaking this one aspect leaves other useful security properties intact, if those properties had been the only goal, they could have been implemented with a simpler and more user-friendly system.
  - SideburnsOfDoom 10y ago
    > A backdoor that requires physical access isn't a backdoor. If an attacker has such access, you're already screwed so why did the original "load an unsigned debug build" functionality require cryptography rather than just, say, holding down the volume button during boot? Because it's not nearly as simple as "I have the hardware, I can do anything".
  - deleted 10y ago
    [deleted]
  - swerr 10y ago
    It's like saying the admin/root account is a backdoor because it allows you to do anything to the system.
mtgx 10y ago
A backdoor is a backdoor = unauthorized access to a user's device. What does it matter if it's Microsoft, FBI, or the Chinese government using it? By definition, it can't be "just Microsoft" anyway, as the people who discovered this pointed out, whether it's up to Microsoft or not. > and no one seems to be doing anything to correct the record. Maybe Microsoft feels guilty about it? It reminds me of when a journalist asked them about Bitlocker being backdoored, and they refused to comment. https://www.schneier.com/blog/archives/2015/03/can_the_nsa_bre_1.html https://www.schneier.com/blog/archives/2015/03/can_the_nsa_b...
- l3m0ndr0p 10y ago
  The US government is enforcing implied consent on all citizens by forcing corporations to have these "backdoors" in place. I can see now why there are many of these backdoors or issues with the MS Windows. I think these issues exist to provide that backdoor opportunity for our government. No government will respect your privacy and will always claim ownership over everything you do. It's a corrupt system and it needs to end. Peacefully.

pipio21 10y ago

I s there any difference between a test/development backdoor and a FBI backdoor?. If you let backdoors in the system, of course the secret services will demand to have it. In fact, backdoors that were put in place because secret services' pressure, will be suited as developer backdoors as an excuse when found by the mainstream. First they install backdoors in systems, in order for MS or the US gobertment to have complete access to any computer in the world, then they worry when the Chinese and Russians find them.

bradford 10y ago
I think you're missing my point (and my poor wording probably didn't help). A backdoor that requires physical access isn't a backdoor. If an attacker has such access, you're already screwed. A backdoor that requires administrative privileges isn't a backdoor. If an attacker has such access, you're already screwed. The so-called dev/test 'backdoor' really isn't a backdoor. It's a 'unlock' tool that's required for anyone who's going to engineer the device. My main beef is that this article appears to be re-branding the engineering unlock as a backdoor, and confusion is obviously ensuing. Again, In my original post, I asked "What's the exploit"? and I understand that the existence of an exploit might not be the article's subject, but If you really think that there's a security problem here, I'll ask it again: "What's the exploit?"
- Nullabillity 10y ago
  > A backdoor that requires physical access isn't a backdoor. If an attacker has such access, you're already screwed. > A backdoor that requires administrative privileges isn't a backdoor. If an attacker has such access, you're already screwed. Then why bother trying to lock it down in the first place?
  - cptskippy 10y ago
    Service providers that wish to provide subsidized devices as part of service contracts usually require that said devices can't be repurposed for the duration of the service contracts. Thus a means is needed to lock a device.
- mindslight 10y ago
  > A backdoor that requires physical access isn't a backdoor. If an attacker has such access, you're already screwed. The security model of "secure boot" is designed to mitigate physical access, so a private way of circumventing that property is a backdoor. While breaking this one aspect leaves other useful security properties intact, if those properties had been the only goal, they could have been implemented with a simpler and more user-friendly system.
- SideburnsOfDoom 10y ago
  > A backdoor that requires physical access isn't a backdoor. If an attacker has such access, you're already screwed so why did the original "load an unsigned debug build" functionality require cryptography rather than just, say, holding down the volume button during boot? Because it's not nearly as simple as "I have the hardware, I can do anything".
- deleted 10y ago
  [deleted]
- swerr 10y ago
  It's like saying the admin/root account is a backdoor because it allows you to do anything to the system.

mtgx 10y ago

A backdoor is a backdoor = unauthorized access to a user's device. What does it matter if it's Microsoft, FBI, or the Chinese government using it? By definition, it can't be "just Microsoft" anyway, as the people who discovered this pointed out, whether it's up to Microsoft or not. > and no one seems to be doing anything to correct the record. Maybe Microsoft feels guilty about it? It reminds me of when a journalist asked them about Bitlocker being backdoored, and they refused to comment. https://www.schneier.com/blog/archives/2015/03/can_the_nsa_bre_1.html https://www.schneier.com/blog/archives/2015/03/can_the_nsa_b...

l3m0ndr0p 10y ago
The US government is enforcing implied consent on all citizens by forcing corporations to have these "backdoors" in place. I can see now why there are many of these backdoors or issues with the MS Windows. I think these issues exist to provide that backdoor opportunity for our government. No government will respect your privacy and will always claim ownership over everything you do. It's a corrupt system and it needs to end. Peacefully.