5 ms·

I s there any difference between a test/development backdoor and a FBI backdoor?. If you let backdoors in the system, of course the secret services will demand

by pipio21 10y ago

I s there any difference between a test/development backdoor and a FBI backdoor?. If you let backdoors in the system, of course the secret services will demand to have it. In fact, backdoors that were put in place because secret services' pressure, will be suited as developer backdoors as an excuse when found by the mainstream. First they install backdoors in systems, in order for MS or the US gobertment to have complete access to any computer in the world, then they worry when the Chinese and Russians find them.

bradford 10y ago
I think you're missing my point (and my poor wording probably didn't help). A backdoor that requires physical access isn't a backdoor. If an attacker has such access, you're already screwed. A backdoor that requires administrative privileges isn't a backdoor. If an attacker has such access, you're already screwed. The so-called dev/test 'backdoor' really isn't a backdoor. It's a 'unlock' tool that's required for anyone who's going to engineer the device. My main beef is that this article appears to be re-branding the engineering unlock as a backdoor, and confusion is obviously ensuing. Again, In my original post, I asked "What's the exploit"? and I understand that the existence of an exploit might not be the article's subject, but If you really think that there's a security problem here, I'll ask it again: "What's the exploit?"
- Nullabillity 10y ago
  > A backdoor that requires physical access isn't a backdoor. If an attacker has such access, you're already screwed. > A backdoor that requires administrative privileges isn't a backdoor. If an attacker has such access, you're already screwed. Then why bother trying to lock it down in the first place?
  - cptskippy 10y ago
    Service providers that wish to provide subsidized devices as part of service contracts usually require that said devices can't be repurposed for the duration of the service contracts. Thus a means is needed to lock a device.
- mindslight 10y ago
  > A backdoor that requires physical access isn't a backdoor. If an attacker has such access, you're already screwed. The security model of "secure boot" is designed to mitigate physical access, so a private way of circumventing that property is a backdoor. While breaking this one aspect leaves other useful security properties intact, if those properties had been the only goal, they could have been implemented with a simpler and more user-friendly system.
- SideburnsOfDoom 10y ago
  > A backdoor that requires physical access isn't a backdoor. If an attacker has such access, you're already screwed so why did the original "load an unsigned debug build" functionality require cryptography rather than just, say, holding down the volume button during boot? Because it's not nearly as simple as "I have the hardware, I can do anything".
- deleted 10y ago
  [deleted]
- swerr 10y ago
  It's like saying the admin/root account is a backdoor because it allows you to do anything to the system.
  - _pmf_ 10y ago
    > It's like saying the admin/root account is a backdoor because it allows you to do anything to the system. It's more like saying having a admin/root account and a post-it with a password hint is a backdoor (which is also wrong, of course).
- dredmorbius 10y ago
  The term "backdoor" derives from the very notion of a door. In the back whatever it is you're trying to secure. I'm finding your line of argument across multiple comments increasingly disingenuous. You're hurting your argument far more than you're helping.
  - bradford 10y ago
    With all due respect, What argument do you think I'm trying to make? I ask this because I'm still rather unclear about the argument that the original article is trying to make. I'm even more confused about what conclusions slipstream would have us draw from his web-post. Some comments here say that it's not an exploit, that instead its a lesson about why you shouldn't, as a matter of policy, include backdoors. Others say that it is a backdoor/security hole, and are appropriately up in arms over it. The only thing I'm confessing is confusion. I understand that you think I'm being disingenuous, and the nice thing is that we really don't need to continue this conversation. If it is as bad as some are suggesting, than wouldn't an exploit be out in the near future? I'd expect such an exploit, or even evidence of a backdoor, to make further news, and if I see it then I'll obviously have my answer.
    - alainv 10y ago
      I'll bite. The original article is from the Register. If you work at Microsoft and read HN I'd expect you have a reasonable idea of their average article quality. I don't think they were trying to make any particular point rather than generate pageviews with a combination of "haha M$" and righteous anti-backdoor anger. That said, I myself agree with other commenters that your stance "this isn't a backdoor because it requires physical access; if you've given up physical access you're already screwed" is beyond disingenuous. Disregarding a login screen bypass by the same logic would be rightly pilloried. Yes, physical security is the hardest to improve, but that's exactly the carrot Microsoft has used to try and convince the world Secure Boot isn't a pure anti-consumer move.
      - 13of40 10y ago
        The "backdoor" isn't the package that got leaked, it's the private key that signed the package. Without the key, the deployed packages wouldn't be serviceable in case a real exploit was found. Without a serviceability plan, they couldn't have released Secure Boot. So the question isn't whether there was a back door - there had to be a back door - it's whether Secure Boot is a legitimate thing to have.
- PhasmaFelis 10y ago
  Installing an OS when Microsoft doesn't want you to is the exploit. The legitimate user is the "attacker," Microsoft (or their policy) is the "target." (I'm not sure if that's what the Register was trying to say, because they're kind of screechy and incoherent at the best of times, but that's how I personally read it.)

by pipio21 10y ago

bradford 10y ago

I think you're missing my point (and my poor wording probably didn't help). A backdoor that requires physical access isn't a backdoor. If an attacker has such access, you're already screwed. A backdoor that requires administrative privileges isn't a backdoor. If an attacker has such access, you're already screwed. The so-called dev/test 'backdoor' really isn't a backdoor. It's a 'unlock' tool that's required for anyone who's going to engineer the device. My main beef is that this article appears to be re-branding the engineering unlock as a backdoor, and confusion is obviously ensuing. Again, In my original post, I asked "What's the exploit"? and I understand that the existence of an exploit might not be the article's subject, but If you really think that there's a security problem here, I'll ask it again: "What's the exploit?"

Nullabillity 10y ago
> A backdoor that requires physical access isn't a backdoor. If an attacker has such access, you're already screwed. > A backdoor that requires administrative privileges isn't a backdoor. If an attacker has such access, you're already screwed. Then why bother trying to lock it down in the first place?
- cptskippy 10y ago
  Service providers that wish to provide subsidized devices as part of service contracts usually require that said devices can't be repurposed for the duration of the service contracts. Thus a means is needed to lock a device.
mindslight 10y ago
> A backdoor that requires physical access isn't a backdoor. If an attacker has such access, you're already screwed. The security model of "secure boot" is designed to mitigate physical access, so a private way of circumventing that property is a backdoor. While breaking this one aspect leaves other useful security properties intact, if those properties had been the only goal, they could have been implemented with a simpler and more user-friendly system.
SideburnsOfDoom 10y ago
> A backdoor that requires physical access isn't a backdoor. If an attacker has such access, you're already screwed so why did the original "load an unsigned debug build" functionality require cryptography rather than just, say, holding down the volume button during boot? Because it's not nearly as simple as "I have the hardware, I can do anything".
deleted 10y ago
[deleted]
swerr 10y ago
It's like saying the admin/root account is a backdoor because it allows you to do anything to the system.
- _pmf_ 10y ago
  > It's like saying the admin/root account is a backdoor because it allows you to do anything to the system. It's more like saying having a admin/root account and a post-it with a password hint is a backdoor (which is also wrong, of course).
dredmorbius 10y ago
The term "backdoor" derives from the very notion of a door. In the back whatever it is you're trying to secure. I'm finding your line of argument across multiple comments increasingly disingenuous. You're hurting your argument far more than you're helping.
- bradford 10y ago
  With all due respect, What argument do you think I'm trying to make? I ask this because I'm still rather unclear about the argument that the original article is trying to make. I'm even more confused about what conclusions slipstream would have us draw from his web-post. Some comments here say that it's not an exploit, that instead its a lesson about why you shouldn't, as a matter of policy, include backdoors. Others say that it is a backdoor/security hole, and are appropriately up in arms over it. The only thing I'm confessing is confusion. I understand that you think I'm being disingenuous, and the nice thing is that we really don't need to continue this conversation. If it is as bad as some are suggesting, than wouldn't an exploit be out in the near future? I'd expect such an exploit, or even evidence of a backdoor, to make further news, and if I see it then I'll obviously have my answer.
  - alainv 10y ago
    I'll bite. The original article is from the Register. If you work at Microsoft and read HN I'd expect you have a reasonable idea of their average article quality. I don't think they were trying to make any particular point rather than generate pageviews with a combination of "haha M$" and righteous anti-backdoor anger. That said, I myself agree with other commenters that your stance "this isn't a backdoor because it requires physical access; if you've given up physical access you're already screwed" is beyond disingenuous. Disregarding a login screen bypass by the same logic would be rightly pilloried. Yes, physical security is the hardest to improve, but that's exactly the carrot Microsoft has used to try and convince the world Secure Boot isn't a pure anti-consumer move.
    - 13of40 10y ago
      The "backdoor" isn't the package that got leaked, it's the private key that signed the package. Without the key, the deployed packages wouldn't be serviceable in case a real exploit was found. Without a serviceability plan, they couldn't have released Secure Boot. So the question isn't whether there was a back door - there had to be a back door - it's whether Secure Boot is a legitimate thing to have.
PhasmaFelis 10y ago
Installing an OS when Microsoft doesn't want you to is the exploit. The legitimate user is the "attacker," Microsoft (or their policy) is the "target." (I'm not sure if that's what the Register was trying to say, because they're kind of screechy and incoherent at the best of times, but that's how I personally read it.)