21 ms·
They're not exactly insecure, they're just used for different things, like networks that are already secure. You can secure existing networks pretty well agains
by peterwwillis 9y ago
They're not exactly insecure, they're just used for different things, like networks that are already secure. You can secure existing networks pretty well against things like MitM, and then it doesn't matter if you use rsh or ssh. (part of why so many routers still use telnet is it's supposed to only be enabled on management interfaces)
Quite a few years ago I helped build the public terminal cluster for HOPE. That year we used a token ring network for all of the hosts. Nobody anywhere near the conference had any token ring gear whatsoever. It was impossible to break into the network, so you had to use existing nodes. And the nodes' adapters had their promiscuous modes disabled in hardware. That plus a hardened terminal server and an extremely limited thin client meant nobody could successfully hack the network. You could have used telnet all day and been totally secure.
Though in conference environments, the network is not the biggest risk for targeted attacks. Carefully watching your target enter their password is simpler and more effective.
- gbrown_ 9y ago> They're not exactly insecure, they're just used for different things, like networks that are already secure. There is no such thing. I'd be pedantic and rephrase this to - used for networks which you trust.
- peterwwillis 9y agoI think the engineers setting up red/black networks for the military might disagree with you, but even in the enterprise 802.1X can result in a secure local network. I would say trust is a result of the operation of the network, as you may need to do something to establish it. And in this vein you're right, "networks you already trust" definitely would have been better wording.
- richardwhiuk 9y agoNo. You can't use rlogin on a 802.1X network or a red/black network. Passwords are transmitted in plain text, which means any other terminal on the network can sniff the password.
- peterwwillis 9y agoRed networks are intended for classified plaintext, by definition...
- richardwhiuk 9y agoPasswords aren't classified plain text, they are authentication details and should be handled differently.