4 ms·
You’re joking right? It’s “allow ssh as root with a publicly available ssh key”. Your version is making it sound mundane.
by RL_Quine 7y ago
You’re joking right?
It’s “allow ssh as root with a publicly available ssh key”. Your version is making it sound mundane.
- tptacek 7y agoIf mundanity is your concern, add an exclamation point to it.
- RL_Quine 7y agoAccuracy helps.
- fungi 7y agoIf it was a genuine "backdoor" why would you want use a publicly available key?
- anxman 7y agoThis isn't a backdoor but it is a major vulnerability.
- MaulingMonkey 7y agoBeing the only keyholder reduces plausable deniability, so maybe.
- RL_Quine 7y agoThe private key is on the shipped devices, from my reading.
- MaulingMonkey 7y agoAgreed. I'm hypothesizing that you might do this, even with keys intended to be used as a back door, by shipping it on devices, you vastly increase the number of potential suspects for any backdoor abuse. Continuing this train of thought - a hardcoded password is classic example of a backdoor, and just as "public" as including a private key.
- tedunangst 7y agoSad state of affairs when terrible, ugly vulnerabilities are mundane.