5 ms·

Telnet should not be used anymore. Its an old protocol, and not suitable for today especially in the case of security. You can easily migrate to ssh.

indymike 4y ago
One does not use telnet as telnet when doing security work. Telnet + sclient (you can also use tons of other tools, too) lets you inspect many servers that have TLS security. SSH does not.
- worldsavior 4y ago
  There are hacks, sure, but its not telnet. It becomes a "fork" of telnet which enables you to have more functionality. Thats not telnet.
NegativeK 4y ago
Part of security is acknowledging that business needs can't always fit in rigid ideals and coming up with compensating controls.
- acdha 4y ago
  Yes, but that doesn’t mean you just leave telnet running decades after it became obsolete. That should be a time limited waiver and mitigations, and if you have legacy devices which absolutely need Telnet you should be planning for what you’ll do when something that old finally breaks and you have the resources to port relatively simple code.
  - henrydark 4y ago
    This is circular: sure, if telnet is _obsolete_, then remove it. But being obsolete exactly means no one is using it anymore. If someone is using it, then it's not obsolete. Regarding security, some would advocate that telnet, or whatever else, is secure at least as much as the network underlying it. So anyone who puts their "legacy" telnet apps on a VPC is fine, and has decades more to enjoy software that has already been running for decades.
    - acdha 4y ago
      Telnet has been obsolete since the turn of the century. That doesn’t mean that nobody uses it but it does mean that everyone who does should be upgrading away from it. Trusting the network for security was common in the previous century but standards have improved since then. For example, sending your password in clear text is no longer considered acceptable by mainstream security standards since it avoids the risk of passive network monitoring or accidental exposure.
      - aflag 4y ago
        Obsolete means no longer in use or useful. It's been argued in this thread that it's both in use and useful. But yes, there are more secure protocols that overlap with most of what telnet can be used for.
        acdha 4y ago
        Obsolete doesn’t mean something has no possibility of being useful but rather that it’s no longer commonly used because there are better alternatives. My son’s beloved steam locomotives still run but nobody uses them for normal commercial service because they became obsolete shortly after the invention of diesel and electric. > (of words, equipment, etc.) No longer in use; gone into disuse; disused or neglected (often in favour of something newer) https://en.wiktionary.org/wiki/obsolete https://en.wiktionary.org/wiki/obsolete Bringing that full circle, telnet used to be common but it has security issues (lack of encryption or integrity unless you tunnel over TLS, lack of modern authentication options, etc.) and so anywhere it’s still used we should be looking in to replacing it.
        aflag 4y ago
        Telnet is still in use for its primary purpose, which is a bit different than a locomotive which has been neglected to a tourist attraction. Your last paragraph means you would like to make telnet obsolete, but it isn't yet. As evidenced in the thread, it's not partical or desirable to replace it with other technology in all the deployments of it. So, it's still hanging in there for now.
  - indymike 4y ago
    I haven't used a telnet server in forever, but I do use the telnet client to connect and introspect various services from time to time.
    - acdha 4y ago
      I used to do that too but switched to netcat/OpenSSL s_client in the 2010s, especially as TLS everywhere caught on.
bigbillheck 4y ago
Telnet as a way of logging in to a remote system is bad, sure, but telnet as a program for connecting to a server on any port and talking the protocol manually was great, especially before http got so complicated.
- worldsavior 4y ago
  I agree telnet can be used as a "client" for a different protocol, but for other means, its not a good solution.
an-unknown 4y ago
Not sure why everyone thinks that telnet is "not suitable for today especially in the case of security", although telnet over TLS exists. There are also certain things that telnet can do which SSH cannot (e.g. transport data for a block terminal). And everyone who uses "telnet as a program for connecting to a server on any port and talking the protocol manually" forgot that telnet is a real protocol and this type of abuse only works if the telnet client is sufficiently dumb / doesn't negotiate parameters. There is a reason why netcat exists.
- worldsavior 4y ago
  Telnet does not have any standard security, at least by default. No encryption and no authentication among others.
  - an-unknown 4y ago
    This is factually wrong. There are even multiple different authentication and encryption schemes defined for telnet, see e.g.: https://www.iana.org/assignments/telnet-options/telnet-options.xhtml https://www.iana.org/assignments/telnet-options/telnet-optio... Just because some old and rudimentary telnetd or telnet client doesn't implement it doesn't mean it doesn't exist / isn't used.
    - worldsavior 4y ago
      Those are data formats, and a client is needed to support those (on both endpoints). You better just use something modern like ssh instead of hunting for clients (and making sure they're reliable).
qwezxcrty 4y ago
I have a 35k$ worth Xray flat panel detector (still have >5k$ ebay value today), it runs embedded linux on an obsolete samsung ARM processor and uses telnet to talk to the console computer through a point to point ethernet link. Apparently, it's impossible to migrate to ssh and why the ** I need to care about security here?
- worldsavior 4y ago
  Didn't talk about old devices. Security can be very important in cases of connecting to other servers.
  - masklinn 4y ago
    > Didn't talk about old devices. Does not matter, you stated without nuance that telnet should no be used. So you told GP that they should trash their telnet-only devices.
    - worldsavior 4y ago
      No. You understood the phrase incorrectly and assume I mean "bang the head against the wall and don't you telnet". Of course if you have no other choice, go for it. But if you do...
nibbleshifter 4y ago
I mean, obviously we use SSH where possible. But in many cases out in the real world we have to support frankly awful old equipment that only offers telnet (if you are lucky). I don't think we will see the back of such things before 2030 either.
m3047 4y ago
"Telnet... [is] an old protocol..." Ok. Telnet is a protocol, it is not synonymous with TCP. As for unencrypted traffic generally, I see no reason for fetishizing encryption. "Compute" is not synonymous with teh cloudz. Cloud tech is not synonymous with teh cloudz. It's trivial to put e.g. Nginx in front of something. If you need encryption between 127.0.0.1 and 127.0.0.42 you clearly don't trust the hardware you're running on; I'm sure someone's got some clever way of hiding the private keys, but "clever" doesn't mean provably secure. Between containers... meh. Show me you thought about it and have a threat model. Between datacenters... not so much. Do I care whether the connection is encrypted, or whether all traffic goes through a tunnel? I'd like to see a threat model. Is sigint included? Even across the globe I might make an exception for a well-reasoned argument. That would almost certainly have to be data which was an observable: the time, a flow rate. Encryption is not the same as tamper-proof. Even unencrypted data might need defense against that. (Maybe secrecy is easier than nonrepudiability. Maybe.) Secrecy is not identical to privacy. Security is not identical to either of those, and hypervigilance isn't the same as not needing to be concerned with something (these days security can be either of those). Observability might be more important than either secrecy or privacy depending on the application, and who is doing the observing. A lot of it depends on where you demarc your rings of hell and how you defend things. I send data in the clear sometimes and I'm ok with it. I also use a telnet client for decidedly "not telnet protocol" purposes related to diagnostics as well as observability.
- worldsavior 4y ago
  I dont see why a thread model is needed here, encryption is always important, especially in big corps. It seems like you're stating that a normal person doesnt need security.

indymike 4y ago

One does not use telnet as telnet when doing security work. Telnet + sclient (you can also use tons of other tools, too) lets you inspect many servers that have TLS security. SSH does not.

worldsavior 4y ago
There are hacks, sure, but its not telnet. It becomes a "fork" of telnet which enables you to have more functionality. Thats not telnet.

NegativeK 4y ago

Part of security is acknowledging that business needs can't always fit in rigid ideals and coming up with compensating controls.

acdha 4y ago
Yes, but that doesn’t mean you just leave telnet running decades after it became obsolete. That should be a time limited waiver and mitigations, and if you have legacy devices which absolutely need Telnet you should be planning for what you’ll do when something that old finally breaks and you have the resources to port relatively simple code.
- henrydark 4y ago
  This is circular: sure, if telnet is _obsolete_, then remove it. But being obsolete exactly means no one is using it anymore. If someone is using it, then it's not obsolete. Regarding security, some would advocate that telnet, or whatever else, is secure at least as much as the network underlying it. So anyone who puts their "legacy" telnet apps on a VPC is fine, and has decades more to enjoy software that has already been running for decades.
  - acdha 4y ago
    Telnet has been obsolete since the turn of the century. That doesn’t mean that nobody uses it but it does mean that everyone who does should be upgrading away from it. Trusting the network for security was common in the previous century but standards have improved since then. For example, sending your password in clear text is no longer considered acceptable by mainstream security standards since it avoids the risk of passive network monitoring or accidental exposure.
    - aflag 4y ago
      Obsolete means no longer in use or useful. It's been argued in this thread that it's both in use and useful. But yes, there are more secure protocols that overlap with most of what telnet can be used for.
      - acdha 4y ago
        Obsolete doesn’t mean something has no possibility of being useful but rather that it’s no longer commonly used because there are better alternatives. My son’s beloved steam locomotives still run but nobody uses them for normal commercial service because they became obsolete shortly after the invention of diesel and electric. > (of words, equipment, etc.) No longer in use; gone into disuse; disused or neglected (often in favour of something newer) https://en.wiktionary.org/wiki/obsolete https://en.wiktionary.org/wiki/obsolete Bringing that full circle, telnet used to be common but it has security issues (lack of encryption or integrity unless you tunnel over TLS, lack of modern authentication options, etc.) and so anywhere it’s still used we should be looking in to replacing it.
        aflag 4y ago
        Telnet is still in use for its primary purpose, which is a bit different than a locomotive which has been neglected to a tourist attraction. Your last paragraph means you would like to make telnet obsolete, but it isn't yet. As evidenced in the thread, it's not partical or desirable to replace it with other technology in all the deployments of it. So, it's still hanging in there for now.
- indymike 4y ago
  I haven't used a telnet server in forever, but I do use the telnet client to connect and introspect various services from time to time.
  - acdha 4y ago
    I used to do that too but switched to netcat/OpenSSL s_client in the 2010s, especially as TLS everywhere caught on.

bigbillheck 4y ago

Telnet as a way of logging in to a remote system is bad, sure, but telnet as a program for connecting to a server on any port and talking the protocol manually was great, especially before http got so complicated.

worldsavior 4y ago
I agree telnet can be used as a "client" for a different protocol, but for other means, its not a good solution.

an-unknown 4y ago

Not sure why everyone thinks that telnet is "not suitable for today especially in the case of security", although telnet over TLS exists. There are also certain things that telnet can do which SSH cannot (e.g. transport data for a block terminal). And everyone who uses "telnet as a program for connecting to a server on any port and talking the protocol manually" forgot that telnet is a real protocol and this type of abuse only works if the telnet client is sufficiently dumb / doesn't negotiate parameters. There is a reason why netcat exists.

worldsavior 4y ago
Telnet does not have any standard security, at least by default. No encryption and no authentication among others.
- an-unknown 4y ago
  This is factually wrong. There are even multiple different authentication and encryption schemes defined for telnet, see e.g.: https://www.iana.org/assignments/telnet-options/telnet-options.xhtml https://www.iana.org/assignments/telnet-options/telnet-optio... Just because some old and rudimentary telnetd or telnet client doesn't implement it doesn't mean it doesn't exist / isn't used.
  - worldsavior 4y ago
    Those are data formats, and a client is needed to support those (on both endpoints). You better just use something modern like ssh instead of hunting for clients (and making sure they're reliable).

qwezxcrty 4y ago

I have a 35k$ worth Xray flat panel detector (still have >5k$ ebay value today), it runs embedded linux on an obsolete samsung ARM processor and uses telnet to talk to the console computer through a point to point ethernet link. Apparently, it's impossible to migrate to ssh and why the ** I need to care about security here?

worldsavior 4y ago
Didn't talk about old devices. Security can be very important in cases of connecting to other servers.
- masklinn 4y ago
  > Didn't talk about old devices. Does not matter, you stated without nuance that telnet should no be used. So you told GP that they should trash their telnet-only devices.
  - worldsavior 4y ago
    No. You understood the phrase incorrectly and assume I mean "bang the head against the wall and don't you telnet". Of course if you have no other choice, go for it. But if you do...

nibbleshifter 4y ago

I mean, obviously we use SSH where possible. But in many cases out in the real world we have to support frankly awful old equipment that only offers telnet (if you are lucky). I don't think we will see the back of such things before 2030 either.

m3047 4y ago

"Telnet... [is] an old protocol..." Ok. Telnet is a protocol, it is not synonymous with TCP. As for unencrypted traffic generally, I see no reason for fetishizing encryption. "Compute" is not synonymous with teh cloudz. Cloud tech is not synonymous with teh cloudz. It's trivial to put e.g. Nginx in front of something. If you need encryption between 127.0.0.1 and 127.0.0.42 you clearly don't trust the hardware you're running on; I'm sure someone's got some clever way of hiding the private keys, but "clever" doesn't mean provably secure. Between containers... meh. Show me you thought about it and have a threat model. Between datacenters... not so much. Do I care whether the connection is encrypted, or whether all traffic goes through a tunnel? I'd like to see a threat model. Is sigint included? Even across the globe I might make an exception for a well-reasoned argument. That would almost certainly have to be data which was an observable: the time, a flow rate. Encryption is not the same as tamper-proof. Even unencrypted data might need defense against that. (Maybe secrecy is easier than nonrepudiability. Maybe.) Secrecy is not identical to privacy. Security is not identical to either of those, and hypervigilance isn't the same as not needing to be concerned with something (these days security can be either of those). Observability might be more important than either secrecy or privacy depending on the application, and who is doing the observing. A lot of it depends on where you demarc your rings of hell and how you defend things. I send data in the clear sometimes and I'm ok with it. I also use a telnet client for decidedly "not telnet protocol" purposes related to diagnostics as well as observability.

worldsavior 4y ago
I dont see why a thread model is needed here, encryption is always important, especially in big corps. It seems like you're stating that a normal person doesnt need security.