6 ms·

"Telnet, an outdated system for logging in remotely." This comment from the article bothered me. No evidence was given as to why it is outdated. I did a little

"Telnet, an outdated system for logging in remotely." This comment from the article bothered me. No evidence was given as to why it is outdated. I did a little digging to find that Telnet is vulnerable to several different attacks, but all of it can be mitigated by Transport Layer Security (TLS) security and Simple Authentication and Security Layer (SASL) authentication. Of course many devices don't support TLS and SASL. If a device does support the newer standards I think it's wrong to consider it outdated.

junon 3y ago
Telnet is not used really at all anymore. Most distributions come without it, or have it disabled by default. Historically it was the only way to connect remotely, as it imitated how connections used to work over phone lines. It's definitely outdated, as SSH is now the defacto.
- jamesdwilson 3y ago
  That last part is interesting, it imitated how connections used to work over phone lines, can you talk more about that or provide a link please? Thank you
blowski 3y ago
It’s outdated in the same way my 90s baggy jeans are outdated. Technically, they still work as clothing, but people find it unusual if I wear them.
- InCityDreams 3y ago
  Where do you live, though?
vngzs 3y ago
"Outdated" is a reasonable moniker for devices that accept cleartext telnet over the open Internet. That you can retrofit security onto telnet by running it over a TLS tunnel is not especially relevant, nor does it make telnet less outdated; secure devices are better off just using SSH. What makes a protocol outdated? I would argue that outdated protocols "bake in" outdated assumptions. The telnet protocol has a builtin assumption that the network is secure, while newer protocols for remote administration lack this assumption and assume an actively malicious network.
- jamesdwilson 3y ago
  the telnet protocol does not have to be used only on the open internet, just as HTTP (insecure) does not have to be either. It can be used internally for whatever reason you want as well. I don't think that makes it outdated.
  - nightpool 3y ago
    And what sort of network do you think the IOT devices from the article were designed to be used on? This kind of thought process (well security isn't important if you use it internally) is exactly the sort of attitude that led to the botnets in the article becoming as large and as devastating as they ended up being
    - jamesdwilson 3y ago
      "A bad workman blames his tools" - if you're implementing a solution and you choose the wrong tool for the job, the tool is not to blame. If you need a secure protocol, don't use an insecure protocol. There are still ample use cases for the insecure protocol.
marcod 3y ago
How could anybody claim that the teletype protocol is outdated? Teletype refers to this: https://en.wikipedia.org/wiki/Teleprinter https://en.wikipedia.org/wiki/Teleprinter
- Jtsummers 3y ago
  For remote login (context of the statement), telnet has been deprecated for a very long time.
- tgv 3y ago
  It's not really related to teletypes (which I've never heard being called a teleprinter). They didn't operate over the internet, but used protocols such as RS-232 or acoustic modems.
justsomehnguy 3y ago
> but all of it can be mitigated by Transport Layer Security (TLS) security and Simple Authentication and Security Layer (SASL) authentication At this point anyone sane should question why he would add TLS and SASL to Telnet (and expect to find clients which would support those too) instead of slapping SSH. It's like asking why anyone would consider a hand-operated drill outdated, since you can slap an electric motor on it.
tgv 3y ago
Possible reason: telnet lets you log in with username/password, which is much easier to obtain than an ssh key. Encoded traffic doesn't matter. Paras cs. wouldn't have been able to wiretap the affected servers.
andersa 3y ago
When have you last used it?
throwawaaarrgh 3y ago
Telnet is extremely, insanely outdated. It's like walking around in Elizabethan clothes. Just because you also strap on a fanny pack and can go to a modern pub in it doesn't make it up to date. Wearing six inch long pointy toes and a giant codpiece just makes you look ridiculous.

junon 3y ago

Telnet is not used really at all anymore. Most distributions come without it, or have it disabled by default. Historically it was the only way to connect remotely, as it imitated how connections used to work over phone lines. It's definitely outdated, as SSH is now the defacto.

jamesdwilson 3y ago
That last part is interesting, it imitated how connections used to work over phone lines, can you talk more about that or provide a link please? Thank you

blowski 3y ago

It’s outdated in the same way my 90s baggy jeans are outdated. Technically, they still work as clothing, but people find it unusual if I wear them.

InCityDreams 3y ago
Where do you live, though?

vngzs 3y ago

"Outdated" is a reasonable moniker for devices that accept cleartext telnet over the open Internet. That you can retrofit security onto telnet by running it over a TLS tunnel is not especially relevant, nor does it make telnet less outdated; secure devices are better off just using SSH. What makes a protocol outdated? I would argue that outdated protocols "bake in" outdated assumptions. The telnet protocol has a builtin assumption that the network is secure, while newer protocols for remote administration lack this assumption and assume an actively malicious network.

jamesdwilson 3y ago
the telnet protocol does not have to be used only on the open internet, just as HTTP (insecure) does not have to be either. It can be used internally for whatever reason you want as well. I don't think that makes it outdated.
- nightpool 3y ago
  And what sort of network do you think the IOT devices from the article were designed to be used on? This kind of thought process (well security isn't important if you use it internally) is exactly the sort of attitude that led to the botnets in the article becoming as large and as devastating as they ended up being
  - jamesdwilson 3y ago
    "A bad workman blames his tools" - if you're implementing a solution and you choose the wrong tool for the job, the tool is not to blame. If you need a secure protocol, don't use an insecure protocol. There are still ample use cases for the insecure protocol.

marcod 3y ago

How could anybody claim that the teletype protocol is outdated? Teletype refers to this: https://en.wikipedia.org/wiki/Teleprinter https://en.wikipedia.org/wiki/Teleprinter

Jtsummers 3y ago
For remote login (context of the statement), telnet has been deprecated for a very long time.
tgv 3y ago
It's not really related to teletypes (which I've never heard being called a teleprinter). They didn't operate over the internet, but used protocols such as RS-232 or acoustic modems.

justsomehnguy 3y ago

> but all of it can be mitigated by Transport Layer Security (TLS) security and Simple Authentication and Security Layer (SASL) authentication At this point anyone sane should question why he would add TLS and SASL to Telnet (and expect to find clients which would support those too) instead of slapping SSH. It's like asking why anyone would consider a hand-operated drill outdated, since you can slap an electric motor on it.

tgv 3y ago

Possible reason: telnet lets you log in with username/password, which is much easier to obtain than an ssh key. Encoded traffic doesn't matter. Paras cs. wouldn't have been able to wiretap the affected servers.

andersa 3y ago

When have you last used it?

throwawaaarrgh 3y ago

Telnet is extremely, insanely outdated. It's like walking around in Elizabethan clothes. Just because you also strap on a fanny pack and can go to a modern pub in it doesn't make it up to date. Wearing six inch long pointy toes and a giant codpiece just makes you look ridiculous.