3 ms·
Because it looks like this actually is telnet as opposed to ssh, let's make one thing clear: In telnet, everything is sent unencrypted. Even passwords. Especia
by cbd1984 12y ago
Because it looks like this actually is telnet as opposed to ssh, let's make one thing clear:
In telnet, everything is sent unencrypted. Even passwords. Especially passwords. Telnet does not encrypt passwords. Passwords are sent in the clear. Anyone snooping your traffic could read all of your passwords if you send them over a telnet session.
I hope that was just enough verbiage to make certain at least one person gets the message.
- AtmaScout 12y agoVery good point. I can imagine someone not thinking about that when using this lib. All types of shenanigans could potentially be had with this though. I personally would not like installing an app with this lib.
- hylianlink 12y agoI'm in the same boat.
- swisspol 12y agoYes this is Telnet, not SSH and you certainly wouldn't want to ship it enabled by default: it should be enabled on Debug builds only or have some explicit switch for testers, etc... The primary use of this library is for development and field debugging and for that it can be very valuable: you can connect to your app (while it's running of course) from pretty much any computer. There are also some use cases in production that expose no security risks (apps are sandboxed after all and far from every app deals with password or sensitive data).
- tough-crowd 12y agoTo quote Dr. Ian Malcolm: "Security holes find a way", I mean life.
- quesera 12y ago> I hope that was just enough verbiage to make certain at least one person gets the message. Yep. Plenty of verbiage. All of it invalid, however. This code doesn't run login or link PAM. It doesn't authenticate. No username or password will ever be prompted for, or sniffed.