Hacker News Reader

Comment by jml7c5 | Hacker News Reader

Is "backdoor" the right term for this? I was under the impression that it implied intent. I.e., a "backdoor" is something added specifically to provide access through abnormal means, not just something that can be used to provide access.

This seems more like a mistake, particularly since they included the password in plaintext.

View on HN

A secret way for the manufacturer to get into your device; the term "backdoor" is very appropriate I think. Most manufacturers would not go about it as clumsily as Xyxel, but it's the same thing.

But implicit in your statement that it's "a secret way for the manufacturer to get into your device" is the claim that Zyxel intended it as a bypass.

It seems like without intent, anything can be called a "backdoor". My browser receives automatic updates, and Mozilla could push an update that gives them remote access to my user account. But I don't think anyone would say Mozilla has "backdoored" Firefox.

Firstly, I think it's a lot to ask that we believe Zyxel put a backdoor in their products and then just forgot about it.

But even if we choose to believe that, it's not wrong to say that it was secret. "Secret" typically means "without the knowledge of others". If I forget the secret combination to my safe, it doesn't become "not a secret" because of that.

In your example, Mozilla has presumably made public that they are using remote updates. So it can hardly be described as secret.

It's a locked front door, with the key under the flower pot. (But that's too long to write out each time.)

By the looks of it, yes you're right.

This is not a backdoor, this is frontdoor, plain and simple.

I see your point. While this uses the normal authentication method (user, password), the undisclosed nature of the account makes it a backdoor practically.

Not at all: https://en.wikipedia.org/wiki/Backdoor_(computing)

Reply on news.ycombinator.com