Hacker News Reader

Comment by SapporoChris | Hacker News Reader

"Telnet, an outdated system for logging in remotely." This comment from the article bothered me. No evidence was given as to why it is outdated. I did a little digging to find that Telnet is vulnerable to several different attacks, but all of it can be mitigated by Transport Layer Security (TLS) security and Simple Authentication and Security Layer (SASL) authentication. Of course many devices don't support TLS and SASL. If a device does support the newer standards I think it's wrong to consider it outdated.

View on HN

"Outdated" is a reasonable moniker for devices that accept cleartext telnet over the open Internet. That you can retrofit security onto telnet by running it over a TLS tunnel is not especially relevant, nor does it make telnet less outdated; secure devices are better off just using SSH.

What makes a protocol outdated? I would argue that outdated protocols "bake in" outdated assumptions. The telnet protocol has a builtin assumption that the network is secure, while newer protocols for remote administration lack this assumption and assume an actively malicious network.

the telnet protocol does not have to be used only on the open internet, just as HTTP (insecure) does not have to be either. It can be used internally for whatever reason you want as well. I don't think that makes it outdated.

And what sort of network do you think the IOT devices from the article were designed to be used on? This kind of thought process (well security isn't important if you use it internally) is exactly the sort of attitude that led to the botnets in the article becoming as large and as devastating as they ended up being

"A bad workman blames his tools" - if you're implementing a solution and you choose the wrong tool for the job, the tool is not to blame. If you need a secure protocol, don't use an insecure protocol. There are still ample use cases for the insecure protocol.

Telnet is not used really at all anymore. Most distributions come without it, or have it disabled by default. Historically it was the only way to connect remotely, as it imitated how connections used to work over phone lines. It's definitely outdated, as SSH is now the defacto.

That last part is interesting, it imitated how connections used to work over phone lines, can you talk more about that or provide a link please? Thank you

It’s outdated in the same way my 90s baggy jeans are outdated. Technically, they still work as clothing, but people find it unusual if I wear them.

Where do you live, though?

> but all of it can be mitigated by Transport Layer Security (TLS) security and Simple Authentication and Security Layer (SASL) authentication

At this point anyone sane should question why he would add TLS and SASL to Telnet (and expect to find clients which would support those too) instead of slapping SSH.

It's like asking why anyone would consider a hand-operated drill outdated, since you can slap an electric motor on it.

Telnet is extremely, insanely outdated. It's like walking around in Elizabethan clothes. Just because you also strap on a fanny pack and can go to a modern pub in it doesn't make it up to date. Wearing six inch long pointy toes and a giant codpiece just makes you look ridiculous.

Possible reason: telnet lets you log in with username/password, which is much easier to obtain than an ssh key. Encoded traffic doesn't matter. Paras cs. wouldn't have been able to wiretap the affected servers.

When have you last used it?

How could anybody claim that the teletype protocol is outdated? Teletype refers to this: https://en.wikipedia.org/wiki/Teleprinter

For remote login (context of the statement), telnet has been deprecated for a very long time.

It's not really related to teletypes (which I've never heard being called a teleprinter). They didn't operate over the internet, but used protocols such as RS-232 or acoustic modems.

Reply on news.ycombinator.com