Doesn’t backdoor imply hidden? If it’s clearly documented it’s just a (front)door?
In the house analogy you don’t see the backdoor when approaching the front. If it was just “an alternative everyone knows about and can be broken easier than the front door” then it probably would have been called “a window”.
Most login forms have a weaker option like a SMS 2FA or password reset fallback. Nobody calls it a backdoor. It’s just a crappy second front door, or window.
It's meaningful that the Windows 10 install method has no (official) way to disable it, but I don't think making something optional could make it not a back door, if it was one before.
Even when automatic updates are disabled, I'm not going to be reading every update so the effect seems mostly the same, regardless of whether updates are automatic or not.
The FSF's definition of "back door" (at the bottom of the linked page) is "any feature of a program that enables someone who is not supposed to be in control of the computer where it is installed to send it commands" which leaves a lot of ambiguity with the words "supposed to be". I am not sure how to interpret this definition.
[1] https://www.gnu.org/proprietary/proprietary-back-doors.html#...
Doesnt really matter which platform, automatic updates are bad news.
On windows it led to clownstrike. On BMW it led to dash ads.
Theres infinite examples of auto updates being an attack vector for OEMs and other bad actors.
Always disable updates on every product. Can always reenable as needed or even sideload updates.
As an advertised feature of the product.
Your personal definition doesn’t match the general understanding of the word and concept. By your definition every window on a house or car is a “backdoor”. Anything with an advertised fallback is a backdoor. And sometimes the “front door” is the back door: getting money from an ATM is less secure than with an ID at the bank teller.
I'm surprised the hidden aspect of backdoor is so forward in folks minds. In my thinking nothing in cyber security is hidden, I drop the obviously present hidden part of backdoor definition when it's used in yhe cyber security context.
>> I'm probably mistaken, but I've always referred to password resets as backdoors
> Password resets aren't "backdoors" unless they contain a flaw the defeats any security protections.
You really have to make up your mind. It was “always” but then it wasn’t, and even as you put it you’d have been wrong almost every time to call a reset “a backdoor”.
> I'm surprised the hidden aspect of backdoor is so forward in folks minds.
Only because you misunderstand the meaning of the term, as made very clear above. Go through the wiki page for a “backdoor”.
> In my thinking nothing in cyber security is hidden
I wonder what all those security researchers do all day, with everything being so out in the open and known by everyone.
> I drop the obviously present hidden part of backdoor definition when it's used in yhe cyber security context.
You can drop it but then you’re just using the wrong definition and wrong understanding.
It's just that publicly known backdoors are of very limited usefulness, because people go out of their way to remove, disable, or avoid them. Or worse, use them for their own gains. There have been more than a few cases of governments trying to implement and enforce publicly known backdoors (with keys only the government knows), such as the Clipper cryptography chip in the 90s.
But... just because something is documented, doesn't mean it's publicly known. We have an example here of something obscure enough to be a useful backdoor (assuming someone knew about it).
And while the underlying feature might have been documented, the fact that many BIOSes enabled the feature was not documented anywhere. That does count as hidden.