Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardware backdoors in some x86 CPUs

github.com

Post reply on HN
Print view View original

31–40 of 103 posts

Re: Hardware backdoors in some x86 CPUs

#31

Post by close04 »

blank429384jf wrote: post #30
brador wrote: post #28

Earlier quoted context omitted.

Doesn’t backdoor imply hidden? If it’s clearly documented it’s just a (front)door?

backdoor means a secondary access point that defeats the security features of the primary. In the door analogy, the home owner spends a ton on a lock and camera for the front door but doesn't even have a deadbolt on the back.

Every definition of a “backdoor” in computing implicitly or explicitly considers it hidden/covert.

In the house analogy you don’t see the backdoor when approaching the front. If it was just “an alternative everyone knows about and can be broken easier than the front door” then it probably would have been called “a window”.

Most login forms have a weaker option like a SMS 2FA or password reset fallback. Nobody calls it a backdoor. It’s just a crappy second front door, or window.

Re: Hardware backdoors in some x86 CPUs

#32

Post by blank429384jf »

close04 wrote: post #31
blank429384jf wrote: post #30

Earlier quoted context omitted.

backdoor means a secondary access point that defeats the security features of the primary. In the door analogy, the home owner spends a ton on a lock and camera for the front door but doesn't even have a deadbolt on the back.

Every definition of a “backdoor” in computing implicitly or explicitly considers it hidden/covert. In the house analogy you don’t see the backdoor when approaching the front. If it was just “an alternative everyone knows about and can be broken easier than the front door” then it probably would have been called “a window”. Most login forms have a weaker option like a SMS 2FA or password reset fallback. Nobody calls i…

I'm probably mistaken, but I've always referred to password resets as backdoors. Is there another term they could be classfied as?

Re: Hardware backdoors in some x86 CPUs

#33

Post by close04 »

blank429384jf wrote: post #32
close04 wrote: post #31

Earlier quoted context omitted.

Every definition of a “backdoor” in computing implicitly or explicitly considers it hidden/covert. In the house analogy you don’t see the backdoor when approaching the front. If it was just “an alternative everyone knows about and can be broken easier than the front door” then it probably would have been called “a window”. Most login forms have a weaker option like a SMS 2FA or password reset fallback. Nobody calls i…

I'm probably mistaken, but I've always referred to password resets as backdoors. Is there another term they could be classfied as?

> Is there another term they could be classfied as?

As an advertised feature of the product.

Your personal definition doesn’t match the general understanding of the word and concept. By your definition every window on a house or car is a “backdoor”. Anything with an advertised fallback is a backdoor. And sometimes the “front door” is the back door: getting money from an ATM is less secure than with an ID at the bank teller.

Re: Hardware backdoors in some x86 CPUs

#35

Post by RamRodification »

littlecranky67 wrote: post #10
joss82 wrote: post #6

This backdoor only appears on decades-old VIA C3 embedded x86 processors

They should have mentioned that in the first line of the github readme, not burried deep down in the text.

Buried? Deep down? The fourth paragraph, clearly labeled "Affected Systems", a minute or two into the read.

Re: Hardware backdoors in some x86 CPUs

#37

Post by alfanick »

blueflow wrote: post #36

As noted by userbinator: https://news.ycombinator.com/item?id=49220030 Not a backdoor, but a documented CPU feature. The whitepaper about rosenbridge cannot be published because it would constitute scientific fraud.

> Not a backdoor, but a documented CPU feature.

I would be even more explicit and call it “Not a backdoor, but a documented feature of ancient de facto unused Via C3 CPU.”

Re: Hardware backdoors in some x86 CPUs

#39

Post by blank429384jf »

close04 wrote: post #33
blank429384jf wrote: post #32

Earlier quoted context omitted.

I'm probably mistaken, but I've always referred to password resets as backdoors. Is there another term they could be classfied as?

> Is there another term they could be classfied as? As an advertised feature of the product. Your personal definition doesn’t match the general understanding of the word and concept. By your definition every window on a house or car is a “backdoor”. Anything with an advertised fallback is a backdoor. And sometimes the “front door” is the back door: getting money from an ATM is less secure than with an ID at the bank…

Password resets aren't "backdoors" unless they contain a flaw the defeats any security protections. It's not just that the backdoor is less secure than the front, the backdoor has no security or is so easily defeated the security may as well not exist.

I'm surprised the hidden aspect of backdoor is so forward in folks minds. In my thinking nothing in cyber security is hidden, I drop the obviously present hidden part of backdoor definition when it's used in yhe cyber security context.

Post reply on HN