The Jargon file definition seems very right. A back-door is a way in that is not suspected by the owner, regardless of motivation.

I have written a number of web administration packages. And even though I am not super-security conscious, I have them all programmed so that the package *will not work* until you change the root password. That's right, until you change the password you can only do one thing: change the password (and no matter what you do you get taken to a screen that says, prior to customizing this program you must change the password).

IMHO all packages should have this feature.

The RH package seems to go beyond not offering this security feature -- IIUC it actually takes away from it by (falsely) telling the user no such password exists. If that's not a back-door, I don't know what is!!

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/25/1694#1694