,
3 tweets,
1 min read
Read on Twitter
Default/backdoor passwords has been a scourge for decades. However, we can't tell people NOT to do this until we can explain alternatives, how to achieve their goals (like configuration, resets, debugging) without default passwords.
Everyone knows the Mirai worm was about "default passwords". it really wasn't. Instead, the issue was that Telnet was enabled. The issue we need to solve is why Telnet was enabled, and how they can accomplish those goals without Telnet being enabled.
Another biggy is how to setup consumer products. A lot of alternatives to default passwords are worse, such as forcing people to have online cloud accounts in order to configure their IoT devices. It looks more secure (no listening ports) but has worse privacy concerns.
