When you're trying to do something secretly, you run into a new tradeoff: doing it the right way vs. doing it in such a way that it doesn't draw attention to itself. It might have been the case that hashing it would have been too flashy.

I would imagine it would hook into the existing code that is hashing the passwords... Which suggests that they are not in fact hashing the user inputs and are relying on the client to do that for them.

>They embedded the backdoor password right into it

Or you know, that's just one obvious backdoor they put in, to divert from the other 2-3 non-obvious they have.

But one thing the NSA likes to say is that the backdoors they insert are only accessible to them, not to others. For example the DUAL_EC backdoor could only be exploited by the NSA. With this backdoor, now China and everyday criminals can also use it.

I see the benefit of inserting multiple backdoors. But none of them should be vulnerable to rival nations.

>But one thing the NSA likes to say is that the backdoors they insert are only accessible to them, not to others.

Which is an empty statement when it comes to security principles. If you've placed a backdoor (and some are blatantly obvious if you look for it, like some SSL issues), then others can use it too. Most backdoors are not of the "we have an encrypted password only we know" variety, but of the purposeful hole to exploit.

>I see the benefit of inserting multiple backdoors. But none of them should be vulnerable to rival nations.

Except if the idea is to monitor the local population, and you do not care that much if others monitor them too.

That's not a good idea if you're hiding a backdoor. The last thing you want is for people to have a reason to audit the code base.