News for hackers. Stuff that matters.

A comment on Amazon's customer service backdoor. Parent comment

Re:Amazon's customer service backdoor by MertsA on Monday January 25, 2016 @12:27AM (#10965760)
At this point, 16 bits of entropy is more than the entropy of a lot of the passwords that I've seen.
[ Parent | on HN ]
Re:Amazon's customer service backdoor by richardwhiuk on Monday January 25, 2016 @04:28AM (#10966314)
You have 10 bits of entropy at best, unless you put it above 1024, at which point if it dies, any none privileged user on the box can sniff passwords.
[ Parent | on HN ]
Re:Amazon's customer service backdoor by Dylan16807 on Monday January 25, 2016 @07:22AM (#10966761)
Why are you using passwords for SSH?

Do you actually have untrusted users on the box?

Why would you not secure the custom port to root-only?

[ Parent | on HN ]
Re:Amazon's customer service backdoor by arielb1 on Monday January 25, 2016 @05:47AM (#10966501)
If you are serious, you should limit SSH access to a bastion host with no unprivileged users.
[ Parent | on HN ]