Why ports below 1024 are privileged

early 1980sThe Berkeley networking code

Binding a listening socket to a port below one thousand and twenty-four requires privilege. The number is not a technical boundary: nothing about the protocol changes on either side of it.

It was an authentication mechanism. On a network of shared machines, each administered by a small number of people, a connection arriving from a low port carried a guarantee: whatever sent it had been started by somebody with administrative rights on that machine.

1980sWhat the guarantee was used for

A family of remote access tools was built directly on it. A machine could be configured to trust another machine, and the trust was checked by looking at the source port. If the connection came from a low port, the remote end was assumed to have verified the user's identity already, and no password was required.

Understood in its setting this is reasonable. Machines were expensive, shared, and administered by employees of the same organisation, and the alternative was sending passwords across the same unencrypted network.

1990s onwardsThe assumption that dissolved

The guarantee held exactly as long as ordinary users did not administer their own machines.

Once a person owned the computer on their desk, administrative rights on it cost nothing, and a connection from a low port proved only that the sender had chosen to use one. The mechanism did not break; the population it described changed underneath it.

present dayWhat it costs now

The restriction survived the guarantee, and the cost is paid daily by everyone serving a website. A process that must bind to the standard web ports has to start with privileges it does not want, and then give them up, which is a delicate operation and a recurring source of mistakes.

The alternatives are all workarounds: granting a narrow capability instead of full privilege, putting something else in front to do the binding, or redirecting the traffic at a lower layer. Each is reasonable and each exists because of a number chosen when the answer to who ran the machine was different.

1980sThe trust model that was built on it

It is worth being concrete about what the guarantee enabled, because the design looks reckless without it. A file on one machine could list other machines and users to be trusted, and a matching connection from a low port on a listed machine was accepted without any further check.

No password crossed the network, which was the point: the network carried everything in the clear, so not sending a password was a genuine security improvement over the alternative available at the time.

The whole arrangement rested on one assumption, stated nowhere in the protocol: that obtaining administrative rights on a connected machine was difficult.

1990sHow the replacement changed the question

What replaced it moved the guarantee from the network to cryptography. Instead of inferring identity from a property of the connection, the two ends prove identity to each other with keys, and the port number becomes irrelevant to the question.

That is the general shape of the repair for everything in this part: a property that used to be a proxy for a fact becomes a proxy for nothing, and the fix is to establish the fact directly rather than to find a better proxy.

present dayWhat to check in your own system

The practical residue is a question worth asking of any service that listens on a standard port: what privileges does it hold once it is running, and did it need them for anything except binding.

The common answer is that it started as an administrator, opened the socket, and dropped down. That sequence is correct and is also the point at which a mistake grants an attacker everything, which is why the narrow capability and the redirect exist as alternatives.

The number itself

One thousand and twenty-four is a round figure in binary and nothing else. There is no property of the first thousand ports that distinguishes them, and the assignments inside the range were made over decades by a registry rather than by design.

Which means the boundary is doubly arbitrary: a round number dividing a space whose contents were allocated one at a time, guarding a guarantee that has not held for thirty years.

present dayWhere the same idea still works

Inferring authority from a property of the connection is not dead; it moved. A request arriving on an internal interface, from an address range only the operator controls, is trusted by a great deal of software today for exactly the reasons the port number was trusted then.

The assumption is the same one, and it fails the same way: it holds until somebody else can send from inside that range, at which point the property proves nothing and the software has no second check. Reading the old mechanism carefully is the cheapest way to recognise the new one.

present dayWhy nobody removes it

Removing the restriction is easy and nobody does it, for a reason that recurs across this part: the benefit is diffuse and the risk is specific.

Somewhere on the network is a system still relying on the old guarantee, and the person who lifts the restriction inherits responsibility for it. Keeping a rule that no longer protects anything is free for whoever keeps it, and mildly expensive for everybody, forever.

What we cannot verify

The mechanism and the boundary are documented in the source and in the assigned-numbers records of the period, and both are checkable. The reasoning is recorded mainly in manuals and in later accounts rather than in a design document, and the choice of one thousand and twenty-four specifically, rather than any other round binary figure, is not explained by any source we have found.