Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Begins at the Home Router

insights.sei.cmu.edu

Post reply on HN
Print view View original

31–40 of 177 posts

Re: Security Begins at the Home Router

#31

Post by armitron »

The way I do things, is to treat the cable modem as already compromised and connect it to a router 100% under my control (running Linux) that will perform additional firewalling and/or act as a wireless AP. I will never let a border device have any sort of direct access into my internal network.

There is no point in spending lots of time & effort trying to secure half-baked half-open devices that are not under my full control. I will do what I can [or what I'm allowed to do by the usually severely restricted configuration modem panel] but I know the game, there, is already lost. Moreover, the ISP can remotely administer the cable modem and flash anything to it.

A second perimeter that is based on infrastructure I fully configure/control/administer is where I still have a chance.

Re: Security Begins at the Home Router

#32

Post by jdlyga »

kyrra wrote: post #6
AustinBGibbons wrote: post #2

Telling that the summary advice is “change the default password”, even if some of the other ideas are deployed user involvement is near zero if not completely zero. I wonder how impactful it would be to roll out a totally read-only router, or if the necessity of updates and maintenance would generate too much headache for the user

(I'm a Googler, opinions are my own). I think this is one of the awesome things about Google Wifi (aka: OnHub). It's fully managed from a phone app (via "the cloud"), so you get the authentication tied to your gmail account. It's also based on ChromeOs (chromebook OS), and follows a similar auto-update that Chromebooks get. So you are always running the latest firmware. (There are obviously downsides to Google Wifi,…

If only Google Wifi worked with wired connections, I would've considered buying one. I ended up going the Ubiquity route, and couldn't be happier.

Re: Security Begins at the Home Router

#33

Post by briandear »

j45 wrote: post #11
frockington wrote: post #7

Earlier quoted context omitted.

The only con I can think to that is the initial influx of support questions. I have no idea why this is not the default now, its simple, user friendly, and way more secure

A larger information label specific to each device could be printed to minimize those questions. "START HERE" followed by steps. Communication and comprehension is always a key battle of onboarding.

Or something similar such as the way the HomePod setup process works.

Re: Security Begins at the Home Router

#34

Post by Terretta »

h4b4n3r0 wrote: post #15
kyrra wrote: post #6

Earlier quoted context omitted.

(I'm a Googler, opinions are my own). I think this is one of the awesome things about Google Wifi (aka: OnHub). It's fully managed from a phone app (via "the cloud"), so you get the authentication tied to your gmail account. It's also based on ChromeOs (chromebook OS), and follows a similar auto-update that Chromebooks get. So you are always running the latest firmware. (There are obviously downsides to Google Wifi,…

Can you elucidate just _why_ it is necessary for a router to be managed through the cloud?

It’s useful but not necessary. It’s hard to offer the simplicity described above while keeping the control in your hands, but some folks working on wireless mesh are working on it:

https://blog.eero.com/mesh-trust-public-key-infrastructure-e...

Re: Security Begins at the Home Router

#35

Post by 0xfeba »

I agree with Steven Gibson. The biggest defense we can have on this is autoupdating routers. At a minimum, just restart at some fixed time after an update is downloaded. More fancy would be dynamically calculating a low usage day and time to restart.

But this would also involve the router manufacturer keeping it up-to-date as well.

Which gets me thinking... Does a SOHO (or any) device exist that effectively runs two firmware instances at once to allow minimal downtime as it switches over to new firmware? I imagine larger routers do, or at least, two identical physical routers accomplishes as much.

Re: Security Begins at the Home Router

#36

Post by firefistace77 »

I'll take this opportunity to ask the community, what is a recommend router?

It's going to be me and my roommate only (with friends and family over) and I would like to get something secure and also reliable (and preferably on the cheaper side)

Any suggestions? I believe we have Cox if that is any factor....

Re: Security Begins at the Home Router

#37

Post by thomastjeffery »

noja wrote: post #3
AustinBGibbons wrote: post #2

Telling that the summary advice is “change the default password”, even if some of the other ideas are deployed user involvement is near zero if not completely zero. I wonder how impactful it would be to roll out a totally read-only router, or if the necessity of updates and maintenance would generate too much headache for the user

Print the randomly generated password on a sticker on the router. Problem solved.

The problem with that is that they pick awful sets to generate from.

Instead of a string of random letters and numbers, they should be a string of words.

It's frustrating to visit someone's home, and have to enter (on a phone keyboard, no less) some lengthy gibberish that they never bothered to change.

Re: Security Begins at the Home Router

#38

Post by SubiculumCode »

Operyl wrote: post #4
AustinBGibbons wrote: post #2

Telling that the summary advice is “change the default password”, even if some of the other ideas are deployed user involvement is near zero if not completely zero. I wonder how impactful it would be to roll out a totally read-only router, or if the necessity of updates and maintenance would generate too much headache for the user

AT&T and a few others currently deal with this problem by having a random password assigned for the admin user printed on a sticker on the side of their Modem/Router combo boxes. It seems to work pretty well.

imo, it's none of my isp's business what I have on my network and so use my own network equipment.

Re: Security Begins at the Home Router

#39

Post by white-flame »

Terretta wrote: post #34
h4b4n3r0 wrote: post #15

Earlier quoted context omitted.

Can you elucidate just _why_ it is necessary for a router to be managed through the cloud?

It’s useful but not necessary. It’s hard to offer the simplicity described above while keeping the control in your hands, but some folks working on wireless mesh are working on it: https://blog.eero.com/mesh-trust-public-key-infrastructure-e...

"Simplicity" can be a negative indicator of security. If it's simpler for you, it might also be simpler for an attacker.

Manual steps with the physical hardware, or even requiring a local wifi/ethernet connection, are always going to be more secure than an internet-accessible god mode.

Re: Security Begins at the Home Router

#40

Post by CommanderData »

I'd like explore making a small ecosystem of open security plugins built on top of OpenWrt.

The goal is to make firewalling and controlling network traffic really easy.

The UI should be so easy a parent could perform difficult tasks such as limiting an iot devices traffic to local net or maybe just one ip using just an app.

Or detecting unusual patterns of traffic from a device or IP addresses.

The apis exist I can't think of many barriers to entry.

Post reply on HN