Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubiquiti Networks Breach

mailchi.mp

Post reply on HN
Print view View original

361–370 of 486 posts

Re: Ubiquiti Networks Breach

#361

Post by kiwijamo »

conk wrote: post #331
3guk wrote: post #40

I must admit - Ubiquiti has lost some of it's shine in the last few years, whilst AP and routing hardware seems to still be very good in terms of pricepoint, it does feel like the software side of things has been going in a very strange direction for quite some time. I'm still quite annoyed by the fact that I was forced to migrate from Unifi Video to Unifi Protect - due to vendor lock in and the fact that the remote…

Can’t you still access a Unifi video server locally? What’s so hard about setting up a reverse proxy or VPN?

You can't do that anymore. You either have to buy their server or use their cloud, from my understanding. I am another considering migration away from them for this reason as well.

Re: Ubiquiti Networks Breach

#362

Post by dawnerd »

nh2 wrote: post #283

Regarding authenticity, from the TechCrunch article about this: > The networking company quickly followed its email with a post on its community pages confirming that the email was authentic, after several complained that the email sent to customers included typos. Indeed: How am I supposed to know whether this email is really from Ubiquiti? * There was apparently no official press release. * All links in the email,…

Yeah I was really suspect seeing two buttons like that in the email. They didn't really think that one through.

Re: Ubiquiti Networks Breach

#363

Post by dawnerd »

lsllc wrote: post #232
imposterr wrote: post #83

Earlier quoted context omitted.

You can also just run a docker container for it [0]. This has the added benefit of separating your data from the runtime so you can move it around as if you had a physical cloud key. [0] https://hub.docker.com/r/linuxserver/unifi-controller

Yeah ... I find that the containerized UniFi controller tends to crash after a few days with various Java errors. I've tried several different unifi-controller containers, although I haven't tried this particular one so I'll give it a try.

That particular image has been problem free for me on unraid for I dunno feels like years now. They did do some update that I missed the notes on that wiped out my database and I had to re add everything. Wasn't too happy about that.

Re: Ubiquiti Networks Breach

#364

Post by m0dest »

tfvlrue wrote: post #349
asciident wrote: post #334

Earlier quoted context omitted.

Strange, I found the Unifi Controller web UI to be really poorly architected. 1) You start a .app that sits for a few seconds then requires you to launch the browser by clicking a button. While using the browser, you can't close the extra window for the controller. 2) On the browser, you go to a localhost website that has an invalid TLS certificate (you can a "Not Secure" warning) and have to click through to the uns…

I'm not sure it's fair to fault the Unifi software for using a self-signed SSL certificate. I think the only theoretical security risk here would be that Ubiquiti could decrypt the traffic between you and your Unifi controller, if they could somehow obtain it. (Someone please correct me if I'm wrong.) Ultimately, if you don't trust the certificate it comes with, it's not too difficult to replace it with one of your o…

I think it's fair for few reasons:

- Without a valid SSL certificate, there's no way to tell whether you're actually visiting your UniFi controller or a honeypot. Ubiquiti isn't the risk here.

- UniFi features that depend on WebSocket and WebRTC are unavailable when using self-signed certificates. This includes live stats updating, device terminal, airView, etc. (Those features can be used in the cloud UI... if your Internet connection happens to be working fine.)

- Valid SSL certificates would be easy to auto-provision these days with LetsEncrypt. There are some minor challenges around port forwarding / relay, but that isn't rocket science. If Plex can figure it out, Ubiquiti can figure it out :)

Re: Ubiquiti Networks Breach

#365

Post by possibleworlds »

colordrops wrote: post #260
possibleworlds wrote: post #179

Earlier quoted context omitted.

My primary use case for a home router is solid set and forget qos. fq_codel and cake were recently added to routeros v7 beta, which means I will be plugging in my hEX again after a few years of happy edgerouter x usage. Also interested in what access points (besides unifi) people pair with mikrotik routers. Any wifi 6 recommendations?

I'm curious as to what you are doing with qos in a home setup.

Late reply, and the other reply covered it really.

Up until around a year ago I was on adsl2 with a highly symmetrical connection. I work from home mostly as does my partner, with constant syncing to various cloud services plus large uploads and downloads for work.

Maxing out the puny 1Mb of upload would render the entire connection completely unusable. Yes, you can manually limit various apps but it so much easier just to throw an edgerouter x in front of everything running stock smart queue or cake.

I'm on a faster connection now so uploads are not so much an issue, but even still it works a treat for things like gaming / VOIP.

Re: Ubiquiti Networks Breach

#366

Post by justinclift »

snoshy wrote: post #74
not2b wrote: post #50

Earlier quoted context omitted.

No one could possibly prove this kind of negative.

Why not? All you have to do is point to one particular company whose systems have not been verifiably breached after having resisted actual attempts.

Several places probably would have met those goals...

... right up until the SolarWinds hack became public.

The point being, provable "we've never been breached" seems to have a way of turning out to be wrong. :/

Re: Ubiquiti Networks Breach

#367

Post by chrisgacsal »

vetinari wrote: post #52
centimeter wrote: post #28

Earlier quoted context omitted.

Cloudless if and only if you run their gigantic bloated Java network management tool. I really like ubiquiti hardware but I got fed up with their software BS. Now I use either Mikrotik or TP-Link’s industrial offerings. Both are way easier to work with than ubiquiti and the hardware is usually in the same tier.

Mikrotik? Easier? Do not get me wrong, I love Mikrotik, but easier would not the word I would be using. This image ( https://www.reddit.com/r/mikrotik/comments/jyjgnc/mikrotik_v... ) sums it up neatly. Also, Mikrotik is not directly comparable, you cannot replace Unifi Controller with Capsman.

Only thing disappoints me about Mikrotik is the wireless performance of their routers, which seems to that is more about the RouterOS then the hardware itself. You can never know if the next update will improve or worsen WiFi perf. Otherwise they have really good products.

Re: Ubiquiti Networks Breach

#368

Post by r9 »

asciident wrote: post #334
giobox wrote: post #186

Earlier quoted context omitted.

Second this. I'm no great expert in this area but have greatly enjoyed using Ubiquiti gear for my home the past few years. If there is something else that offers a comparable experience at similar price point would be great to know. The Unifi Controller software has been some of the nicest I've used in a domestic setting.

Strange, I found the Unifi Controller web UI to be really poorly architected. 1) You start a .app that sits for a few seconds then requires you to launch the browser by clicking a button. While using the browser, you can't close the extra window for the controller. 2) On the browser, you go to a localhost website that has an invalid TLS certificate (you can a "Not Secure" warning) and have to click through to the uns…

How does one have a valid TLS cert on a piece of software that uses a "localhost website"?

Re: Ubiquiti Networks Breach

#369

Post by fomine3 »

tfvlrue wrote: post #349
asciident wrote: post #334

Earlier quoted context omitted.

Strange, I found the Unifi Controller web UI to be really poorly architected. 1) You start a .app that sits for a few seconds then requires you to launch the browser by clicking a button. While using the browser, you can't close the extra window for the controller. 2) On the browser, you go to a localhost website that has an invalid TLS certificate (you can a "Not Secure" warning) and have to click through to the uns…

I'm not sure it's fair to fault the Unifi software for using a self-signed SSL certificate. I think the only theoretical security risk here would be that Ubiquiti could decrypt the traffic between you and your Unifi controller, if they could somehow obtain it. (Someone please correct me if I'm wrong.) Ultimately, if you don't trust the certificate it comes with, it's not too difficult to replace it with one of your o…

To be fair, there is no (or very few) practical solution other than to use self-signed certificate. https://lwn.net/Articles/837491/

Re: Ubiquiti Networks Breach

#370

Post by fomine3 »

m0dest wrote: post #364
tfvlrue wrote: post #349

Earlier quoted context omitted.

I'm not sure it's fair to fault the Unifi software for using a self-signed SSL certificate. I think the only theoretical security risk here would be that Ubiquiti could decrypt the traffic between you and your Unifi controller, if they could somehow obtain it. (Someone please correct me if I'm wrong.) Ultimately, if you don't trust the certificate it comes with, it's not too difficult to replace it with one of your o…

I think it's fair for few reasons: - Without a valid SSL certificate, there's no way to tell whether you're actually visiting your UniFi controller or a honeypot. Ubiquiti isn't the risk here. - UniFi features that depend on WebSocket and WebRTC are unavailable when using self-signed certificates. This includes live stats updating, device terminal, airView, etc. (Those features can be used in the cloud UI... if your…

Enabling non self-signed TLS certificate on IoT devices looks like easy task but actually it has difficulty. Especially router is hard because it bootstrap WAN connection.
Post reply on HN