Security Begins at the Home Router • Hacker News Board

Re: Security Begins at the Home Router

#11

Post by j45 » Mon, Jul 30, 2018, 5:12 PM UTC

frockington wrote: post #7

noja wrote: post #3

Earlier quoted context omitted.

Print the randomly generated password on a sticker on the router. Problem solved.

The only con I can think to that is the initial influx of support questions. I have no idea why this is not the default now, its simple, user friendly, and way more secure

A larger information label specific to each device could be printed to minimize those questions.

"START HERE" followed by steps. Communication and comprehension is always a key battle of onboarding.

Re: Security Begins at the Home Router

#12

Post by tomjakubowski » Mon, Jul 30, 2018, 5:14 PM UTC

frockington wrote: post #7

noja wrote: post #3

Earlier quoted context omitted.

Print the randomly generated password on a sticker on the router. Problem solved.

The only con I can think to that is the initial influx of support questions. I have no idea why this is not the default now, its simple, user friendly, and way more secure

Cox (Orange County) and Verizon Fios (Los Angeles) delivered routers with good-looking, seemingly randomly generated passwords printed on a label. It's been this way with Cox for at least six years.

Re: Security Begins at the Home Router

#13

Post by Operyl » Mon, Jul 30, 2018, 5:16 PM UTC

paulie_a wrote: post #9

Operyl wrote: post #4

Earlier quoted context omitted.

AT&T and a few others currently deal with this problem by having a random password assigned for the admin user printed on a sticker on the side of their Modem/Router combo boxes. It seems to work pretty well.

While I do like the idea, att boxes are very low quality and drop wifi connections constantly. I've always installed a ubuqiti router and AP. Apparently it's impossible to disable the firewall on the att box also. I've actually called att and had the conversation: "can you enable some ports". CSR, which ones? Tcp and udp 1-65,535...

For most users, this really isn't a problem. I never had many problems using the ATT stock boxes for routing, but like you have moved on to better solutions. But we also understand how to secure our devices. Even newer consumer routers are following this same strategy of printed admin passwords, so if a consumer is deciding to replace it with a newer device it still works! :)

Re: Security Begins at the Home Router

#14

Post by bradenb » Mon, Jul 30, 2018, 5:19 PM UTC

AustinBGibbons wrote: post #2

Telling that the summary advice is “change the default password”, even if some of the other ideas are deployed user involvement is near zero if not completely zero. I wonder how impactful it would be to roll out a totally read-only router, or if the necessity of updates and maintenance would generate too much headache for the user

The idea of a completely read-only router is really interesting. I used to buy hardware that would only work with open firmware -- I used to love to constantly update and mess with DD-WRT. But in more recent years I've just started buying high-performing hardware and skipping the customization beyond SSID and passwords. With faster connections, UPNP, and decent default QoS policies I pretty much never have to configure my access points or routers anymore. I'm pretty sure the average consumer has no desire to configure anything.

Re: Security Begins at the Home Router

#15

Post by h4b4n3r0 » Mon, Jul 30, 2018, 5:20 PM UTC

kyrra wrote: post #6

AustinBGibbons wrote: post #2

Telling that the summary advice is “change the default password”, even if some of the other ideas are deployed user involvement is near zero if not completely zero. I wonder how impactful it would be to roll out a totally read-only router, or if the necessity of updates and maintenance would generate too much headache for the user

(I'm a Googler, opinions are my own). I think this is one of the awesome things about Google Wifi (aka: OnHub). It's fully managed from a phone app (via "the cloud"), so you get the authentication tied to your gmail account. It's also based on ChromeOs (chromebook OS), and follows a similar auto-update that Chromebooks get. So you are always running the latest firmware. (There are obviously downsides to Google Wifi,…

Can you elucidate just _why_ it is necessary for a router to be managed through the cloud?

Re: Security Begins at the Home Router

#16

Post by stamps » Mon, Jul 30, 2018, 5:22 PM UTC

dsr_ wrote: post #5

I don't fear rebooting my router because it takes less than 30 seconds to do a complete cycle; TCP sessions can withstand that. It probably helps that it runs Debian stable, too, so security updates are frequent and regular.

Care to share some more information about your setup?

I'm a PFsense user currently and am always looking for ways to tinkering with my networks.

Re: Security Begins at the Home Router

#17

Post by madeuptempacct » Mon, Jul 30, 2018, 5:24 PM UTC

I don't see how 'security' is a thing when you have anything connected to wireless. If you get access to a router, you get access to everything.

Re: Security Begins at the Home Router

#18

Post by h4b4n3r0 » Mon, Jul 30, 2018, 5:26 PM UTC

Just install OPNSense (or its less modern forebear: PFSense). It works great, has a ton of features (e.g. packet filter from FreeBSD, OpenVPN, etc, etc), and it gets security updates. I run mine in a VM, with the WAN adapter passed through to it to make it unavailable to the host.

Re: Security Begins at the Home Router

#19

Post by kyrra » Mon, Jul 30, 2018, 5:35 PM UTC

billions wrote: post #10

kyrra wrote: post #6

Earlier quoted context omitted.

(I'm a Googler, opinions are my own). I think this is one of the awesome things about Google Wifi (aka: OnHub). It's fully managed from a phone app (via "the cloud"), so you get the authentication tied to your gmail account. It's also based on ChromeOs (chromebook OS), and follows a similar auto-update that Chromebooks get. So you are always running the latest firmware. (There are obviously downsides to Google Wifi,…

While your points are valid, it is a bit disconcerting to have the world's largest data monetizer watch all of a home's traffic. Google's promised benevolence may be temporary

One nice thing with Google WiFi being based on CROS, is that it's mostly open source (about the same level as Android, where there are some binary blob board support packages). With that, there is custom firmware you can load know Google Wifis: https://github.com/marcosscriven/galeforce

As an aside, you can read the Google WiFi privacy details here: https://support.google.com/wifi/answer/6246642?hl=en

Re: Security Begins at the Home Router

#20

Post by StudentStuff » Mon, Jul 30, 2018, 5:40 PM UTC

stamps wrote: post #16

dsr_ wrote: post #5

I don't fear rebooting my router because it takes less than 30 seconds to do a complete cycle; TCP sessions can withstand that. It probably helps that it runs Debian stable, too, so security updates are frequent and regular.

Care to share some more information about your setup? I'm a PFsense user currently and am always looking for ways to tinkering with my networks.

PFSense was the bane of my existence for a time, I regret ever installing it in the handful of businesses I put it in. When it'd fall over (usually from the 2nd WAN port disappearing after a reboot), I'd have to drive out and swap in another router while debugging it. Minor, custom changes to prevent PFSense from blocking boot due to a USB ethernet interface disappearing? Overwritten on upgrade without warning.

They also have recently made it a PITA to use PFSense with IPTV, as UDP Multicast forwarding has been deprecated w/o warning. Like everything with PFSense, it just disappeared one update without so much as a warning :P

I have a friend who uses Debian as his core router, its not bad. I've gone to OpenWRT since its got the fit and finish, plus it will boot and be debugable no matter what happens.