Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Begins at the Home Router

insights.sei.cmu.edu

Post reply on HN
Print view View original

161–170 of 177 posts

Re: Security Begins at the Home Router

#161

Post by Fnoord »

Mister_Snuggles wrote: post #8
noja wrote: post #3

Earlier quoted context omitted.

Print the randomly generated password on a sticker on the router. Problem solved.

This is what my ISP does for their router/cable modem combo. There's a sticker that tells you the SSID, the password for the SSID, the URL for the web interface along with the user ID and password. The passwords are both randomly generated. They will also put it into bridge mode for you where none of that stuff applies.

Yeah, mine as well, until recently they figured out that the passwords weren't so randomly generated as they were derived from the SSID. Great entropy...

I recommend to use a mnemonic password [1] and just print out the WiFi password (without using Google Cloud...) and use some adhesive tape to attach it on the bottom of the router. The downside is that someone who has physical access to the router can see the password within seconds. Someone's who's plumbing your drain or when you are on the toilet.

That they put it into bridge mode when you request is due to EU regulations where EU civilians have free choice of router.

[1] https://xkpasswd.net

Re: Security Begins at the Home Router

#163

Post by fghtr »

firefistace77 wrote: post #36

I'll take this opportunity to ask the community, what is a recommend router? It's going to be me and my roommate only (with friends and family over) and I would like to get something secure and also reliable (and preferably on the cheaper side) Any suggestions? I believe we have Cox if that is any factor....

I would recommend an FSF-certified ThinkPenguin router that respects your freedom:

https://www.fsf.org/resources/hw/endorsement/thinkpenguin

Re: Security Begins at the Home Router

#164

Post by deno »

h4b4n3r0 wrote: post #115
auslander wrote: post #110

Earlier quoted context omitted.

Second OPNsense. And there are nice fanless x86 mini PCs, router size on aliexpress

I don't know why technical people bother with anything else these days, TBH. You don't even need a separate server for it: just use a separate network card in an existing machine. And even if one decides to buy a separate machine, it's still much cheaper than a router with comparable capabilities. And the existing router can often be reused as a dumb access point. It's a no-brainer.

> You don't even need a separate server for it: just use a separate network card in an existing machine.

Because you want internal network to keep working when you do server maintenance.

Re: Security Begins at the Home Router

#165

Post by wtallis »

walrus01 wrote: post #151
wtallis wrote: post #125

Earlier quoted context omitted.

> Have no wifi functions in your router!!! Separating the ISP-controlled modem from the router is certainly good advice, but I can't see any strong reason to recommend separating the AP from the router. If you know your AP needs to be located far from the router in order to provide decent coverage, then it makes sense. Otherwise, there's no technological or economic justification for putting three exclamation marks o…

The Venn diagram overlap of routers that have serious admin features and routers that have wifi built in is not very large. Separating the wifi allows you to replace or change wifi without bringing down services to local hardwired home servers.

What do you mean by "serious admin features" for a router? They run Linux and any third-party firmware will give you ssh access. What's missing? And swapping out WiFi radios is something that you only need to do once every few years, so it's nothing that should weigh on the decision about what to use in the meantime—especially since new APs can be added to the network without requiring you to physically decommission the WiFi capabilities of your primary router.

Re: Security Begins at the Home Router

#166

Post by auslander »

auslander wrote: post #110
h4b4n3r0 wrote: post #18

Just install OPNSense (or its less modern forebear: PFSense). It works great, has a ton of features (e.g. packet filter from FreeBSD, OpenVPN, etc, etc), and it gets security updates. I run mine in a VM, with the WAN adapter passed through to it to make it unavailable to the host.

Second OPNsense. And there are nice fanless x86 mini PCs, router size on aliexpress

check Partaker B5, for example

Re: Security Begins at the Home Router

#167

Post by ozim »

deno wrote: post #157
ateesdalejr wrote: post #56

Earlier quoted context omitted.

Only reason I would be concerned about using that specific generator in particular would be the fact that it severely limits your passwords to the "kid-friendly" set.

That’s the only reason? And the fact that it’s exclusively online?

If you have to create pw you want use one time and tell it to someone over the phone or use it for "Guest WiFi" network, I don't see why I got downvoted.

It is not like I am going to use it for my main email account.

Re: Security Begins at the Home Router

#168

Post by inetknght »

Yizahi wrote: post #150
inetknght wrote: post #93

Earlier quoted context omitted.

If you start making my router autoupdate and autoreboot like Windows does you will alienate a very large number of customers. Instead: stop making shit routers.

Unlike with Windows I seriously doubt that. Windows reboot is unpredictable and a) can break your work flow and b) can possible corrupt your unsaved data, calculations etc. Router reboot is simply a network outage for 2-3 minutes and routers that can do auto-update also always support configuration it. E.g. Reboot at 3am in the night, only on Monday and only if there had been new firmware in the last week. I can assu…

You assume updating the router firmware won't break or reset your configuration, and won't add new vulnerabilities you haven't already mitigated.

Re: Security Begins at the Home Router

#169

Post by j45 »

briandear wrote: post #33
j45 wrote: post #11

Earlier quoted context omitted.

A larger information label specific to each device could be printed to minimize those questions. "START HERE" followed by steps. Communication and comprehension is always a key battle of onboarding.

Or something similar such as the way the HomePod setup process works.

Definitely. If there was an open onboarding standard or framework for tech that was slowly adopted like Bluetooth it would go a long way.

Re: Security Begins at the Home Router

#170

Post by vel0city »

flukus wrote: post #152
wtallis wrote: post #133

Earlier quoted context omitted.

> hardware I know works with local ISP's Your ISP is irrelevant, unless you're shopping for an integrated modem+router. Rule number 1 is don't do that , and keep your modem separate and just a modem. Then your router only needs the universal standard Ethernet port as its WAN interface, and at worst you might have to configure PPPoE instead of just using DHCP to get your public IP.

> Rule number 1 is don't do that, and keep your modem separate and just a modem I think I'm going to have to go down this path, I was just hoping to avoid it. It means having another device to configure, another set of blinking lights, another weird shaped plug to try and squeeze into the power board and learning whatever PPPoE is just to transform Ethernet packets into the ADSL equivalent. It also possibly means a m…

Most modems do not usually have much to configure if anything at all. Most management pages for these devices will have line quality metrics and other network debugging tools and have zero user configurable settings. PPPoE settings are usually all configured by the router/gateway.
Post reply on HN