51–60 of 134 posts
My ISP never gave me a router. Just an Ethernet cable coming into my apartment :)
Another cool thing about WiFi routers is that you can use them as radars to monitor people in a home. The 2.4ghz frequency is perfect for reflecting off water bodies while having great penetration through walls.
That router looks like its control panel is hosted on an external server. Router control panels usually show what devices are connected. So for router control panel functionality, they need to have the router report all connected devices to the server. Obviously they should be doing this encrypted, not unecrypted. But ignoring encryption, this is the price you pay for cloud management: the could knows your data.
Remember, the TR-069 traffic starts at your device, and terminates at their end, it's not making it out onto the public internet, it's entirely within the ISP network. That's not to say it still shouldn't be encrypted, but with a FTTH connection using a PON network there's already physical layer encryption going on typically, otherwise a custom configured ONT could snoop on other peoples traffic on the same segment.
What if technical support is outsourced to a call-center in India?
Earlier quoted context omitted.
You're just paying some extra third-party that handles all your traffic now. What's to prevent them from doing the same? You're moving trust to another actor.
It's easy to move your VPN to an arbitrary VPS anywhere in the world, but there's only a handful of residential ISPs available in any given area, and they are almost univerally scummy.
Where I live the nationwide fiber network has around 100 ISPs available of varying reputation.
Wikipedia says that PPPoE "offers encryption" but now I'm curious if this is effective, and actually used by anyone...
Earlier quoted context omitted.
You're just paying some extra third-party that handles all your traffic now. What's to prevent them from doing the same? You're moving trust to another actor.
Personally I very much agree that using a vpn service for all your traffic is probably not a good idea. As well as other objections, some have been confirmed to sell fine grain traffic information, and may have an easier time justifying that as it is arguably anonymised. That said, if you set up your own vpn on a digital ocean node, moving your network boundary to the datacentre, then the cloud hosting companies netw…
That's probably the issue. A general purpose machine (with AES-NI), slap OpenBSD on it, disable DHCP server on your ISP router, let OpenBSD handle that... and done! (not for the faint of heart though)
You might even add a NIC to it, and act as another physical hop for firewalling, etc.
I don't know if it's true, but I've heard that some ISPs route your entire traffic through their machines. They even have access to your IP packets. Very shady!
ISP's intercepting HTTP traffic to modify it is far from unheard of. In the best case, this is to notify customers of required changes. This is actually used by comcast [1]. In the worst case, this is a service sold to advertisers, or a service that includes arbitrary java-script injection. For something close to the worst case, see [2] (previously discussed on HN [3]). [1] https://tools.ietf.org/html/rfc6108 [2] htt…
That router looks like its control panel is hosted on an external server. Router control panels usually show what devices are connected. So for router control panel functionality, they need to have the router report all connected devices to the server. Obviously they should be doing this encrypted, not unecrypted. But ignoring encryption, this is the price you pay for cloud management: the could knows your data.
Remember, the TR-069 traffic starts at your device, and terminates at their end, it's not making it out onto the public internet, it's entirely within the ISP network. That's not to say it still shouldn't be encrypted, but with a FTTH connection using a PON network there's already physical layer encryption going on typically, otherwise a custom configured ONT could snoop on other peoples traffic on the same segment.
Why would an ISP care about that?
I've been forwarding all outgoing connections on port 80 (and a selection of other commonly-unencrypted ports) through a VPN (in the router) for a while now - but leaving all other ports (including most importantly 443) connecting directly. It feels like a good compromise between privacy and speed. (I realise this is not the subject of the article exactly but I figured it's a related issue.)
I've been forwarding all outgoing connections on port 80 (and a selection of other commonly-unencrypted ports) through a VPN (in the router) for a while now - but leaving all other ports (including most importantly 443) connecting directly. It feels like a good compromise between privacy and speed. (I realise this is not the subject of the article exactly but I figured it's a related issue.)
Why do you feel that way? VPNs are vastly more likely to actually read your traffic than any ISP.
I've been forwarding all outgoing connections on port 80 (and a selection of other commonly-unencrypted ports) through a VPN (in the router) for a while now - but leaving all other ports (including most importantly 443) connecting directly. It feels like a good compromise between privacy and speed. (I realise this is not the subject of the article exactly but I figured it's a related issue.)
Why do you feel that way? VPNs are vastly more likely to actually read your traffic than any ISP.
There are good and bad VPNs but ISPs are much larger corporations with direct ties to governments. I fail to see how a good VPN is worse than ISP + Governments.