4 ms·

Let me grab this occasion to ask: WTF is going on in general? I readily presume most people have a wifi router with these iot devices and while obviously those

by chx 10y ago

Let me grab this occasion to ask: WTF is going on in general? I readily presume most people have a wifi router with these iot devices and while obviously those are not the best security wise (I presume again most don't run pfsense or openwrt) but still they are there, NATting away happily. How would a baby monitor appear on the open web...? I can't imagine the average user setting them up in DMZ or port forward or ... what is happening here? I am obviously missing some primarily home networking oriented protocol probably because I am configuring my own routers and I am simply unaware of some feature of the factory firmware that allows traffic inwards.

userbinator 10y ago
I don't use those products, but I can imagine many of them automatically doing port forwards (https://en.wikipedia.org/wiki/Universal_Plug_and_Play#NAT_traversal https://en.wikipedia.org/wiki/Universal_Plug_and_Play#NAT_tr... ) and possibly even automatically registering in a dynamic DNS service, all for the "convenience" of the "I don't know what a port is and I don't want to know" user.
- chx 10y ago
  > Many routers and firewalls expose themselves as Internet Gateway Devices, allowing any local UPnP control point to perform a variety of actions, including retrieving the external IP address of the device, enumerate existing port mappings, and add or remove port mappings. Are you bloody kidding me? Why do you even have a firewall, rudimentary as it is, then?
  - geococcyxc 10y ago
    Not all home routers are allowing this by default. I don't have any hard numbers to offer, but my feeling is that only very old and today's very crappy ones do.
  - closeparen 10y ago
    UPnP comes from the view that NAT is an unfortunate artifact of residential ISPs only giving out one IPv4 address per household, not a crucial security strategy. If you really think of your NATing router as a security device, turn off UPnP. Though I'm not sure how much good that will do, as any device can still phone home or reverse tunnel.
    - chx 10y ago
      Sure but port scanning and forming a massive botnet is impossible if they are not even capable of listening on an open port which NAT gives you for free. It's like the lemonade you could make when life you gives you lemons. Except now it's spoiled too.
      - closeparen 10y ago
        On the other hand, UPnP is the only currently viable strategy for average people to run devices on their home networks and control them from the internet without looping in a third party server.

by chx 10y ago

userbinator 10y ago

I don't use those products, but I can imagine many of them automatically doing port forwards (https://en.wikipedia.org/wiki/Universal_Plug_and_Play#NAT_traversal https://en.wikipedia.org/wiki/Universal_Plug_and_Play#NAT_tr... ) and possibly even automatically registering in a dynamic DNS service, all for the "convenience" of the "I don't know what a port is and I don't want to know" user.

chx 10y ago
> Many routers and firewalls expose themselves as Internet Gateway Devices, allowing any local UPnP control point to perform a variety of actions, including retrieving the external IP address of the device, enumerate existing port mappings, and add or remove port mappings. Are you bloody kidding me? Why do you even have a firewall, rudimentary as it is, then?
- geococcyxc 10y ago
  Not all home routers are allowing this by default. I don't have any hard numbers to offer, but my feeling is that only very old and today's very crappy ones do.
- closeparen 10y ago
  UPnP comes from the view that NAT is an unfortunate artifact of residential ISPs only giving out one IPv4 address per household, not a crucial security strategy. If you really think of your NATing router as a security device, turn off UPnP. Though I'm not sure how much good that will do, as any device can still phone home or reverse tunnel.
  - chx 10y ago
    Sure but port scanning and forming a massive botnet is impossible if they are not even capable of listening on an open port which NAT gives you for free. It's like the lemonade you could make when life you gives you lemons. Except now it's spoiled too.
    - closeparen 10y ago
      On the other hand, UPnP is the only currently viable strategy for average people to run devices on their home networks and control them from the internet without looping in a third party server.