4 ms·

Time for a new roommate.

by Jeremy1026 8y ago

Filligree 8y ago
Yes, this one is malfunctioning.
- kazen44 8y ago
  or time for proper network security? port-security and disabling unused ports works great in these cases, especially if you are the sole user of the network.
  - ghaff 8y ago
    I dunno. Locking down some things may make sense. But, for the most part, assuming that physical security for your wired home network is sufficient doesn't seem like an unreasonable assumption combined with standard practices for your systems.
  - joshumax 8y ago
    Still, network security is extremely hard when the actor has physical access to your networking hardware. I currently live in a dorm situation and put each roommate on their own separate vlan on their own separate wireless gateway behind an f5 firewall running snort and I'd still be at risk if one of my roommates decided to put something between my gateway and the router.
  - SolarNet 8y ago
    Roommates have physical access to the network. Principles of security tell us you can't defend against that. Need to change the network.
  - z3t4 8y ago
    Everything is using port 443 now a days. Yes also malware. You would need a host whitelist.
  - walshemj 8y ago
    Not much good against insider / roommate threat
  - megous 8y ago
    I like some cryptographical guarantees, so my trusted devices get to be on a overlay WireGuard based VPN, and the access from actual ethernet/LAN gets blocked. VPN still uses IP/port blocking, but thanks to WireGuard, you can be sure that source IP really matches the device you think it does.
paultopia 8y ago
For serious. the kind of idiot who would hand over facebook credentials, bank account info, and physical network access for fifteen bucks a month to a total rando is also the kind of idiot who will dig up their roommate's social security card to help them out when the nice person from the IRS calls about back taxes.
- dingaling 8y ago
  I'd quite happily pimp out my unused fake Facebook profile for $15. Lock the 'device' into its own subnetted VLAN so it can't see any local traffic and it's easy money paid into a deposit-only savings account...
  - SmellyGeekBoy 8y ago
    How do you know that your router doesn't have a 0day that allows them to escape the VLAN?

Time for a new roommate.

Filligree 8y ago

Yes, this one is malfunctioning.

kazen44 8y ago
or time for proper network security? port-security and disabling unused ports works great in these cases, especially if you are the sole user of the network.
- ghaff 8y ago
  I dunno. Locking down some things may make sense. But, for the most part, assuming that physical security for your wired home network is sufficient doesn't seem like an unreasonable assumption combined with standard practices for your systems.
- joshumax 8y ago
  Still, network security is extremely hard when the actor has physical access to your networking hardware. I currently live in a dorm situation and put each roommate on their own separate vlan on their own separate wireless gateway behind an f5 firewall running snort and I'd still be at risk if one of my roommates decided to put something between my gateway and the router.
- SolarNet 8y ago
  Roommates have physical access to the network. Principles of security tell us you can't defend against that. Need to change the network.
- z3t4 8y ago
  Everything is using port 443 now a days. Yes also malware. You would need a host whitelist.
- walshemj 8y ago
  Not much good against insider / roommate threat
- megous 8y ago
  I like some cryptographical guarantees, so my trusted devices get to be on a overlay WireGuard based VPN, and the access from actual ethernet/LAN gets blocked. VPN still uses IP/port blocking, but thanks to WireGuard, you can be sure that source IP really matches the device you think it does.

paultopia 8y ago

For serious. the kind of idiot who would hand over facebook credentials, bank account info, and physical network access for fifteen bucks a month to a total rando is also the kind of idiot who will dig up their roommate's social security card to help them out when the nice person from the IRS calls about back taxes.

dingaling 8y ago
I'd quite happily pimp out my unused fake Facebook profile for $15. Lock the 'device' into its own subnetted VLAN so it can't see any local traffic and it's easy money paid into a deposit-only savings account...
- SmellyGeekBoy 8y ago
  How do you know that your router doesn't have a 0day that allows them to escape the VLAN?