5 ms·

It's funny to think that if you were to report all of your findings to your local newspaper (Turkish newspaper in this case), as to how Turkish ISPs have comple

It's funny to think that if you were to report all of your findings to your local newspaper (Turkish newspaper in this case), as to how Turkish ISPs have complete access to your router or how Huawei (China) has an SSH key for your router, people would go absolutely ballistic. But for us it's just another day of expected craziness and we're tired of talking about it

kuesji 7y ago
i don't think too many people care about this. ( yes, i live in turkey )
p1esk 7y ago
Yeah, no one cares outside of hackernews.
- blaser-waffle 7y ago
  Hell, I'd imagine my grandmother or other non-tech family would be glad the telephone company can pop in and fix it
kspacewalk2 7y ago
Turkish newspapers are almost universally subservient to the autocratic government. Any free press that's still somehow around has way more consequential dictatorial abuses of power to report on, if they dare.
Someone1234 7y ago
> how Turkish ISPs have complete access to your router You think it is going to blow people's socks off that a router provided and controlled by an ISP is accessible by that same ISP? Huh? The Huawei SSH key is a little strange, but depressingly common for network equipment, even big names like Cisco[0]. [0] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-nexus9k-sshkey https://tools.cisco.com/security/center/content/CiscoSecurit...
- gumby 7y ago
  > The Huawei SSH key is a little strange, but depressingly common for network equipment, even big names like Cisco... There’s an understandable reason for this: the isp’s staff aren’t necessarily any more competent than the isp’s customers (some are, but there are so many ISPs that I suspect they are now a small minority). So just at the isp wants to be able to reset your interface devices remotely, so will Huawei and Cisco support for the ISPs themselves. I am not implying that “understandable” means “justified”
- Eremotherium 7y ago
  >even big names like Cisco Even? By now Cisco having hardcoded credentials and glaring security fuckups is a meme.
TheSpiceIsLife 7y ago
> if you were to report all of your findings to your local newspaper ... people would go absolutely ballistic. You reckon? I don’t think they’d even be interested in hearing about it. Where do you live and who is your local paper that leads you to believe they’d bother writing, let alone publishing, such a story?
Thaxll 7y ago
If that stuff listen to the interface of your public IP which is most likely not the case, but yes it's still scary.
closeparen 7y ago
CPE is just part of the ISP's infrastructure that happens to be in your house. There is no need to trust it. Just put your own router in front of it.
- hazeii 7y ago
  Indeed, I've had a linux box between the router and the local network since the days of dial-up (originally it was the dial-up box, which made and shared the 'net connection). The only reason I've ever had to upgrade the hardware has been because the original setup only had 10MBps NICs.
0xff00ffee 7y ago
I'm pretty sure my new CenturyLInk fiber router is similar. I tried to create a PPoE connection from my WRT1900 direclty to century link using the same credentials and I couldn't connect to my internet. However, now I am motivated to create a bridge and find out why. For CenturyLink fiber I have two boxes: Box A: the exterior fiber enters this box, the tech said it was a "translator"; and the port 4 ethernet on it goes to ... Box B: the centurylink wireless router, which performs the PPoE with my credentials which were somehow hardwired because no one ever told me my username/password. I'm guesing TR-069? Then port 4 on this goes to ... Box C: MY WRT1900AC, which then goes to other subnets for my cameras, lab, and office. I figured Box B was redundant, but trying to remove it has been problematic.
- tenebrisalietum 7y ago
  B probably exists so they can split fiber between multiple end users or support things like phone service over the same link. Did you use the same VPI and VCI? PPPoE also sends an identifier (the "Host-Uniq" tag if I'm understanding it right) that probably has to match what your ISP is expecting or has assigned.
- Tourus 7y ago
  > PPoE with my credentials which were somehow hardwired because no one ever told me my username/password They make it very hard to use your own "Box B", but I've set this up twice now (most recently last week). Get the username and password from CenturyLink (the tech that installs the service has this, or call them). Then, google search "century link vlan 201 wan tag". The trick is you need a router that has this functionality, most basic consumer ones don't. Unfortunately, even if you follow all directions and it still doesn't work troubleshooting is a nightmare, very little or no help from their customer support.
  - 0xff00ffee 7y ago
    Ah I see. My WRT1900AC doesn't have that option. I was running OpenWRT but ran into some issues and panicked back to the default firmware. Now that I have another wireless router I might dare it again.

kuesji 7y ago

i don't think too many people care about this. ( yes, i live in turkey )

p1esk 7y ago

Yeah, no one cares outside of hackernews.

blaser-waffle 7y ago
Hell, I'd imagine my grandmother or other non-tech family would be glad the telephone company can pop in and fix it

kspacewalk2 7y ago

Turkish newspapers are almost universally subservient to the autocratic government. Any free press that's still somehow around has way more consequential dictatorial abuses of power to report on, if they dare.

Someone1234 7y ago

> how Turkish ISPs have complete access to your router You think it is going to blow people's socks off that a router provided and controlled by an ISP is accessible by that same ISP? Huh? The Huawei SSH key is a little strange, but depressingly common for network equipment, even big names like Cisco[0]. [0] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-nexus9k-sshkey https://tools.cisco.com/security/center/content/CiscoSecurit...

gumby 7y ago
> The Huawei SSH key is a little strange, but depressingly common for network equipment, even big names like Cisco... There’s an understandable reason for this: the isp’s staff aren’t necessarily any more competent than the isp’s customers (some are, but there are so many ISPs that I suspect they are now a small minority). So just at the isp wants to be able to reset your interface devices remotely, so will Huawei and Cisco support for the ISPs themselves. I am not implying that “understandable” means “justified”
Eremotherium 7y ago
>even big names like Cisco Even? By now Cisco having hardcoded credentials and glaring security fuckups is a meme.

TheSpiceIsLife 7y ago

> if you were to report all of your findings to your local newspaper ... people would go absolutely ballistic. You reckon? I don’t think they’d even be interested in hearing about it. Where do you live and who is your local paper that leads you to believe they’d bother writing, let alone publishing, such a story?

Thaxll 7y ago

If that stuff listen to the interface of your public IP which is most likely not the case, but yes it's still scary.

closeparen 7y ago

CPE is just part of the ISP's infrastructure that happens to be in your house. There is no need to trust it. Just put your own router in front of it.

hazeii 7y ago
Indeed, I've had a linux box between the router and the local network since the days of dial-up (originally it was the dial-up box, which made and shared the 'net connection). The only reason I've ever had to upgrade the hardware has been because the original setup only had 10MBps NICs.

0xff00ffee 7y ago

I'm pretty sure my new CenturyLInk fiber router is similar. I tried to create a PPoE connection from my WRT1900 direclty to century link using the same credentials and I couldn't connect to my internet. However, now I am motivated to create a bridge and find out why. For CenturyLink fiber I have two boxes: Box A: the exterior fiber enters this box, the tech said it was a "translator"; and the port 4 ethernet on it goes to ... Box B: the centurylink wireless router, which performs the PPoE with my credentials which were somehow hardwired because no one ever told me my username/password. I'm guesing TR-069? Then port 4 on this goes to ... Box C: MY WRT1900AC, which then goes to other subnets for my cameras, lab, and office. I figured Box B was redundant, but trying to remove it has been problematic.

tenebrisalietum 7y ago
B probably exists so they can split fiber between multiple end users or support things like phone service over the same link. Did you use the same VPI and VCI? PPPoE also sends an identifier (the "Host-Uniq" tag if I'm understanding it right) that probably has to match what your ISP is expecting or has assigned.
Tourus 7y ago
> PPoE with my credentials which were somehow hardwired because no one ever told me my username/password They make it very hard to use your own "Box B", but I've set this up twice now (most recently last week). Get the username and password from CenturyLink (the tech that installs the service has this, or call them). Then, google search "century link vlan 201 wan tag". The trick is you need a router that has this functionality, most basic consumer ones don't. Unfortunately, even if you follow all directions and it still doesn't work troubleshooting is a nightmare, very little or no help from their customer support.
- 0xff00ffee 7y ago
  Ah I see. My WRT1900AC doesn't have that option. I was running OpenWRT but ran into some issues and panicked back to the default firmware. Now that I have another wireless router I might dare it again.