3 ms·
Just checked my TP Link router, it uses http in the house, I'm fine with it. the web page can default to http, then on the top of that page advise users to cho
by ausjke 6y ago
Just checked my TP Link router, it uses http in the house, I'm fine with it.
the web page can default to http, then on the top of that page advise users to choose https-with-browsering-warnings (provide a link for that for immediate use) that is safer for local use. the default still be http.
most of the routers are wireless with wpa2-psk which is encrypted. If someone knows how to use the shared-psk to decrypt http traffic and you need defend that, you already know you should use the https option.
- jeroenhd 6y agoWhile cracking WPA2 isn't trivial, it's not hard to redirect network traffic once you've managed to get in. Whether it's through abusing a flaw in the router's WPS functionality or plain old brute force, it's not impossible for an attacker to get into your network. From there a simple flood of ARP packets will allow the attacker to take over your network traffic and listen in on any unencrypted traffic, using the router admin password as an escalation within the network infrastructure. Of course, such an attack is unrealistic in a home network scenario. It doesn't matter, because most consumer routers probably contain some unauthenticated RCE or authentication bypass anyway. Consumer routers aren't the most secure products and nearly every time a security researcher starts digging into their firmware, something spectacular comes out of it.