3 ms·

I think this is more the fault of manufacturers than end users. Routers should be secure by default, and it should be hard to do something that will make it in

I think this is more the fault of manufacturers than end users. Routers should be secure by default, and it should be hard to do something that will make it insecure. The router manufacturers are the supposed experts when it comes to networking, expecting every consumer to even know the risks of exposing their router admin interface to the world is not a reasonable assumption.

sathackr 5y ago
So it's the car companies fault if I crash my car? They should limit vehicle speed to 5mph so I don't hurt myself or others. I have used many of these routers. Admin access on the wan port is blocked by default and must be enabled by the user.
- solarkraft 5y ago
  Lackluster comparison (a modern consumer router should be more like a self steering car), but modern cars indeed have safety features to prevent you from crashing. Of course, both with the car and the router there are good arguments that you should be able to do the dumb thing if you know you need it. If it has to be explicitly enabled after intense warnings, the protective duty (as someone knowing better) can possibly be considered fulfilled - or you can still argue that it should be especially hard to do to block out people who don’t listen to warnings.
- Johnny555 5y ago
  Do you want to require that router users pass a government proficiency test and carry insurance to cover their liability for unsafe network use? Otherwise the analogy with driving a car is not quite complete.
- sophacles 5y ago
  You are making a very good point: the order of gear shifting was tightly regulated after a lot of accidents caused by NDLR order (instead of the now-standard PRNDL). In fact most automotive interfaces have regulations to standardize them after enough accidents were caused by people getting new cars that had different interfaces.
- kube-system 5y ago
  My car will literally hit the brakes for me if I am about to crash into something. A router marketed to a non-professional should do the same.
Alupis 5y ago
I haven't bought a consumer router in well over a decade that isn't secure by default. Universally they all prohibit accessing the router via the WAN interface, and have reasonable firewall defaults. Many these days even include a randomized unique password for every router, stuck to the side of the device with a sticker. These routers were put on the internet on purpose, by people that seem to know what they are doing (universities and businesses), and none seem to have default credentials. Seems reasonable to me.
paxys 5y ago
Is there any mainstream router brand that exposes admin pages to the internet by default?
Pxtl 5y ago
These routers are secure by default. This is only visible because users have chosen to have their routers expose their admin pages to the public internet. I have never seen a router that had its admin page visible to the WAN by default.
- whoopdedo 5y ago
  > I have never seen a router that had its admin page visible to the WAN by default. I'd wager there's a non-zero percentage of routers which have the modem (or ISP router) plugged into a LAN port.
deleted 5y ago
[deleted]

sathackr 5y ago

So it's the car companies fault if I crash my car? They should limit vehicle speed to 5mph so I don't hurt myself or others. I have used many of these routers. Admin access on the wan port is blocked by default and must be enabled by the user.

solarkraft 5y ago
Lackluster comparison (a modern consumer router should be more like a self steering car), but modern cars indeed have safety features to prevent you from crashing. Of course, both with the car and the router there are good arguments that you should be able to do the dumb thing if you know you need it. If it has to be explicitly enabled after intense warnings, the protective duty (as someone knowing better) can possibly be considered fulfilled - or you can still argue that it should be especially hard to do to block out people who don’t listen to warnings.
Johnny555 5y ago
Do you want to require that router users pass a government proficiency test and carry insurance to cover their liability for unsafe network use? Otherwise the analogy with driving a car is not quite complete.
sophacles 5y ago
You are making a very good point: the order of gear shifting was tightly regulated after a lot of accidents caused by NDLR order (instead of the now-standard PRNDL). In fact most automotive interfaces have regulations to standardize them after enough accidents were caused by people getting new cars that had different interfaces.
kube-system 5y ago
My car will literally hit the brakes for me if I am about to crash into something. A router marketed to a non-professional should do the same.

Alupis 5y ago

I haven't bought a consumer router in well over a decade that isn't secure by default. Universally they all prohibit accessing the router via the WAN interface, and have reasonable firewall defaults. Many these days even include a randomized unique password for every router, stuck to the side of the device with a sticker. These routers were put on the internet on purpose, by people that seem to know what they are doing (universities and businesses), and none seem to have default credentials. Seems reasonable to me.

paxys 5y ago

Is there any mainstream router brand that exposes admin pages to the internet by default?

Pxtl 5y ago

These routers are secure by default. This is only visible because users have chosen to have their routers expose their admin pages to the public internet. I have never seen a router that had its admin page visible to the WAN by default.

whoopdedo 5y ago
> I have never seen a router that had its admin page visible to the WAN by default. I'd wager there's a non-zero percentage of routers which have the modem (or ISP router) plugged into a LAN port.

deleted 5y ago

[deleted]