4 ms·

> these routers are secure. Owner of a C7 v4 here. There has not been a firmware update from TP-Link since December 2019 (note that v4 is the second-most recen

by cafxx 5y ago

> these routers are secure. Owner of a C7 v4 here. There has not been a firmware update from TP-Link since December 2019 (note that v4 is the second-most recent HW revision). No way these are not affected by at least some CVE somewhere in their stack. Calling them secure is a leap of faith that TP-Link does not deserve. I recently flashed openwrt exactly to be able to be on a more recent stack. I would never dream exposing that UI to the Internet as-is. They don't even have any form of brute forcing protection. If they really needed access to the router remotely, it would be much saner to expose an SSH server with pubkey-only access or VPN, both with brute forcing protection, and allow tunnelling to the router UI only from the LAN side. Either who set those up really has nothing to lose if they get owned, or they do not know what they are doing. In both cases, it does not qualify as being a secure setup. (Sure, they may also be honeypots - in which case your argument was incorrect anyway, as they are secure, but they are not routers)

kralos 5y ago
> If they really needed access to the router remotely, it would be much saner to expose an SSH server with pubkey-only access or VPN, both with brute forcing protection, and allow tunnelling to the router UI only from the LAN side. any chance you can explain that to my mum?
- yipbub 5y ago
  > it would be much saner to expose an SSH server with pubkey-only access or VPN It would be safer to leave open to the public only a secure protocol based on strong cryptographic keys instead of a password. Or you have to be signed in to a VPN to see the page. > brute forcing protection Try too many passwords? Try again in 1 minute. Again? 30 minutes > allow tunnelling to the router UI only from the LAN side I think this one means don't expose it to the internet at all. Just from your local network. >
- msh 5y ago
  Your mom probably don’t need wan access to her router.
input_sh 5y ago
Same model, but the interface showed build 20180316 as "up to date", and when I've tried manually downloading the 2019 build it showed "invalid type". Swapped it with DD-wrt not long ago (DD-wrt support was why I've decided on this model, but I was too lazy to do that before).

by cafxx 5y ago

kralos 5y ago

> If they really needed access to the router remotely, it would be much saner to expose an SSH server with pubkey-only access or VPN, both with brute forcing protection, and allow tunnelling to the router UI only from the LAN side. any chance you can explain that to my mum?

yipbub 5y ago
> it would be much saner to expose an SSH server with pubkey-only access or VPN It would be safer to leave open to the public only a secure protocol based on strong cryptographic keys instead of a password. Or you have to be signed in to a VPN to see the page. > brute forcing protection Try too many passwords? Try again in 1 minute. Again? 30 minutes > allow tunnelling to the router UI only from the LAN side I think this one means don't expose it to the internet at all. Just from your local network. >
msh 5y ago
Your mom probably don’t need wan access to her router.

input_sh 5y ago

Same model, but the interface showed build 20180316 as "up to date", and when I've tried manually downloading the 2019 build it showed "invalid type". Swapped it with DD-wrt not long ago (DD-wrt support was why I've decided on this model, but I was too lazy to do that before).