5 ms·

There's that nagging feeling that they're not concerned about security but banning anything that works well, is inexpensive and isn't made by an US company...

There's that nagging feeling that they're not concerned about security but banning anything that works well, is inexpensive and isn't made by an US company... Anecdote: once I bought the cheapest router I could find online. The idea was to test connecting to a crap AP. Unfortunately the cheapest was a TP-Link and it worked absolutely perfectly, ruining my test plan.

tiahura 2y ago
That doesn’t seem likely. Are there really US companies clamoring to make 0 margin disposable electronics?
- bluGill 2y ago
  The margin is not 0. there is a lot of $$$ in low margin disposable products (think toilet paper). However it takes great management to make money building such things and few companies are that good.
rekabis 2y ago
Their firmware is absolutely riddled with flaws and exploitable vulnerabilities. Unless you are willing to re-flash their hardware with third-party firmware such as DD-WRT or OpenWRT, I would always encourage anyone to go with a company that keeps their firmware up to date, like Ubiquity. It’s not their hardware. It’s their firmware which is the problem.
- nottorp 2y ago
  Ubiquity has already attempted to make their customers dependent on the "cloud" once. I believe there was some pushback and they just made it annoying to not use their online services, but I'd still like to know what they need my personal data for...
  - buildbot 2y ago
    According to their privacy policy, they don’t collect or sell anything (besides the standard we run a website stuff). The nefarious, evil purpose of the cloud service is…just lock in. And being easy to configure.
- ryanianian 2y ago
  For anyone curious about the vulnerabilities, this Ars article from November 2024 is a good read: https://arstechnica.com/information-technology/2024/11/microsoft-warns-of-8000-strong-botnet-used-in-password-spraying-attacks/ https://arstechnica.com/information-technology/2024/11/micro...
- moduspol 2y ago
  Perhaps the ban / tariff / regulation should be applied to companies making networking hardware that's riddled with flaws and exploitable vulnerabilities, rather than by naming specific companies or countries of origin.
  - rekabis 2y ago
    I would be fully open to the FTC/CRTC or whatever network/ISP regulator that exists in your country be the determiner of what should be exposed to world+dog. Let them do remote vulnerability scans once a day on all IP addresses assigned to domestic ISPs or locations physically in-country, then flag the IPs that have vulnerable routers. From there, they can force ISPs to contact their clients to demand the issue be resolved. If the client does not respond to the ISP, the ISP is forced to suspend the connection until the client can demonstrate a fix has been implemented. In all cases, that vulnerability vanishing has the ISP updated so the client is no longer in danger of being pestered. If the product is still being sold in stores, or is not very far past EoL, and there is no manufacturer patch available, those manufacturers must take their hardware back for a 100% MSRP refund, or provide an equivalent router without those exploits. It’s only if the product has been no longer manufactured for a minimum set period of time - say, 7 years - that it is deemed “too far past EoL” for the responsibility for patching/replacing to fall on manufacturers, and responsibility finally falls to the consumer to replace/upgrade. In all cases, a customer can “fix” their router with third-party firmware such as OpenWRT or DD-WRT, but this also requires laws to be written that forces manufacturers to not hardware-lock their routers, and force them to meet the minimum storage/driver-availability specs these third-party firmwares need.
- hindsightbias 2y ago
  Even with the WRTs, the firmware is probably built by the manufacturer. Try finding the provenance of who wrote the source code and where they live. AFAIK, that's not possible. So you have a router built with Chinese components (all of the ones anyone here can afford) with closed and "open" firmware built by them. I bought one of those GL.inet "open" routers and the WRT packages bricked it, so I have a choice of reverting or flashing from the factory (which appears to be a link to HK). That's probably 99.99% of use cases. They're in your base and they always have been.
  - rekabis 2y ago
    > Even with the WRTs, the firmware is probably built by the manufacturer. Say you know nothing about router firmware without saying you know nothing about router firmware. OpenWRT and DD-WRT and other open-source third-party firmwares are THIRD PARTY firmwares. They have no connection with the manufacturer whatsoever.
    - hindsightbias 2y ago
      I just looked at 10 different openwrt data entries: > WikiDevi URL: https://wikidevi.wi-cat.ru/TP-LINK_Archer_C2_v3.x https://wikidevi.wi-cat.ru/TP-LINK_Archer_C2_v3.x Every one had a .ru domain. How do you know, exactly, who built it? GL.inet builds their own WRT package. It's a "feature".
      - rekabis 2y ago
        > Every one had a .ru domain. Brand-new to the Internet, are ya? Just because you cherry-pick Russian informational sites doesn’t mean that third-party firmwares have any connection to Russia whatsoever. Third-party firmwares are open-source projects, worked on by tens of thousands of volunteers from around the planet, and frequently have ZERO CONNECTION to any one hardware manufacturer. There are some collaboration efforts, when a particular manufacturer decides to adopt an open-source firmware as the exclusive firmware for their own hardware, but that simply means the hardware is fully unlocked for any third-party firmware that wants to be adapted for that hardware. These manufacturers just decided that they had no desire to f**k over the consumer by locking them into custom-made firmware. For example, I believe Turris https://www.turris.com/ https://www.turris.com/ takes a stock, latest copy of OpenWRT and makes a few tweaks to extend its capabilities for additional, server-like features.
- adamc 2y ago
  I dislike the pattern where we have to hook into their cloud.
KerrAvon 2y ago
I think I can count the number of routers assembled in the US today on zero fingers. Some TP-Links are not great -- get a first gen C7, IIRC.
- bluGill 2y ago
  I assume you are not counting hobbyist things.
deleted 2y ago
[deleted]
jdewerd 2y ago
I love cheap and reliable TP-Link routers as much as the next guy, but it's definitely also a security issue. The CCP almost certainly has a backdoor. Maybe a respectable one in the form of an undisclosed bug or the ability to lean on an update provider, but the point stands: it's absolutely a security issue and denying this is cope. Routers are going to be a bit more expensive and a bit less reliable for a while. We'll live.
- deleted 2y ago
  [deleted]
- zxcvbnm69 2y ago
  [dead]
- c22 2y ago
  Probably a better approach than the futile attempt to excise all routers with backdoors or bugs would be to continue the ongoing efforts to make network security router agnostic.
throwawaymaths 2y ago
i had the opposite experience. i got a tp link that refused to work if i didnt register it. i tried to get customer service and there were so many dark patterns in their customer service queue (fake "you have X minutes in the queue" numbers, etc) Eventually i got through to a human that said you can't run it without registering it. it did NOT say that on the box. shit like this is what the ftc should crack down on
pkaye 2y ago
I've been researching a new Wi-Fi router and heard lots of complaints that TP-Link doesn't provide many firmware updates? Is that not true? ASUS is not that much better but I do have an option of using the AsusWRT-Merlin open source alternative on their router. Another thing I've noticed is companies tend to still sell their models which are close to EOL on their website. Something needs to be done about that.
- dole 2y ago
  That's true, TP-Link isn't great about keeping their consumer product firmware secured or updated. ASUS isn't much better but when it comes to network gear, you kind of do get what you pay for. Selling models close to EOL or trying to hold hardware makers responsible for firmware security has been an issue for decades.
  - giantg2 2y ago
    Are there manufacturers that are consumer focused that are good about security and updates? Some of the ASUS models are not particularly cheap, raising the question of why not go with business oriented models.
  - throw0101c 2y ago
    > That's true, TP-Link isn't great about keeping their consumer product firmware secured or updated. ASUS isn't much better but when it comes to network gear, you kind of do get what you pay for. If this is actually the case then you should contact the FTC because Asus under an order to pay attention to security: * https://www.ftc.gov/news-events/news/press-releases/2016/07/ftc-approves-final-order-asus-privacy-case https://www.ftc.gov/news-events/news/press-releases/2016/07/... I have an Asus RT-AC68U that I bought ages ago that's still getting regular first-party firmware updates (plus the ones from Merlin). Currently using ISP-provided hardware, but given my past experience I'd definitely look at Asus as an option if I needed a new router.
    - dole 2y ago
      I have an Asus RT-AC1200, released in 2019 that hasn't had a firmware update since 2021/05 which is the reason why I bought the TP-Link. I do see Asus has a Nov 2024 firmware for that RT-AC68U on their site. As far as my TP-Link router, I think I remember it being stuck on a 2022/09 firmware until at least 2023/09, and I wound up flashing it with OpenWRT earlier this year.
kwanbix 2y ago
I am not a US citizen, nor I live there. However, I trust the Chinese goverment much less than the US one. So I get the banning if they really believe they could have a trojan horse. What I don't get is, what guarantees you that there is not a trojan jorse on any electronic device they produce?
- taco_emoji 2y ago
  This is an extremely good question that our government (I'm American) is completely disinterested in asking or answering.
- alias_neo 2y ago
  I suppose the issue is really the risk; attacks on infrastructure need to route over networks; even a completely vulnerability ridden machine isn't a risk if it isn't reachable from the net (inbound or outbound). Routers as the gateways into all sorts of networks, and they see/control all of the traffic in and out and often between devices on the network; they're a critical junction.
eightysixfour 2y ago
If the US was serious about this or TikTok, they would create security and privacy rules that applied to everyone. Instead they are targeting individual companies, which means it has little to do with security or privacy.
- giantg2 2y ago
  If they did that, it would mean the "good" spy agencies wouldn't have platforms. This is selective so they can just ban the platforms of "bad" spy agencies.
- AnarchismIsCool 2y ago
  I can't wait to see TP-Link being sold rebranded on amazon as "ANDORBEST FASTEST PRO ROUTER ACCESSPOINT CHAINSAW WEEDEATER PINEAPPLE YOGURT"
  - all2 2y ago
    This reads like my BTC wallet recovery string.
throw38484 2y ago
[flagged]
pixl97 2y ago
>There's that nagging feeling that they're not concerned about security but banning anything that works well, is inexpensive and isn't made by an US company.. Two things can hold true at the same time. A US company selling US equipment and US software can have US law enforcement agents show up and point US guns at them for non-compliance. But that in turns sets up a captive market where the US players in the market are more likely to perform collusion and raise prices.
- AnarchismIsCool 2y ago
  Non-compliance is a weird way of saying "refusal to install US backdoors"
whimsicalism 2y ago
nagging feeling? that is absolutely what is happening, unless the US is claiming there is some backdoor in chinese cars
throw0101c 2y ago
> There's that nagging feeling that they're not concerned about security but banning anything that works well, is inexpensive and isn't made by an US company... The FTC went after (Taiwan-based) Asus for security reasons: > After a public comment period, the Federal Trade Commission has approved a final order resolving the Commission’s complaint against ASUSTeK Computer, Inc., charging that critical security flaws in its routers put the home networks of hundreds of thousands of consumers at risk. * https://www.ftc.gov/news-events/news/press-releases/2016/07/ftc-approves-final-order-asus-privacy-case https://www.ftc.gov/news-events/news/press-releases/2016/07/... So 'legitimate' security concerns have been a thing in the past.
ralferoo 2y ago
Totally agree. The only line that really stood out to me in the whole article was "... has grabbed a 65% market share in the United States..."
Havoc 2y ago
These sort of bans won't affect those willing to play it fast & loose Ebay, aliexpress, reshipper, friend in europe...there is always a way
iszomer 2y ago
Banning it from the American market is one thing, enforcing the ban is another topic altogether.

tiahura 2y ago

That doesn’t seem likely. Are there really US companies clamoring to make 0 margin disposable electronics?

bluGill 2y ago
The margin is not 0. there is a lot of $$$ in low margin disposable products (think toilet paper). However it takes great management to make money building such things and few companies are that good.

rekabis 2y ago

Their firmware is absolutely riddled with flaws and exploitable vulnerabilities. Unless you are willing to re-flash their hardware with third-party firmware such as DD-WRT or OpenWRT, I would always encourage anyone to go with a company that keeps their firmware up to date, like Ubiquity. It’s not their hardware. It’s their firmware which is the problem.

nottorp 2y ago
Ubiquity has already attempted to make their customers dependent on the "cloud" once. I believe there was some pushback and they just made it annoying to not use their online services, but I'd still like to know what they need my personal data for...
- buildbot 2y ago
  According to their privacy policy, they don’t collect or sell anything (besides the standard we run a website stuff). The nefarious, evil purpose of the cloud service is…just lock in. And being easy to configure.
ryanianian 2y ago
For anyone curious about the vulnerabilities, this Ars article from November 2024 is a good read: https://arstechnica.com/information-technology/2024/11/microsoft-warns-of-8000-strong-botnet-used-in-password-spraying-attacks/ https://arstechnica.com/information-technology/2024/11/micro...
moduspol 2y ago
Perhaps the ban / tariff / regulation should be applied to companies making networking hardware that's riddled with flaws and exploitable vulnerabilities, rather than by naming specific companies or countries of origin.
- rekabis 2y ago
  I would be fully open to the FTC/CRTC or whatever network/ISP regulator that exists in your country be the determiner of what should be exposed to world+dog. Let them do remote vulnerability scans once a day on all IP addresses assigned to domestic ISPs or locations physically in-country, then flag the IPs that have vulnerable routers. From there, they can force ISPs to contact their clients to demand the issue be resolved. If the client does not respond to the ISP, the ISP is forced to suspend the connection until the client can demonstrate a fix has been implemented. In all cases, that vulnerability vanishing has the ISP updated so the client is no longer in danger of being pestered. If the product is still being sold in stores, or is not very far past EoL, and there is no manufacturer patch available, those manufacturers must take their hardware back for a 100% MSRP refund, or provide an equivalent router without those exploits. It’s only if the product has been no longer manufactured for a minimum set period of time - say, 7 years - that it is deemed “too far past EoL” for the responsibility for patching/replacing to fall on manufacturers, and responsibility finally falls to the consumer to replace/upgrade. In all cases, a customer can “fix” their router with third-party firmware such as OpenWRT or DD-WRT, but this also requires laws to be written that forces manufacturers to not hardware-lock their routers, and force them to meet the minimum storage/driver-availability specs these third-party firmwares need.
hindsightbias 2y ago
Even with the WRTs, the firmware is probably built by the manufacturer. Try finding the provenance of who wrote the source code and where they live. AFAIK, that's not possible. So you have a router built with Chinese components (all of the ones anyone here can afford) with closed and "open" firmware built by them. I bought one of those GL.inet "open" routers and the WRT packages bricked it, so I have a choice of reverting or flashing from the factory (which appears to be a link to HK). That's probably 99.99% of use cases. They're in your base and they always have been.
- rekabis 2y ago
  > Even with the WRTs, the firmware is probably built by the manufacturer. Say you know nothing about router firmware without saying you know nothing about router firmware. OpenWRT and DD-WRT and other open-source third-party firmwares are THIRD PARTY firmwares. They have no connection with the manufacturer whatsoever.
  - hindsightbias 2y ago
    I just looked at 10 different openwrt data entries: > WikiDevi URL: https://wikidevi.wi-cat.ru/TP-LINK_Archer_C2_v3.x https://wikidevi.wi-cat.ru/TP-LINK_Archer_C2_v3.x Every one had a .ru domain. How do you know, exactly, who built it? GL.inet builds their own WRT package. It's a "feature".
    - rekabis 2y ago
      > Every one had a .ru domain. Brand-new to the Internet, are ya? Just because you cherry-pick Russian informational sites doesn’t mean that third-party firmwares have any connection to Russia whatsoever. Third-party firmwares are open-source projects, worked on by tens of thousands of volunteers from around the planet, and frequently have ZERO CONNECTION to any one hardware manufacturer. There are some collaboration efforts, when a particular manufacturer decides to adopt an open-source firmware as the exclusive firmware for their own hardware, but that simply means the hardware is fully unlocked for any third-party firmware that wants to be adapted for that hardware. These manufacturers just decided that they had no desire to f**k over the consumer by locking them into custom-made firmware. For example, I believe Turris https://www.turris.com/ https://www.turris.com/ takes a stock, latest copy of OpenWRT and makes a few tweaks to extend its capabilities for additional, server-like features.
adamc 2y ago
I dislike the pattern where we have to hook into their cloud.

KerrAvon 2y ago

I think I can count the number of routers assembled in the US today on zero fingers. Some TP-Links are not great -- get a first gen C7, IIRC.

bluGill 2y ago
I assume you are not counting hobbyist things.

deleted 2y ago

[deleted]

jdewerd 2y ago

I love cheap and reliable TP-Link routers as much as the next guy, but it's definitely also a security issue. The CCP almost certainly has a backdoor. Maybe a respectable one in the form of an undisclosed bug or the ability to lean on an update provider, but the point stands: it's absolutely a security issue and denying this is cope. Routers are going to be a bit more expensive and a bit less reliable for a while. We'll live.

deleted 2y ago
[deleted]
zxcvbnm69 2y ago
[dead]
c22 2y ago
Probably a better approach than the futile attempt to excise all routers with backdoors or bugs would be to continue the ongoing efforts to make network security router agnostic.

throwawaymaths 2y ago

i had the opposite experience. i got a tp link that refused to work if i didnt register it. i tried to get customer service and there were so many dark patterns in their customer service queue (fake "you have X minutes in the queue" numbers, etc) Eventually i got through to a human that said you can't run it without registering it. it did NOT say that on the box. shit like this is what the ftc should crack down on

pkaye 2y ago

I've been researching a new Wi-Fi router and heard lots of complaints that TP-Link doesn't provide many firmware updates? Is that not true? ASUS is not that much better but I do have an option of using the AsusWRT-Merlin open source alternative on their router. Another thing I've noticed is companies tend to still sell their models which are close to EOL on their website. Something needs to be done about that.

dole 2y ago
That's true, TP-Link isn't great about keeping their consumer product firmware secured or updated. ASUS isn't much better but when it comes to network gear, you kind of do get what you pay for. Selling models close to EOL or trying to hold hardware makers responsible for firmware security has been an issue for decades.
- giantg2 2y ago
  Are there manufacturers that are consumer focused that are good about security and updates? Some of the ASUS models are not particularly cheap, raising the question of why not go with business oriented models.
- throw0101c 2y ago
  > That's true, TP-Link isn't great about keeping their consumer product firmware secured or updated. ASUS isn't much better but when it comes to network gear, you kind of do get what you pay for. If this is actually the case then you should contact the FTC because Asus under an order to pay attention to security: * https://www.ftc.gov/news-events/news/press-releases/2016/07/ftc-approves-final-order-asus-privacy-case https://www.ftc.gov/news-events/news/press-releases/2016/07/... I have an Asus RT-AC68U that I bought ages ago that's still getting regular first-party firmware updates (plus the ones from Merlin). Currently using ISP-provided hardware, but given my past experience I'd definitely look at Asus as an option if I needed a new router.
  - dole 2y ago
    I have an Asus RT-AC1200, released in 2019 that hasn't had a firmware update since 2021/05 which is the reason why I bought the TP-Link. I do see Asus has a Nov 2024 firmware for that RT-AC68U on their site. As far as my TP-Link router, I think I remember it being stuck on a 2022/09 firmware until at least 2023/09, and I wound up flashing it with OpenWRT earlier this year.

kwanbix 2y ago

I am not a US citizen, nor I live there. However, I trust the Chinese goverment much less than the US one. So I get the banning if they really believe they could have a trojan horse. What I don't get is, what guarantees you that there is not a trojan jorse on any electronic device they produce?

taco_emoji 2y ago
This is an extremely good question that our government (I'm American) is completely disinterested in asking or answering.
alias_neo 2y ago
I suppose the issue is really the risk; attacks on infrastructure need to route over networks; even a completely vulnerability ridden machine isn't a risk if it isn't reachable from the net (inbound or outbound). Routers as the gateways into all sorts of networks, and they see/control all of the traffic in and out and often between devices on the network; they're a critical junction.

eightysixfour 2y ago

If the US was serious about this or TikTok, they would create security and privacy rules that applied to everyone. Instead they are targeting individual companies, which means it has little to do with security or privacy.

giantg2 2y ago
If they did that, it would mean the "good" spy agencies wouldn't have platforms. This is selective so they can just ban the platforms of "bad" spy agencies.
AnarchismIsCool 2y ago
I can't wait to see TP-Link being sold rebranded on amazon as "ANDORBEST FASTEST PRO ROUTER ACCESSPOINT CHAINSAW WEEDEATER PINEAPPLE YOGURT"
- all2 2y ago
  This reads like my BTC wallet recovery string.

throw38484 2y ago

[flagged]

pixl97 2y ago

>There's that nagging feeling that they're not concerned about security but banning anything that works well, is inexpensive and isn't made by an US company.. Two things can hold true at the same time. A US company selling US equipment and US software can have US law enforcement agents show up and point US guns at them for non-compliance. But that in turns sets up a captive market where the US players in the market are more likely to perform collusion and raise prices.

AnarchismIsCool 2y ago
Non-compliance is a weird way of saying "refusal to install US backdoors"

whimsicalism 2y ago

nagging feeling? that is absolutely what is happening, unless the US is claiming there is some backdoor in chinese cars

throw0101c 2y ago

> There's that nagging feeling that they're not concerned about security but banning anything that works well, is inexpensive and isn't made by an US company... The FTC went after (Taiwan-based) Asus for security reasons: > After a public comment period, the Federal Trade Commission has approved a final order resolving the Commission’s complaint against ASUSTeK Computer, Inc., charging that critical security flaws in its routers put the home networks of hundreds of thousands of consumers at risk. * https://www.ftc.gov/news-events/news/press-releases/2016/07/ftc-approves-final-order-asus-privacy-case https://www.ftc.gov/news-events/news/press-releases/2016/07/... So 'legitimate' security concerns have been a thing in the past.

ralferoo 2y ago

Totally agree. The only line that really stood out to me in the whole article was "... has grabbed a 65% market share in the United States..."

Havoc 2y ago

These sort of bans won't affect those willing to play it fast & loose Ebay, aliexpress, reshipper, friend in europe...there is always a way

iszomer 2y ago

Banning it from the American market is one thing, enforcing the ban is another topic altogether.