5 ms·

You, probably. On a more serious note, is this any different from ISPs having a remote management system for ISP provided routers? In terms of privacy, if Spac

You, probably. On a more serious note, is this any different from ISPs having a remote management system for ISP provided routers? In terms of privacy, if SpaceX didn't have access to the user terminal, they could still just capture your traffic on the sattelite or the ground stations

ronsor 1y ago
If they have access to the router, they can capture local network traffic as well as internet traffic.
- arghwhat 1y ago
  Note that such capture would be quite terrible for performance, not only requiring disabling any hardware offload (a great router might be able to route a few hundred megabit in large packets without offload assuming it doesn't do anything else) to make packets visible for capture, but it would also have to stream the output back to the adversary over the uplink as you would be limited to at most a few gigabytes of local, extremely slow storage, giving no means for local offline analysis... The risk of access to the router is more that they can access your network and touch unprotected and vulnerable things rather than active monitoring.
  - db48x 1y ago
    And most of that wouldn’t be useful. We use encryption for almost everything now for a reason. No, wiretaps on modern networks do not rely on backdoors, or even big labeled front doors like SSH, on individual subscriber devices. Instead it is built into the lower level routing. When an ISP gets a warrant (or whatever relevant document your country uses) they configure their routers to tag all of your traffic and mirror it to a server to be recorded. It’s entirely invisible to the subscriber, and highly automated.
    - tredre3 1y ago
      > And most of that wouldn’t be useful. We use encryption for almost everything now for a reason. The topic at hand is local network access. Some examples of things happening on your local network that you might not want Elon/ISP to see: - Many people have public shares on their NAS for things like media or family photos - Security cameras - Printers - If you're casting, the title of everything you watch is broadcasted on the network - Even if you're not casting, if you use an Android TV then the title of everything you watch is also broadcasted to the network by default - The list of all your devices - If you torrent things, then the hash of all your torrents is likely broadcasted to your local network (through Local Peer Discovery)
- edf13 1y ago
  I sit my external routers (and Starlink) behind another network (DMZ).
microtonal 1y ago
On a more serious note, is this any different from ISPs having a remote management system for ISP provided routers? Maybe, but in more and more European countries, ISPs are required to accommodate you hooking up your own router/modem. E.g., I am on fiber and if I want to I can hook up my own router directly to fiber with an SFP+ module (I currently use the ISP-provided media converter, but my own router). Lots of tech users use their own Ubiquiti/OPNsense/OpenWrt routers, so no remote management. I wonder if this requirement applies to Starlink as well, since they are an ISP.
- prajaybasu 1y ago
  As far as I'm aware, they are only required to allow you to use your own router. DSL tech is far simpler and it's always a combo unit so I could see a case where you would be allowed to bring your own DSL modem. But it just doesn't work like that for DOCSIS or GPON where the cable modems or ONTs these days do much more than just media conversion - SIP, PPPoE, IGMP, etc. even if they don't do Wi-Fi (so ISPs don't call them "routers" - except SingTel, which uses "ONR" to distinguish these units because they are in fact routers for IPTV and SIP). For all of those modems/ONTs, the firmware updates and the configuration for telephony/SIP and PPPoE are controlled by the ISP and also tested to work with their OLT or CMTS so it's just not possible for the ISP to guarantee support for any random modem or ONT. And to support the advanced configuration required these days for VoIP, IPTV, etc. on the "modem" or "ONT", ISPs basically have a backdoor called TR-069 which is really not too dissimilar to what Starlink has access to with their SSH keys. Even if you get "true" dumb modems or ONTs which do not do any routing whatsoever, the device on the other side still has full control over your dumb device via the DOCSIS provisioning process or GPON's OMCI. Starlink seems to be using SSH instead of building a whole protocol - because satellite tech is proprietary and doesn't need to work on other hardware. So, I find that it's highly unlikely that the ISP is officially required to support a user supplied modem, although I haven't consulted the EU laws on this. At most, I think using your own router would require the EU ISPs to provide bridge mode support, but that's not special to EU. However, the TR-069 backdoor is still active even with bridge mode. It can be fairly easy to stop TR-069 with a "dumb" ONT (usually SFP) but ISPs can and will notice that. Whether they allow it is up to them.
amelius 1y ago
I think the main problem is that they would have access to other traffic on your local network. But you can just add more hardware to isolate it.
_joel 1y ago
Is https://en.wikipedia.org/wiki/TR-069 https://en.wikipedia.org/wiki/TR-069 not available?
mystified5016 1y ago
In the US, ISPs are required to allow you to hook up your own modem. As long as your hardware is technically compatible with the network, you just give them your MAC address and plug it in. However, part of being compatible is that the modem bust be configurable and controllable by the ISP. The ISP will typically flash their own firmware to your modem without asking or telling you. The same applies to cell networks. The actual modem in your phone is running a binary blob provided by the network operator. This is done for very good reason, without control of all modems in the netork, the operator can't provide reliable service. A broken modem in the network screaming out non-compliant signals can screw things up for everyone. It's a necessary evil for the network operator to have privileged control over the hardware on their network. You solve this by treating your modem as a direct, untrusted, unprotected hole into the public internet. You also must assume that the ISP can inspect traffic on their network. To solve all of this, you put a firewall between it and your local network. I really don't think it's at all a problem for ISPs to have this level of control over customer modems. It is a problem when the ISP bundles the modem and router, but that's a different conversation. Just always use your own router.

ronsor 1y ago

If they have access to the router, they can capture local network traffic as well as internet traffic.

arghwhat 1y ago
Note that such capture would be quite terrible for performance, not only requiring disabling any hardware offload (a great router might be able to route a few hundred megabit in large packets without offload assuming it doesn't do anything else) to make packets visible for capture, but it would also have to stream the output back to the adversary over the uplink as you would be limited to at most a few gigabytes of local, extremely slow storage, giving no means for local offline analysis... The risk of access to the router is more that they can access your network and touch unprotected and vulnerable things rather than active monitoring.
- db48x 1y ago
  And most of that wouldn’t be useful. We use encryption for almost everything now for a reason. No, wiretaps on modern networks do not rely on backdoors, or even big labeled front doors like SSH, on individual subscriber devices. Instead it is built into the lower level routing. When an ISP gets a warrant (or whatever relevant document your country uses) they configure their routers to tag all of your traffic and mirror it to a server to be recorded. It’s entirely invisible to the subscriber, and highly automated.
  - tredre3 1y ago
    > And most of that wouldn’t be useful. We use encryption for almost everything now for a reason. The topic at hand is local network access. Some examples of things happening on your local network that you might not want Elon/ISP to see: - Many people have public shares on their NAS for things like media or family photos - Security cameras - Printers - If you're casting, the title of everything you watch is broadcasted on the network - Even if you're not casting, if you use an Android TV then the title of everything you watch is also broadcasted to the network by default - The list of all your devices - If you torrent things, then the hash of all your torrents is likely broadcasted to your local network (through Local Peer Discovery)
edf13 1y ago
I sit my external routers (and Starlink) behind another network (DMZ).

microtonal 1y ago

On a more serious note, is this any different from ISPs having a remote management system for ISP provided routers? Maybe, but in more and more European countries, ISPs are required to accommodate you hooking up your own router/modem. E.g., I am on fiber and if I want to I can hook up my own router directly to fiber with an SFP+ module (I currently use the ISP-provided media converter, but my own router). Lots of tech users use their own Ubiquiti/OPNsense/OpenWrt routers, so no remote management. I wonder if this requirement applies to Starlink as well, since they are an ISP.

prajaybasu 1y ago
As far as I'm aware, they are only required to allow you to use your own router. DSL tech is far simpler and it's always a combo unit so I could see a case where you would be allowed to bring your own DSL modem. But it just doesn't work like that for DOCSIS or GPON where the cable modems or ONTs these days do much more than just media conversion - SIP, PPPoE, IGMP, etc. even if they don't do Wi-Fi (so ISPs don't call them "routers" - except SingTel, which uses "ONR" to distinguish these units because they are in fact routers for IPTV and SIP). For all of those modems/ONTs, the firmware updates and the configuration for telephony/SIP and PPPoE are controlled by the ISP and also tested to work with their OLT or CMTS so it's just not possible for the ISP to guarantee support for any random modem or ONT. And to support the advanced configuration required these days for VoIP, IPTV, etc. on the "modem" or "ONT", ISPs basically have a backdoor called TR-069 which is really not too dissimilar to what Starlink has access to with their SSH keys. Even if you get "true" dumb modems or ONTs which do not do any routing whatsoever, the device on the other side still has full control over your dumb device via the DOCSIS provisioning process or GPON's OMCI. Starlink seems to be using SSH instead of building a whole protocol - because satellite tech is proprietary and doesn't need to work on other hardware. So, I find that it's highly unlikely that the ISP is officially required to support a user supplied modem, although I haven't consulted the EU laws on this. At most, I think using your own router would require the EU ISPs to provide bridge mode support, but that's not special to EU. However, the TR-069 backdoor is still active even with bridge mode. It can be fairly easy to stop TR-069 with a "dumb" ONT (usually SFP) but ISPs can and will notice that. Whether they allow it is up to them.

amelius 1y ago

I think the main problem is that they would have access to other traffic on your local network. But you can just add more hardware to isolate it.

_joel 1y ago

Is https://en.wikipedia.org/wiki/TR-069 https://en.wikipedia.org/wiki/TR-069 not available?

mystified5016 1y ago

In the US, ISPs are required to allow you to hook up your own modem. As long as your hardware is technically compatible with the network, you just give them your MAC address and plug it in. However, part of being compatible is that the modem bust be configurable and controllable by the ISP. The ISP will typically flash their own firmware to your modem without asking or telling you. The same applies to cell networks. The actual modem in your phone is running a binary blob provided by the network operator. This is done for very good reason, without control of all modems in the netork, the operator can't provide reliable service. A broken modem in the network screaming out non-compliant signals can screw things up for everyone. It's a necessary evil for the network operator to have privileged control over the hardware on their network. You solve this by treating your modem as a direct, untrusted, unprotected hole into the public internet. You also must assume that the ISP can inspect traffic on their network. To solve all of this, you put a firewall between it and your local network. I really don't think it's at all a problem for ISPs to have this level of control over customer modems. It is a problem when the ISP bundles the modem and router, but that's a different conversation. Just always use your own router.