from Hacker News

US could ban TP-Link routers over hacking fears: report

by esaym on 12/18/24, 3:19 PM with 245 comments

  • by neilv on 12/18/24, 4:27 PM

    I'm currently upgrading my home network, trying various options, and one of the headaches is provenance of the equipment.

    By provenance, I mean where it's designed, where it's manufactured, who has brand oversight of it, who controls the firmware, who runs the IoT phoning-home servers, etc.

    (I don't have high security requirements for home, but I pay attention to such things out of curiosity.)

  • by amelius on 12/18/24, 4:08 PM

    Can we start banning hardware companies __after__ we have banned the selling of user data to the highest bidder (which might as well be Chinese companies)?

  • by eqvinox on 12/18/24, 4:34 PM

    To be fair, TP-Link routers without OpenWRT installed should be banned, considering their vulnerability history...

    But they are nice and cheap OpenWRT platforms. Ban the software instead? ;D

  • by amelius on 12/18/24, 3:56 PM

    This is a real pity since TP-link makes reliable gear with a very good price/performance ratio (Linux user).

  • by zenethian on 12/18/24, 6:38 PM

    What is a good recommendation for replacing a TP-Link Omada AP? I have the Wifi6 AP and it performs great. But if I do need to replace it with something more secure, what are my choices?

    I know Ubiquity is a choice, but the reason I chose Omada over Ubiquity is that I can host the Omada controller locally and not be forced to use a cloud product.

  • by eduction on 12/18/24, 5:31 PM

    Wirecutters top two router recommendations are both TP-Link. Near the top of the review they praise "Hitting the sweet spot between price and performance" but then bury the disclosure that you have to pay extra for security, including "most protection."

    "TP-Link also offers a $5-per-month or $36-per-year plan for Security+ network protection and IoT security. If you don’t pay, you still get some basic functionality such as the ability to block websites and to manually toggle internet access on your kids’ devices, but advanced settings, automatic timed internet control, most protection, and reporting are disabled after the one-month free trial. That said, the Archer AX3000 Pro will continue to provide solid Wi-Fi connectivity even if you don’t sign up for the added plans."

    This report is a great example of why it's a bad deal to trade away security for a lower price. Wirecutter should have been leading the way in pointing this out, instead of just steering people to the cheapest fast thing, YOLO style (anyone can make that kind of recommendation).

    https://www.nytimes.com/wirecutter/reviews/best-wi-fi-router...

  • by vkaku on 12/18/24, 10:53 PM

    I haven't found a competitively priced US made product in the segments where TP-Link seems to do extremely well.

    For home office switches, if we required PoE 1G + 10G ports - the nearest option sold by US companies is 2x the price of TP-Link. There are no competitively priced options (10-20% additional cost) available for these segments. Ditto for gateways.

    In the higher end, the campus switches offered by the competition is not even priced at < 10x the TP-Link switch prices. Which means the immediate cost of using TP-Link right now and replacing it with a much better TP-Link 2-3 years down the lane would justify buying TP-Link only. At this point, the expensive gear from competition feels like an over-engineering + cash grab to an end user.

    Shouldn't more competition be about lowering prices and increasing choices? Where are the choices? Is there even an effort being made to help the end users of these budget segments?

  • by ksec on 12/18/24, 4:31 PM

    I will take this opportunity to ask if anyone want Apple to make AirPort Extreme again?

  • by wrs on 12/18/24, 10:07 PM

    "...routinely fails to address vulnerabilities in its products... When cybersecurity experts point out the flaws...the company declines to engage with them..."

    I feel like this used to apply to most mass-market home routers. Have things improved recently such that TP-Link is an outlier?

  • by fidotron on 12/18/24, 3:53 PM

    APs are going to be the great new app platform, but also a very clear security problem. They have now grown so much spare capacity they can host a lot of extra interesting services. The noises from China suggest some people in companies like Xiaomi worked this out a while ago.

    Fundamentally we need to move to a home networking model that involves isolating all clients completely (especially cameras and smart TVs), and using AP hosted services to mediate interaction between them and the Internet at large. This will involve needing to trust the AP, but will have the advantage of being able to deploy slightly less trustworthy devices at the very edge.

  • by dole on 12/18/24, 3:45 PM

    Those running TP-Link gear might want to check whether theirs supports OpenWRT or another firmware option.

  • by tharmas on 12/18/24, 3:41 PM

    The US Authorities remember when they did it to fax machines in Eastern Europe.

  • by tgeorge on 12/18/24, 4:32 PM

    I wonder what happens to their Kasa brand of smart devices then. I have bunch of wall switches and smart power plugs with them.

  • by phendrenad2 on 12/18/24, 8:42 PM

    Do TP-Link routers really have more security holes than, say, ASUS (designed in Taiwan) or Mikrotik (designed in Latvia)?

  • by ryanalam on 12/18/24, 8:28 PM

    An alternative to NY Post, which I don’t find very credible:

    https://arstechnica.com/tech-policy/2024/12/report-us-consid...

  • by blackeyeblitzar on 12/18/24, 7:10 PM

    It might be the right move. I’ve noticed a lot of oddities with my top of the line TP Link Mesh routers. Limited ability to configure it compared to past routers (not many advanced settings). Forced use of a very sanitized app instead of a browser based panel. Forced updates with no ability to use the admin panel without accepting the update. And so on. It works and is high quality in a way, but I also don’t trust it. Unfortunately a lot of these issues aren’t visible until after you buy it.

  • by impish9208 on 12/18/24, 5:37 PM

  • by harry8 on 12/18/24, 9:14 PM

    So who knows much about banana pi and using that to build a router. What firmware? Are there better hardware options? Anything user-friendly enough to compare with consumer grade uis for routers? Anything else that should be being asked in this space?

    https://www.banana-pi.org/

  • by daft_pink on 12/18/24, 4:47 PM

    Ugh, I use TP-Link Omada and I really don’t want to rip out everything to switch it to Unifi.

  • by nottorp on 12/18/24, 4:02 PM

    There's that nagging feeling that they're not concerned about security but banning anything that works well, is inexpensive and isn't made by an US company...

    Anecdote: once I bought the cheapest router I could find online. The idea was to test connecting to a crap AP. Unfortunately the cheapest was a TP-Link and it worked absolutely perfectly, ruining my test plan.

  • by bilal4hmed on 12/18/24, 4:28 PM

    So what are my options here now? I run an omada system - do I move over to ubiquiti or DIY with opnsense ? if firmware is the issue then an entirely open system is what makes sense here.

  • by ulfw on 12/18/24, 4:29 PM

    Things get dumber by the day. I'm very happy with my TP-Link Deco mesh router.

    The US outsourced absolutely everything to China and is now banning it up down and centre. Shizophrenic much?

  • by nashashmi on 12/18/24, 8:20 PM

    We are on a slippery slope of banning everyone: TikTok; Kaspersky, ... TP-Link.

    Huawei was not banned, they were bullied out of the US market, and had restricted access to US technologies.

  • by m3kw9 on 12/18/24, 7:40 PM

    How hard is it to place transistor level string detection that activates an encrypted program within the asic

  • by showerst on 12/18/24, 4:43 PM

    What's everyone's recommended replacement brand for home users? Mikrotik?

  • by bloomingkales on 12/18/24, 3:56 PM

    I have one, should be worried?

  • by sharpshadow on 12/18/24, 4:51 PM

    “investigators believe that TP-Link routinely fails to address vulnerabilities in its products that are shipped to customers who use the routers for both home and business purposes” good luck finding someone which is able to adress this issue and can deliver the same amount of devices in the price range.

    Sounds like they want to apply pressure to TP-Link so they start to fix more and faster.

  • by GSh080 on 12/19/24, 4:10 AM

    I think this is quite ridiculous. If they collect data, it will be a huge amount. Additionally, most traffic is already encrypted, so they would just get garbage.

  • by whimsicalism on 12/18/24, 4:35 PM

    what i would give to live in a rational well-run country, rather than one governed by populism, paranoia, and jingoism

  • by onewheeltom on 12/18/24, 9:58 PM

    Probably compromised from the factory

  • by 2OEH8eoCRo0 on 12/18/24, 4:11 PM

    I chucked my only piece of TP-Link equipment a few months ago out of caution.

  • by tyjen on 12/18/24, 7:19 PM

    Wait until Congress figures out about all the new "free" games pouring out of China, each requiring kernel level anti-cheat software to operate in the background.

  • by pjmlp on 12/18/24, 4:16 PM

    Yet another step for nationalists to start pushing for internal technologies across the globe.

    Slowly I am feeling back into world geopolitics of my childhood.