Prudent time frame for changing router password?

softdown · March 2018

Lets imagine that you are of interest to "hackers" How often would you change your router password?

pdh · March 2018

Just once. Set it to something very strong: a long string of characters (say, 16 characters or more -- more is better), no words in it, using both upper- and lower-case letters, plus numbers and special characters.

Changing your password often is a protection against continued use of a stolen / guessed password. That is, changing your password is useful only *after* a bad guy has already obtained it. If no bad guy ever learns it, then there's no benefit to ever changing it. So if your password is strong enough that it can't be guessed, and if you're careful not to allow it to be stolen (don't write it down on a sticky note on your office wall -- find a way to remember it without writing it down) then there's no need to ever change it (unless you're using software that forces you to do so).

The biggest challenge is finding a way to remember your long, strong password.. but there are lots of ways to do that.

mike95490 · March 2018

Many routers had a backdoor flaw, and there is new firmware to correct that. If the backdoor is not closed, it matters not what your password is.

https://www.computerworld.com/article/2486450/malware-vulnerabilities/d-link-issues-fixes-for-firmware-backdoor-in-routers.html

and in 2017, AT&T
http://www.zdnet.com/article/flaws-in-att-routers-put-customers-at-risk/

pdh · March 2018

> If the backdoor is not closed, it matters not what your password is

Very true. There are several ways that bad guys could compromise a system that's protected with even the strongest password... software or hardware flaws as you mentioned; hardware or software keyloggers; a small hidden camera trained on your keyboard; interception of Wi-Fi or HTTP transmissions that include the password "in the clear"; reading the little yellow sticky note with the password on it, or breaking into the password database on systems where there is such a thing; and there are others.

Changing your password frequently doesn't help with any of this -- in fact it makes it harder to maintain a good strong password without writing it down. It limits the damage after you've already been hacked, but that's all it does.

Estragon · March 2018

If I was "of interest to hackers" I would set my router password to "password", and never change it, then never do anything with my router. Maybe I'd write a script to constantly update the score of Princess Bride on Rotten Tomatoes or something, then do what I really wanted to do in a public library.

BB. · March 2018

I have my routers set to never allow remote (over the internet) logins--Only from my local network (wired or wifi--still need good passwords).

Also, set my router to never reply to pings (no return, nobody sees any hardware to try and hack).

-Bill

Dave Angelini · March 2018

The Engineers at Schneider and Outback have told me their web portals are very safe. I still wonder about it though. I monitor about 25 systems and although I can only read the data (The portals do not allow changing settings) I do not know enough about the safety that I am told is designed in. Comments on this?

softdown · March 2018

Dave Angelini said:

The Engineers at Schneider and Outback have told me their web portals are very safe. I still wonder about it though. I monitor about 25 systems and although I can only read the data (The portals do not allow changing settings) I do not know enough about the safety that I am told is designed in. Comments on this?

Would any company admit that they don't take security seriously?

Changing the subject here a bit. Just learned that our bluray players are required to have 1 GB of internal memory and an internet data port. That is a lot of data. I had not imagined that the lowly bluray player was capable of potentially extensive surveillance.

Being a Ludite is pretty attractive at times.

softdown · March 2018

BB. said:

I have my routers set to never allow remote (over the internet) logins--Only from my local network (wired or wifi--still need good passwords).

Also, set my router to never reply to pings (no return, nobody sees any hardware to try and hack).

-Bill

My new router offers two separate data transfer "ports"...........2.4 and 5. Sure would be convenient for hackers to download from one bandwidth while the user blithely uses the other bandwidth without even noticing slow service.

This router tells me of DDoS attacks by the lights. Plus the TV internet service went down as well......for a long time.

I would imagine the NRO enjoys as much clandestine access as the NSA...working hand in hand. Looking at our "selection" of current public servants, I wonder about control of the political process. We always seemed to have more freedom fighters actually working in the best interests of the Constitution and the public.

pdh · March 2018

> The Engineers at Schneider and Outback have told me their web portals are very safe. I still wonder about it though. I monitor about 25 systems and although I can only read the data (The portals do not allow changing settings) I do not know enough about the safety that I am told is designed in. Comments on this?

When they say their web portals are safe, what do they mean? Could be:

a. They allow only SSL / HTTPS to communicate with the portal; and/or
b. They use strong crypto once an SSL / HTTPS session has been established; and/or
c. They don't store sensitive data unencrypted on their own machines; and/or
d. They control and limit physical and network access to their web portal server machines; and/or
e. They regularly apply security patches to their servers' operating system and to their web server; and/or
f. Something else

Just as a curiosity, I notice that www.outbackpower.com accepts HTTP (non-encrypted) access -- that is, you can access their site via http://www.outbackpower.com/.

In contrast, try the steakhouse at http://www.outback.com. You'll see that the steakhouse automatically upgrades you to an encrypted HTTPS session -- that is, it re-directs you to https://www.outback.com (https, not http) and it presents an X.509 certificate from Entrust that gives you some assurance of who you're talking to.

So as a very quick first impression, I'm more impressed with the web security at Outback Steakhouse than at Outback Power. (Although maybe their customer portal is locked down more tightly than their main web page is?)

mike95490 · March 2018

Schneider is a large enough player, they have a functional security team

https://www.schneider-electric.com/en/work/support/cybersecurity/overview.jsp

and have found and eradicated malware in systems supported by them.

softdown · March 2018

mike95490 said:

Schneider is a large enough player, they have a functional security team
https://www.schneider-electric.com/en/work/support/cybersecurity/overview.jsp
and have found and eradicated malware in systems supported by them.

That must have disappointed the NSA....having to step up their game a notch. Or..insert Chinese/Russian/Iranian NSA counter part.

Estragon · March 2018

> @Dave Angelini said:
> The Engineers at Schneider and Outback have told me their web portals are very safe. I still wonder about it though. I monitor about 25 systems and although I can only read the data (The portals do not allow changing settings) I do not know enough about the safety that I am told is designed in. Comments on this?

Nothing is "safe" on a computer. That said;

@pdh suggests ssl adds a level of security and it does, but only to the extent it can. It gives a warm fuzzy feeling by showing a padlock icon in a browser, but all that tells you is the site produced credentials approved by some (field settable) trusted authority, and the subsequent interactions with the site may have some (field settable) degree of encryption. It tells you exactly nothing about the security of the site itself.

I don't know enough about how the portals are constructed to have a clue about whether security should be a concern. My guess is probably not - Outback et al would be open to nasty litigation if they did anything other than provide a way to upload and display info to a web page. If they incorporated any sort of field device writable capability, they deserve a cigarette and a blindfold. Schneider techs certainly aren't dumb, and likely don't smoke.

Prudent time frame for changing router password?

Comments

Categories