Logging into the router

[Gliwmaeden2]

When checking which version of Hub2 firmware I currently have, the address for logging into the router has a black triangle flag:

 

The message indicates it is less risky at home, but the general implication is that it's not secure. I am trying to use it at home.

This didn't happen when I checked the firmware version a few weeks ago.

What's going on with it?

[Billx]

Bit late to the party. But excellent topic and discussion, @Gliwmaeden2 

I agree with you, that it doesn't make a lot of sense.

By definition, 192.168.1.1 is a device within a private network, not within a public network.

By definition, messages between http:// 192.168.1.1/ are unsecure in the sense that they are unencrypted.

But they are secure in the sense that the owner of the private network trusts all devices and users within the private network.

One would think that Google Chrome would know that and not be so alarming, especially the fact that this is a private network.

I think other programs, including Windows, get confused, whether a private network, is or is not, private.

I think that what happens, is that when a user logs into the router for the first time, after Chrome gives that warning (meaning that messages are  unencrypted), Chrome saves that fact somewhere in cache (whatever and wherever that is) that you have given permission, and won't bother you again. It will only bother you again, if somehow that record in the cache is lost.

Anyhow, this is my view.

Bill

[Gliwmaeden2]

Thanks, that's a little clearer now! 😊

[KeithFrench]

TalkTalk have never implemented HTTPS in their routers for this purpose, probably because of cost. Everything else you ask is down to your browser.

[Gliwmaeden2]

The point is it doesn't give me the override message, only the option, exactly as in the original image I posted, to "continue to site".

What has not been answered:

Why would I get this message as a one off? It usually doesn't show.

If it actually mattered it would show every time. 

I was already informed that it's http rather than https in the image I posted where it recommends contacting the site owner to upgrade it. So that is not the mystery. 

I am only ever trying to log in at home.  It's an alarming message if it shows, when nothing has been altered at my end.

So the only question that needs answering is why did the message in the image I posted show up at all, ever? 

And perhaps Talktalk could explain why they don't use https?

[KeithFrench]

Hi @Gliwmaeden2 

@Divsec is 100% correct on this. HTTP is not encrypted, whereas HTTPS is. Logging into a TalkTalk router can only be done from the local network; connection attempts coming into the router via its WAN interface are blocked. Unless someone is connected to your network and is using Wireshark with specialist hardware, your connection to the router is classed as secure enough. Your browser should give you an override along the lines of "I trust this connection, please allow it".

[Gliwmaeden2]

@KeithFrench, have you got any thoughts on this, as I don't think the previous reply got to the bottom of things?

When I log in now, as expected, the warning triangle is still there, but not the warning message that I posted in my first post.

So it's back to normal. 

Why would I usually not see that warning message, and then suddenly see it flagging up the issue, then back to normal despite still being triangled in the browser address?

[Gliwmaeden2]

Yes - it's probably Chrome flagging it up for that reason and normally it could matter in connection with other websites, as a warning. 

But nobody's going to be logging into that address unless they are already at home, so the alert is superfluous. 

Though it does still beg the question, why doesn't Talktalk use https for this, and why didn't the alert show last time?

A few weeks ago I got into the router log in with none of these alerts, using the same browser, same devices. 

[Divsec]

Hi @Gliwmaeden2 that's because it is an http rather than HTTPS connection and nothing to worry about