Slashdot Mirror
Ask Slashdot: Can Commercial Hardware Routers Be Trusted?
First time accepted submitter monkaru writes "Given reports that various vendors and encryption algorithms have been compromised. Is it still possible to trust any commercial hardware routers or is 'roll your own' the only reasonable path going forward?" What do you do nowadays, if anything, to maintain your online privacy upstream of your own computer?
You still have to rely on the trustworthiness of the NICs. Anything contacted to the Internet can not be trusted.
Sig: I stole this sig.
You shouldn't have to trust your upstream routers. Instead you should assume they're compromised and use end-to-end encryption. HTTPS and SSH, for example, specifically protect against active attackers such as malicious routers.
actually the obvious answer is that trust is not a binary thing.
Actually, the obvious answer is that you don't have a choice. No matter how much effort you put into it, you will always be depending on third party hard- or software that simply have to trust. So, you want to solder your own PCB? Sure, go ahead, but your Ralink SoC is still manufactured somewhere in China. Don't trust Cisco's IOS? Sure, write your own, and let me know how you designed and manufactured your own ASICs. And then we're not even discussing the fact that as soon as the packet leaves your router, it will enter one that you don't even own. Yes, there is a lot that you can do and I think the closest real answer to the poster's question is to just get an OpenWRT capable router and compile from scratch, but to not trust anyone is simply not an option.
I'm not a complete idiot... Some parts are missing.
I was going to say that.
RSA compromised with money. Cisco compromised already documented. Juniper? I don't know but I wouldn't doubt it.
NSA, you've turned the world against the US and all its businesses. Happy yet?
Like RSA or Microsoft?
I am pretty sure if they are interested enough they will get the data one way or another.
This...
Or has no one ever heard of rubber-hose cryptography?
If all else fails, they can break in at night and steal the information locally, or simply put a gun to your head.
When it comes to computer nerds, that last option probably has a 99.99% success rate.
It has been demonstrated that the intelligence agencies (plural) in the US government is the tail that wags the dog. This is historically true and more than likely true today as well. When you've got the dirt on many people, how tempting would it be to leverage that into getting your way? It's a temptation many could not avoid exploiting.