Routers-computer questions

[golfortennis]

So a number of us on here probably have been told we're pretty good golfers because some of the people we've played with have never seen really good golfers up close, but when you 've played with someone of that level, you know there is still a long way to go.  Well we bought ourselves a router to use on our travels, and in the past couple of days I have gone from my parents making me think I'm pretty good with computers to well.... playing with the really good golfers.

 

We picked up a GL-Inet Slate AX router.  Ideally the plan is that when we travel, we can, among other things, bring our Roku stick and our stick connects to our router, not to hotel wifi, and not divulge any information.  Some of the setup has seemed easy enough, but I noticed a "security alert" mentioning that a "CA root certificate is not trusted" and to trust it, it needs to be installed.  So being the skeptic I am, I did a bit of searching, and it seems like a number of guys take some steps in this regard with any router they get.  But I really can't understand much of it.  "I want to use my own SSL" and "you can find the key in ....."  I know it's a path, but heck if I know where that might be.

 

Can someone put it in more plain english?  A rabbit hole does not begin to describe what these questions have led to. 

[PedronNiall]

You need a certificate on your router telling your other devices that your router is safe to connect to. The certificates usually verify that a device or site is running the latest established security protocols. I can't tell you the ins and outs for your specific router, I can just tell you that it's always annoying to deal with when certs go out of date. The messaging for your specific issue is new to me, but taking any available updates for your router may be enough to fix your issue. I've honestly never seen a personal router need any additional certs installed and from my reading it looks like it's not the norm. Apparently you need to be very careful about this as the wrong cert type can literally give the device the ability to issue new certs for any website it likes, which is bad juju for your data privacy.

 

https://security.stackexchange.com/questions/223061/is-a-self-signed-certificate-from-my-isp-provided-router-a-security-threat

 

Honestly, I don't know why you're bothering with all these headaches. All you need to do is use a good VPN on your devices when connecting to public WiFi and you will have an encrypted tunnel between you and whatever service or site you're accessing. No need to carry around extra hardware and establish a tertiary connection to the public/semi-private WiFi you're already using and no need to drive yourself batty trying to figure out how to install the right cert to use your router but not let it sign new certs for iffy websites if it's compromised.

 

If you're that paranoid and don't trust a VPN then I'm not sure why you trust the router because it's just a piece of hardware that acts as step 1 before turning on its own VPN option if you so choose. From what I can see if you don't enable its VPN functionality it does nothing but become an extra step in an unsecured connection over public WiFi. Your Device <-> Slate <-> Public WiFi <-> Service you're accessing, with no tunneling to protect your data.

 

My advice is to just use a VPN or get a Hotspot from a wireless provider that has service where you'll be traveling. If you want to keep using this router I'd first check for updates. If that doesn't get it done, I suggest you hop over to stackexchange as above and write out a detailed post explaining your issue. Be warned, stack sites can get you an answer, but those who respond aren't always nice, so have your wits about you.

[golfortennis]

2 hours ago, PedronNiall said:

You need a certificate on your router telling your other devices that your router is safe to connect to. The certificates usually verify that a device or site is running the latest established security protocols. I can't tell you the ins and outs for your specific router, I can just tell you that it's always annoying to deal with when certs go out of date. The messaging for your specific issue is new to me, but taking any available updates for your router may be enough to fix your issue. I've honestly never seen a personal router need any additional certs installed and from my reading it looks like it's not the norm. Apparently you need to be very careful about this as the wrong cert type can literally give the device the ability to issue new certs for any website it likes, which is bad juju for your data privacy.

 

https://security.stackexchange.com/questions/223061/is-a-self-signed-certificate-from-my-isp-provided-router-a-security-threat

 

Honestly, I don't know why you're bothering with all these headaches. All you need to do is use a good VPN on your devices when connecting to public WiFi and you will have an encrypted tunnel between you and whatever service or site you're accessing. No need to carry around extra hardware and establish a tertiary connection to the public/semi-private WiFi you're already using and no need to drive yourself batty trying to figure out how to install the right cert to use your router but not let it sign new certs for iffy websites if it's compromised.

 

If you're that paranoid and don't trust a VPN then I'm not sure why you trust the router because it's just a piece of hardware that acts as step 1 before turning on its own VPN option if you so choose. From what I can see if you don't enable its VPN functionality it does nothing but become an extra step in an unsecured connection over public WiFi. Your Device <-> Slate <-> Public WiFi <-> Service you're accessing, with no tunneling to protect your data.

 

My advice is to just use a VPN or get a Hotspot from a wireless provider that has service where you'll be traveling. If you want to keep using this router I'd first check for updates. If that doesn't get it done, I suggest you hop over to stackexchange as above and write out a detailed post explaining your issue. Be warned, stack sites can get you an answer, but those who respond aren't always nice, so have your wits about you.

 

Hmm, ok, that is a lot to think about.  Thank you.  I guess the big thing is I don't want my Roku streaming stick connecting directly to hotel wifi, unless I'm completely out to lunch about using a VPN there.  We have used it for our laptop for some time, but we also have the issue of device limits, our VPN can have only 5 devices at a time, whereas the router can be the one and then we are golden.  Plus it can be annoying to remember to turn on/off the VPN when we use the different devices.  I figure one and done.

 

And thanks for the head's up on that site.  Sounds like a bunch of nerds who got picked on in high school get their revenge.  I was really just looking for some clarity on what I started to read based on searching for what I was reading.  Bottom line, it comes from the router maker, it should be good to install?

[PedronNiall]

As per the post I linked, no, just because it comes from the device maker doesn't mean it's safe. They may inadvertently offer a cert that allows any site you connect to to sign itself as trusted, creating a huge vulnerability. If you want to go that route I recommend finding the cert from the manufacturer and posting the details in the same way to let others evaluate it.

[golfortennis]

10 hours ago, PedronNiall said:

As per the post I linked, no, just because it comes from the device maker doesn't mean it's safe. They may inadvertently offer a cert that allows any site you connect to to sign itself as trusted, creating a huge vulnerability. If you want to go that route I recommend finding the cert from the manufacturer and posting the details in the same way to let others evaluate it.

 

I have been convinced by yourself and someone else to simply send back the router.  Now I will just need to figure out how to delete software.

  

Edited March 26, 2023 by golfortennis

[PedronNiall]

Should simply need to find it in the Add or Remove programs menu from the search panel in Windows then select uninstall or drop it in the trash from the Applications folder on Mac.