Hacker News Reader

> "“The logic behind using [a] domain in the first place, instead of an IP address, is the main problem here,” Dan said in a blog. “Forgetting to buy the domain is the second mistake. "

This doesn't make any sense to me. TP-Link changes hosts and they lose that IP address. A domain name is far better for customers. Unless I'm missing something here?

View on HN

It's not supposed to be a public domain. They use the domain for the router's internal config page. So instead of going to 192.168.1.1 to configure your router, you can go to tplinklogin.net. Of course, if they don't own the domain, a malicious actor can set it up as an actual public website, where they can phish for router login passwords and such.

Would this domain ever be forwarded to the resolver by a TP-Link router? If you are hardcoding a domain, you should better hardcode it in your hosts list somewhere, rather than relying on the DNS to give you the correct reply. (You may not always have a working DNS server to query)

Heck, hardcode a name with an extremely unlikely-to-ever-get-used suffix, like: routerlogin.tplink

Reply on news.ycombinator.com