FCC Reaches Settlement with TP-Link in Wi-Fi Router Investigation | Hacker News Reader

FCC Reaches Settlement with TP-Link in Wi-Fi Router Investigation

transition.fcc.gov

134 pointspentago67 comments

One time I was up for like 36 hours, and I had just gotten a new router from Linksys. I started reading the privacy policy and got really freaked out that they were tracking every website I visited through some kind of HTTP/S proxy.

I wouldn't doubt it because in their policy they paint some pretty broad strokes with their words. Their "Smart WiFi" router phones home constantly and the web interface manager doesn't allow you to run it without third party cookies enabled and JavaScript enabled. I'm going to have to burn that open source router onto it because it said it was capable.

I tried blocking the only third party cookie on our admin portal and the rest of the site seemed to work fine. What are you using to block the third party cookie?

Also what part of the privacy policy gives you the impression of there being a proxy/something tracking the websites you visit?

When you login to the smart wifi, open your network panel, and it will phone home on a loop.

I don't recall specifics, It just made me very paranoid. Go ahead and read it for yourself. Who knows how often they phone home? I know I don't. And think about what kind of targeted advertising they could implement if they knew every website you've ever visited. Is it possible? I can't see how thinking about doing this wouldn't have been a thought in meetings with how to monetize.

There's basically 4 different kinds of traffic you'll see coming out of the browser when you're viewing the admin portal.

JNAP Calls - These are used to get or set configuration settings on your router. They'll always be aimed at 192.168.1.1 (or wherever your gateway is) If you're managing your router through a cloud interface, the POSTS will be directed towards linksyssmartwifi.com

Internet Connectivity Heartbeats - These are used to figure out if you have an active internet connection. They'll be aimed at connect.linksys.com

Speedtest Requests - These requests are used to provide support for the speed test functionality. They're typically aimed at linksys.ookla.com or linksysconnect.speedtest.net and are only used to download the flash object that performs the speed test

GUI/html Requests - These are GET requests used to build the html page, aimed 192.168.1.1

However if you set up a cloud account and use the remote admin interface to change your router's settings, youll see lots of WAN-side traffic to the Linksys cloud.

I wish Pfsense hardware was more affordable so more people could afford to run it.

pfSense is based on FreeBSD. there is no "pfSense hardware", just x86 machines.

I wonder what's the cheapest/most low-power hardware that could do that job? A Raspberry Pi is too underpowered (putting Ethernet on USB is also a big problem), but what's the next step up from there?

Anything that has the right ports should work.

Not sure about psSense, but I use this box to run VyOS [1]:

https://world.taobao.com/item/520967318043.htm

1.8GHz dual core celeron, 2GB RAM, 25GB SSD, wireless + gigabit LAN, fanless and in a nice box with power supply for $100 + shipping.

Disclaimer: No idea how difficult it is to purchase from taobao internationally and this vendor/model may not be the exact one I'm using, but it gives you an idea of the economics that are possible.

[1] http://vyos.net/wiki/Main_Page

See my ebay link above.

You're not part of the solution here

Hi Jim please see my reply above.

We have a dual Ethernet ARM (looks like beaglebone black) in the works.

https://twitter.com/gonzopancho/status/737918774582579200

pfSense sell "pfSense hardware" at https://www.pfsense.org/hardware/

And ARM. https://twitter.com/gonzopancho/status/737918774582579200

I offer them on ebay for $44 + Shipping. It is not hard to just build your own. 3ghz core 2 duo machines with 4GB and room for a 2nd NIC are the way to go to keep cost down in my opinion.

http://www.ebay.com/itm/Quiet-3-0GHz-core-2-duo-pfSense-Fire...

I don't think you're part of the solution

So, why isn't selling cheap pfsense devices on eBay part of the solution to avoiding vendor spying? Because you also sell pfSense hardware and it's more expensive?

because that's the revenue we use to pay the developers.

I'm not sure what you mean by "vendor spying". Perhaps this is a reference to the FCC-required controls for 802.11 devices.

I only entered the market by accident. There is not much of a barrier to entry. I bought 50 machines from a recycling company in Maryland for another project. My friend suggested putting pfsense on them and selling them on ebay to help get rid of them. Your lowest cost product is $299. I am sure you know this industry better than I do. Ping me offline if needed.

Have you made a significant amount of money from this? What is your profit margin? This sounds like a good business.

No, we only sell ~4 machines per week. Profit margin at this price is thin. Maybe we need a better marketing campaign :) The machines without hard drives cost me $20 each. I got a bulk deal on hard drives and network cards. Once we sell all 50 machines, we don't plan on selling any more.

Ubiquiti ERLite runs Vyatta on Debian on MIPS. $100 and it has TCP + VPN offload and 3 real interfaces. It might be possible to run PFSense on it; I've installed PFSense to a CF card on an IDE adapter running in a thin client (you can also find these on eBay, some with PCI-E even...check out the HP T5745 for example). You can find a lot of thin clients on eBay for under $100 if that's what you want, and most are fanless and low-power. The only issue is fitting multiple NICs, but again, PCI-E if you know where to look.

Vyatta has limited their web gui to their paying subscribers for years now. Probably negates any cost savings from using Pfsense.

So the bottom line of this settlement is:

1. You can still load openwrt etc to TP-Link routers.

2. TP-Link needs to do something(e.g. set hard-limit on TX power in some binary blob or something) to make sure nobody can increase Wifi output power above the "safe" threshold.

Now as someone said in the thread, UBNT might have the real high-power WIFI devices(e.g. point-to-point outdoor) that can cause real interference to airplanes etc, it seems UBNT is not impacted at all, which is odd.

I think the tricky part has always been dynamic frequency selection, where the 5GHz WiFi radio is supposed to listen for a radar chirp and switch channels if it hears one. It's my impression that the hardware typically already supports some form of maximum transmit power configuration that the Linux drivers can further restrict but not loosen on the basis of the software's regulatory domain setting.

I have seen high-power WIFI card with amplifiers that can do really powerful TX output and the linux drivers are free to tune that output to its physical upper limit.

But this isn't about the case, you can always chain your router to an external amplifier (your SNR might be a bit flaky but that's another issue) you can always hard mod your router to do whatever you want.

This is a simple case of the routers adhering to the specs out of the box and that the spec could not be modified via software, and I really haven't seen that many TP Link routers that can actually broadcast outside of the "safe" spec, most of them can be unlocked to use the forbidden channels on 2.4 but their power limits are pretty low.

correct, even without amplifiers I have used high-power wifi-cards, however I have not tried any high TX output on any TP-Link products, which is odd why TP-Link becomes the target.

From reading the full document it seems that the default TP-Link software allowed the routers to operate at higher power levels.

"TP-Link violated the Equipment Authorization and Marketing Rules by marketing routers in the United States that were shipped with TP-Link software that permitted the user to change the country code for the router, thereby enabling the router to operate at a higher power than allowed on certain restricted Wi-Fi channels."

This doesn't seem to have much to do with OSS/3rd party firmware support which is a whole other can of worms that the FCC opened a few months ago. This is also seem to be limited to 5ghz only where I guess the US has more restrictions.

The bottom line of the settlement is:

1. You still can't load openwrt etc to TP-Link routers

2. TP-Link needs to do something (e.g. lock down their routers not to allow third party firmware like openwrt) to make sure nobody can increase Wifi output power above the permitted threshold

3. TP-Link have agreed to investigate ways of locking down their routers that don't block openwrt etc, but only so long as this doesn't force them to use chipsets capable of enforcing the restriction at the hardware level (because that would be expensive).

FCC announcement: http://transition.fcc.gov/Daily_Releases/Daily_Business/2016...

Direct Link to the ruling: http://transition.fcc.gov/Daily_Releases/Daily_Business/2016...

Better to stick with those who don't need anyone to require them that.

At least Linksys with Marwell chips has really open WiFi drivers (WRT1900ACS).

The last time I looked it required a proprietary binary blob. AFAIK the only free drivers which work well are ath5k and ath9k.

For firmware. The driver itself is open. I don't think even Qualcomm have open firmware for 802.11ac chips. That's an unfortunate trend. While drivers are getting more open, firmware blobs are becoming more prevalent, in GPUs, WiFi and etc.

The really unfortunate thing is that they're putting the wrong things into the proprietary firmware. I'd be fine with signed proprietary firmware that only enforces FCC limits and regulations. That would make it harder if I wanted to sell my used equipment overseas, but wouldn't otherwise restrict my freedoms.

I'm not fine with the bottom half of the network stack being offloaded to the proprietary firmware where we can't adjust or even directly see things like how many packets it's buffering and how it handles aggregation and retransmissions.

https://omnia.turris.cz/

Would it be possible to do any real harm (to humans, pets, etc) by increasing this power setting or would this only cause interference with other electronics?

Also, which models is this for?

Harm to biological entity's no way.

"causing interference" In theory, yes the possibility exists. In practice not likely.

Other wifi ap's neer by might be drowned more than they would otherwise. You could call that interference.

> In practice not likely.

Depends. It apparently is real enough. Higher 5GHz WiFi band channels can interfere with airport radar. That's why the standard mandates a router to switch to another channel if it detects radar signals.[1]

But of course using an illegal channel is simply illegal...

[1] http://wifi-insider.com/wlan/dfs.htm

I cannot imagine why you're being down-voted. This isn't hypothetical; the FCC imposed these security restrictions after reports of actual interference to airport weather RADARs.

https://www.fcc.gov/general/u-nii-and-tdwr-interference-enfo...

Note however that it appears that virtually all of those instances of interference were tracked down to Ubiquity point to point link devices. TP-Link's ordinary consumer access points and routers may have been out of compliance with the letter of the law, but they weren't causing actual harm to airport operations, let alone enough harm to justify banning OpenWRT.

One individual home router operating illegally won't do much to increase the noise floor, but each router operating illegally adds that much more to the background noise and makes it that much more difficult for the weather radar to function properly. So yes, they were doing harm to airport operations. It's just like light pollution -- one light won't block out the stars, but a million will.

Do you have specific knowledge that diffuse ground-based access points impair the narrow beam TDWRs at issue, or are you just making a broad generalization? It's a decent analogy, but I can think of quite a few differences between a short range weather radar and a radiotelescope.

It was one of the things discussed when making the decision to allow restricted use of the frequencies. Also, keep in mind that more than just airport weather radar use the frequency range in question. That frequency range is also used for satellite uplinks and downlinks. There was a lot of research put into the FCC's decision before it was enacted.

https://www.ntia.doc.gov/files/ntia/publications/ntia_5_ghz_...

https://apps.fcc.gov/edocs_public/attachmatch/FCC-14-30A1.pd...

Those are informative but rather long documents. Are there any specific portions you'd like to call my attention to? Because I'm seeing statements like "There have not been any cases of TDWR interference identified for other unlicensed device applications" (referring to things other than outdoor point to point links), and the sole satellite communications provider operating in the U-NII-1 band being concerned only with limiting the power radiated upwards from outdoor access points and unconcerned with indoor access points.

For such a well-studied topic and with such strong regulation on the table, there really ought to be something relevant and approaching a smoking gun to point to.

And how many home users in practice even modify the firmware in the first place.

They were causing interference because they could be (and were) modified to behave in a way that violated FCC regulations. So the FCC made another regulation that said devices should not be modifiable in that way. This seems totally sensible to me. TP-Link violated this rule--not just the "letter" of it.

Also, nobody has banned OpenWRT. If you read the consent decree, you'll see quite the opposite.

> "Also, nobody has banned OpenWRT. If you read the consent decree, you'll see quite the opposite."

The FCC's initial knee-jerk reaction was very much along the lines of banning OpenWRT, and TP-Link subsequently deployed firmware to make it harder to put OpenWRT on their routers. Sure, they're now saying that it wasn't their intention and that they'll try to find a way to avoid it, but banning OpenWRT was and still is on the table and TP-Link and others have taken steps down that road.

As for the FCC rules: they still haven't put forth a clear explanation of how easy or hard the modifications have to be to get a router vendor in trouble. TP-Link's routers are still not fully secured, and just about everybody else still has routers on the market that are no more secure against modification than the TP-Link products. Absent any evidence of actual interference being traced to TP-Link products, it doesn't look like the FCC is merely being strict about enforcing their rules—it's more like they're making an example of TP-Link but deliberately withholding from a broader enforcement campaign while they and the industry try to figure out what to do (ie. can currently deployed hardware be made secure enough without locking it out of third-party firmware?). Meanwhile, the FCC is still having a chilling effect on open-source wireless router software and they still haven't provided any strong evidence that the harm is justified.

This seems like a long way of saying: "correct, nobody has banned OpenWRT, but the new FCC rules have made it riskier for manufacturers to support things like OpenWRT in the future."

To which I would mostly agree, with an important caveat: TP-Link's violation actually had nothing to do with allowing third-party software like OpenWRT. Its own UI allowed end users to change region settings. This seems clearly problematic under the Commission's rules, even if the rules are vague in other respects.

So, on balance, I think this order sends an important signal that very well may be able to support things like OpenWRT without getting into trouble. But you're right that we don't know that for sure, given the language of the decree. All we know is that the FCC would really like it if the industry could figure out how to support OpenWRT, etc. without simultaneously making it easy to circumvent FCC rules.

> This seems like a long way of saying: "correct, nobody has banned OpenWRT, but the new FCC rules have made it riskier for manufacturers to support things like OpenWRT in the future."

Nope. TP-Link has locked out OpenWRT. It's not a highly effective lock, but it is real and they actually deployed it as an update for existing hardware in the field and for new sales. They're not going to revert to the way things were and instead are trying to develop a new security strategy that clearly won't be feasible on the existing hardware that is now locked out.

And it's not like any router vendor ever actually actively supported third-party firmware; it's just a matter of how much DRM they use to interfere with it.

Ah. I see the disconnect here. "Ban" connotes a rule made by an entity in authority to prohibit something. So I had been thinking you were accusing the FCC of banning OpenWRT.

If you're saying that TP-Link has banned OpenWRT, I might quibble with your use of the word "ban," but I'd basically agree. (Maybe "block" would be better? I see that you yourself are shying away from saying that TP-Link actually "banned" anything, in favor of the phrase "locked out".)

Whether the FCC issues a clear and direct edict or if they merely intimidate the vendors into blocking third-party firmware, the effect for consumers is the same and the blame rests in the same place, so I don't think it's inappropriate to use the word "ban" to cover both cases. Until a large-scale commercial vendor of wireless routers stands up to fight on the side of open and hackable routers, the distinction is of no consequence.

Fortunately, the FCC might be backing down due to other sources of resistance and outcry. But that's not yet clear.

The rules for using DFS 5ghz channels are so harsh that the networks built with them are almost uselessly unreliable. You're /far/ better off just not using channels requiring DFS. Especially if it means you can actually own the equipment you paid for.

Which also reminds me of LTE-U vs WiFi. I wonder if the fundamental problems are similar.

Interference with other electronics, especially other wifi networks. Unused radio spectrum in an area is a limited resource, and if you transmit at a higher power level, you're getting longer range but you're also consuming that resource in a larger radius.

Yes. The FCC allowed operation outside the normal Part 15 unlicensed band range in exchange for the makers of wifi devices promising not to intrude on certain areas within that range of frequencies. By increasing the power setting, you're disrupting navigation services, weather services, aviation services and maritime services. Some of these services are very sensitive to interference, and by setting up your devices to use those frequencies, your little router is essentially screaming into their ear, blocking people from getting information that may be essential for their safety. If you want more bandwidth, pester vendors into hurrying up with 802.11ad devices, don't go tromping on the neighbors' rf lawns.

the big topic is weather radar on 5ghz channels at least in europe. The wifi router has to detect that and stop transmitting[1].

Besides that I don't think you can do soo much harm... on the models with pluggable antennas you pump of the power to 500mW and add some additional power through an antenna but in practice that buys you little or even does worse to your wifi... however DD-WRT allegedly got some knobs to do this and lot's of people did (higher is better!11!!) and this caused some fallout that the seemed to put the FCC into the need to intervene.

Most wifi routers you can buy max out at 100mW some do 500mW you can multiply that if you add custom antennas but then the energy is directional.

There is no harm to humans to animals, maybe eventually if you sleep and live directly (<100cm) next to the antenna 24/7 but even then your smartphone likely uses more power speak to the cell tower.

1: http://wifi-insider.com/wlan/dfs.htm

> some do 500mW you can multiply that if you add custom antennas...

I am somewhat confused here. How can an antenna (a passive device) multiply (or amplify) the power? Yes, it can effectively increase the range by allowing the signal to propagate farther, but actually multiply the power? I don't think so, unless it also includes a signal amp/booster.

you are correct. sorry. here is a link that explains it well: http://www.tp-link.us/FAQ-3.html

I was refering to the ERP - in the article:

> Even the law states [wrongly] that the "Effective Radiated Power (ERP) will not exceed..." and this is based on the input into the antenna multiplied by the antenna gain.

So you are correct! Thanks for pointing that out!

RF is a bit more complicated than that, you have also a specific gain on an antenna. https://en.wikipedia.org/wiki/Antenna_gain

The gain on the antenna doesn't create "energy" but it tells you how efficient an antenna is and what its RF characteristics would be, in general a high gain antenna is a directional one it would send a more focused transmission and would attenuate better to a receiving transmission from a certain direction only, a low gain antenna would have a more uniform RF profile (doughnut/spherical).

High gain antennas are usually used for point to point applications so MW transmitters, P2P Wifi Links, TV/Satellite etc. while low gain antennas are used in devices where the transmission can come from any direction like for example GPS receivers, cell phones and handheld radios.

For Wifi for most applications you would want a low gain antenna on your routers/AP's as they would give you uniform coverage, people often buy high gain antennas without understanding what it means, it's great if you want to line of sight 2 AP's across long distances but unless you also want to line of sight your XBOX it wouldn't have any positive impact on your wifi reception at home.

The term "gain" is a bit unlucky, because it does not really describe what's happening. A much better term would be "directivity". Antenna gain is always with respect to a reference pattern; usually a perfectly omidirectional isotropic pattern is assumed and the gain tells you, how much of the antenna radiation pattern is "compressed" into the spatial direction you're looking at, compared to a plain isotropic antenna.

For example if you're looking at a plain old dipole antenna, then in the plane perpendicular and centered around the dipole you'll see a +5dB gain as if the antenna was perfectly omnidirectional. But if you move out of the plane, say right into the axis of the antenna (but some distance away) there will be very few signal, so what would have gone there has been redistributed into a different spatial direction.

Now consider you have a wireless device sending with 20dB(mW) = 100mW and attach an antenna with a directivity gain of 20dB to it. Then to a receiver that happens to be located within the directivity pattern it looks as if there was a transmitter sending with (20 + 20)dB(mW)=100*100mW = 10W through an omnidirectional radiator.

It's one of the few cases where English is lacking a distinctive term. In German the term used for antenna gain is called "Gewinn", whereas amplifier gain is called "Verstärkung".

According to the /. comments "Requires" is wrong. They "support" them doing that (i.e. that there are not legislative obstacles to it).

Woo! Cheap Wi-Fi routers with the possibility of open source firmware!

bws111's post from the Slashdot thread:

Nowhere in that document does it say the FCC REQUIRES TP-Link to allow open source. What it says is:

“While manufacturers of Wi-Fi routers must ensure reasonable safeguards to protect radio parameters, users are otherwise free to customize their routers and we support TP-Link’s commitment to work with the open-source community and Wi-Fi chipset manufacturers to enable third-party firmware on TP-Link routers.”

They SUPPORT a company working with open-source, not REQUIRE,

Later on it says: TP-Link has also agreed to take steps to support innovation in third-party router firmware by committing to investigate security solutions for certain 5 GHz band routers that would permit the use of third-party firmware while meeting the Commission’s security requirements and maintaining the integrity of critical radio parameters.

So the requirement is that any open-source stuff must meet the security requiements and maintain correct operation, not that they MUST allow open source,

Title is inaccurate, TP-Link only committed to investigate supporting third party firmware (including open source).

From the FCC announcement (similar language is in the ruling):

> committing to investigate security solutions for certain 5 GHz band routers that would permit the use of third-party firmware

We updated the link from the Slashdot post (https://build.slashdot.org/story/16/08/01/1855206/fcc-requir...) to the official announcement.

Reply on news.ycombinator.com