Argthtjtr

I got this "Not secure" warning when I'm trying to log in to my router (it's within my physical access). Apparently my router's management (admin) system doesn't have HTTPS.

Chrome also says

Your connection to this site is not private.

I know that when I visit an HTTP website, the data transferred between my endpoint and the remote server could be sniffed by any node among the route, but this time the "remote server" is just the router (which also serves as a wireless AP).

Is it something to worry about, in the following cases? Assume I am authorized to administer the router and have unlimited physical access to it.

1. The router is placed in my home and I fully acknowledge all devices connected to it (my PC, my phone, my family's PCs and phones).


2. The router is placed in a public place (restaurant, hotel etc.) and is open to public in some ways.

No public Certificate Authority (CA) will issue a certificate for a private IP address, such as the 192.168.x.x blocks.

Because of that, I would expect that I would not see an HTTPS connection to a consumer-grade router in my network, and if I noticed such a connection (this assumes, of course, that I'd actually notice the lock icon when it shouldn't be there; which, if I'm honest, I probably wouldn't), then I would be very suspicious that someone had installed rogue certificates, and has an actively snooping proxy somewhere on my machine or in my network.

It is possible to set up a secure HTTPS connection, depending on your router's capabilities. If you can add a certificate to your router, you can create a self-signed certificate. This will effectively encrypt your HTTPS connection inside of a perfectly valid TLS tunnel, although your browsers will be complaining very loudly that the validity of the certificate can't be verified.

There are ways to get past these complaints by the browser, such as adding yourself as a trusted CA on your computer, or getting a certificate for a domain and using your internal DNS or your hosts files to point the domain to the private IP, as mentioned in the comments.

As far as the specific cases that you're asking about:

1, your own home: There should be nothing to worry about, assuming that all other devices are secure. Rogue devices on your network will be able to do packet sniffing, so don't log in using the same password that you log into your bank with (which is good advice regardless of what you're authenticating with).

2, you're hosting a public access point: Assume the network is being actively probed at all times. In this case, I might take the time to set up TLS properly and even then, if I were truly paranoid (I.e., my access point was set up at DefCon), then each time I access the management web page, I would disable wireless, ensure nothing else is connected via any hubs or switches, then change the password before re-enabling wireless and making my configuration changes.

It is common for SOHO devices (switches, routers) that they either do not support HTTPS or provide HTTPS with factory self-signed certificate which cannot be replaced.

I wouldn't worry much as long as:

1. you control the wiring between your PC and router.


2. remote management is disabled over wireless (admin page is allowed only via wired media) media.


3. remote management is disabled from internet.

This is not a problem.

Others here have given technically precise answers which assume general knowledge of how the secure web connections work. However if you have that level of knowledge you will already know the answer to this question. Here is a simpler answer.

Secure web pages (i.e. those with "https" at the start of the URL and a green padlock or similar symbol) are secured by a system of digital certificates. Merely encrypting something isn't enough because it doesn't guarantee the identity of the web site; you may think you are talking to foobar.com, but how can you be sure? The answer is a system of identity certificates with digital signatures. When you go to its website, "foobar.com" sends you a certificate saying that it is the real "foobar.com", and that certificate is signed by one of a number of "certificate authorities" who are generally trusted by everyone to do this job of certifying identity on the Internet. If you click on the green padlock symbol, or whatever your web browser uses, you can see the certificate details.

If an identity doesn't match, or a certificate is missing, or if the link isn't encrypted, then your web browser will warn you about sending passwords because someone could be listening in.

Your home router doesn't have its own certificate signed by a Certificate Authority, but as the link is within just one house that doesn't matter. I suppose it might be better if web browsers shut up about insecure sites on addresses like 192.168.1.1 so that people don't get false alarms.

No, unfortunately the certs will eventually expire and are usually self-signed. Your best bet, would be to make a new one and upload it to your router (if the router has that function).