Orbi and WEP

Question

I’ve been under the assumption that using WPS encryption is insecure, and the best encryption is to use WPA2 (hopefully with the Krack exploit patched). I noticed that it seems the Orbi system does use WPS through pushing the sync button on the router and/or satellite(s). Previous routers I’ve owned had the ability to completely turn off WEP.

With that in mind, could someone comment on how secure using WEP (through the sync button) is when using an Orbi System?

Also, does anyone think it may be beneficial if down the road Netgear added the ability for an end user to choose if they want WEP enabled or disabled on each individual device through a future firmware update (of course, after Netgear fixes the bugs that have been causing a lot of people to experience seemingly random wireless internet disconnections)?

st_shaw · Answer

You are mixing up a few things here.
&nbsp;
WPS is not the same as WEP. They aren't even the same type of thing. &nbsp;WPS is a method for two devices to associate with each other without using a password or the WiFi SSID. &nbsp;WEP and WPA2 are encryption methods. WEP is insecure. &nbsp;WPA2 is the most secure.
&nbsp;
WPS will only work on devices that support WPA or WPA2 encryptiion.
&nbsp;
Orbi doesn't even support WEP.
&nbsp;
WPS can be less secure than using a passphrase. &nbsp;Orbi only supprts the push-button mode of WPS, which is the most secure WPS method. &nbsp;However, this also means anyone that can touch your Orbi can access your network via WPS.
&nbsp;

st_shaw · Answer

I'm not sure if you have a question anymore, but clearly, WPS should be turned off on an outdoor device.

larryindublin · Answer

st_shawwrote:I'm not sure if you have a question anymore, but clearly, WPS should be turned off on an outdoor device.I understand what is is saying. The risk of someone just coming up to your outdoor Orbi is you can connect just by pushing a button without knowing the password, so they allow turning WPS totally off. While a little lower risk, it still is there for the indoor units. For example: I have a contractor working on the house. I can CHOOSE to give them guest wifi access but they could also just push the WPS button and get connected to my router.&nbsp;I agree, that functionality should be able to be totally turned off.&nbsp;

j1n · Answer

The RBS50Y not only lets you disable the Sync (WPS) button, but the online setup manual (screenshot attached), states the physical sync button will automatically be disabled once the outdoor Orbi is synced to your router and Netgear recommends keeping the sync button turned off for security reasons. I was questioning that since I have the ability to turn on/off the physical sync button on the RBS50Y, that I would like to have that ability to turn on/off the Sync button on the router and satellites if I wanted to through the router interface.

st_shaw · Answer

&nbsp;
j1n Thanks for the information.&nbsp; I have an RBS50Y arriving Monday.
&nbsp;
After reading what you posted, I now see the part about the sync button being disabled in the RBS50Y user manual on page 19.
&nbsp;
I checked on my RBR50 and there is no setting to disable sync/ WPS on the indoor RBS50 Orbi satellites, like you can with the outdoor satellite. I guess it's something NETGEAR could probably add, if they wanted to, but chose not to.
&nbsp;

Forum Discussion

Orbi and WEP

10 Replies