Hi folks, so I have definitively determined that it was my Private DNS service configuration that was causing logins to fail. Once I go into Network Settings and disable Private DNS entirely, the login succeeds. It does not appear that it was any one DNS query that was tripping it up, but the fact of having enabled Private DNS at all. This is obviously a bug and I will report it through the app. I'm going to need to keep Private DNS enabled for my own sanity and usability, and none of my other apps break in this manner.

Having said that, there's a few other annoyances I want to ask about. Firstly, every time I log in, is it going to nag me about enabling Fingerprint Scanner? I'm not enabling Fingerprint Scanner, no thanks never. Can I disable the nag dialog so that I am not impeded every time I log into my router through the Netgear app? Thanks.

Also, "Anywhere Access" feature is problematic. I don't want and don't need "Anywhere Access" to my router. This is actually a giant security vulnerability that you should absolutely never enable unless you have no choice. I have no idea how Netgear manages their cloud servers and I won't have you poking holes in my router's security just to let any hacker bang on my administrative login port. Unfortunately, the app seems to enjoy enabling this option without my consent, and re-enabling it after I've disabled it. These are, of course, Dark Patterns, and they are bugs and they are security issues worth of CVEs and urgent updates. I will, of course, submit another bug report on this.

Just now I browsed a few settings throughout the app, and apparently it has gratuitously disabled my Smart Connect WiFi setting without my consent. Another bug, another Dark Pattern: why disable a useful performance feature? I did not press that switch and I had just verified that it was activiated as I left it.

Why is Netgear's Nighthawk app changing so many settings without user intervention? Is this intended as a security-breaking app or a security-preserving app?

Forum Discussion

Orbi Log capturing ARP attacks from an internal device (TP-Link HS200)