NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Changed to use https for admin
Old post, I know. This has happened to me. Just today, I am able to login from my iPhone, but not my MacBook Air. This has to be something to do with the self signed Cert. My iPhone apparently ignore...
Advances in web browser standards have put Netgear in a "Catch 22".
When connecting to the unencrypted (http) web interface, many web browsers now complain, "Insecure!" There is usually a link (in small print toward the bottom of the screen) which can be used to tell the browser to proceed to the web site anyway. After that first time, most web browsers remember this and no longer display the message.
When connecting to the encrypted (https) web interface, many web browsers now complain, "Insecure!" because the SSL certificate is self-signed. Once again, many browsers provide an almost hidden link to ignore the message.
Both of these, of course, ignore the fact that the router is being accessed from within the user's own network and that it is blatantly obvious which device is being accessed. I use the ordinary http interface because there is no point to including encryption.
As a side note, for many years Netgear had registered several URL's with one of the official certificate authorities. (I believe they included http://www.router.com, http://www.routerlogin.com, http://www.orbilogin.com, http://www.orbilogin.net) When those URL's came up for renewal one summer, they were not renewed. I do not recall seeing any formal explanation, i.e.
- Did Netgear simply forget to renew?
- Did Netgear attempt to renew, but the renewal was rejected?
It is ludicrous, of course, that some company could "own" routerlogin.net When a device on the local network attempts to connect to any of those 'special' URLs, the DNS server in the Netgear router intercepts the request and returns the IP address of the router. (often 192.168.1.1) This DNS interception, of course, does not happen when the user specifies the actual IP. It is the improvement in web browser security which has resulted in the connection being labeled "insecure".
It is ludicrous, of course, that some company could "own" routerlogin.net
Not sure why you say that, since Netgear has owned it since 2004 (and still owns all the others you mention). Though details of the registration for all the URLs you mention are private (done through a proxy). FWIW, the registration record for netgear.com is also private.
There are some formatting requirements for domain names, and you cannot register someone else's trademark. Pretty much anything else can be registered.
When those URL's came up for renewal one summer, they were not renewed.
No - what happened is that the cert expired (very different from losing the domain name).
Both of these, of course, ignore the fact that the router is being accessed from within the user's own network and that it is blatantly obvious which device is being accessed.
That behavior (though sometimes annoying) does protect against some real threats.
For example, imagine you connect to a malicious hotspot that has a DNS server that generates self-signed certs on the fly for every website you visit, and connects you to the real website through a proxy. That creates a man-in-the-middle attack, allowing the hotspot to get your credentials (and other personal data) for all the sites you visit while you are connected to that hotspot. The browser warning is intended to protect you from that class of attacks.
