ReadyCloud security issues

Hi.

Thanks for the answer, but I can't agree. I've just connected to my NAS from corporate network, where no NETGEAR home routers are in use. The connection to my NAS through readycloud.netgear.com is still insecure (http://readycloud.netgear.com).

Regarding the issue#2, no, I was not able to download files after I've disabled ReadyCLOUD on the NAS.

Regards,

Greg

---

JohnCM_S wrote:

The ReadyCLOUD web portal actually runs on HTTPS, all connections from apps, portal and back-end access are on HTTPS. 

 

The reason that you see HTTP on the web portal is for the NETGEAR home routers where they also connect to ReadyCLOUD. However, due to their specifications they usually are having a hard time maintaining HTTPS connection because of certificates being updated from time to time. So seeing the portal on HTTP is just actually for the routers to be able to use its feature but ensuring back-end and other access is secured using HTTPS and VPN connections.

---

This is exactly the part I never understood - and honestly, there is something essentially wrong. Had discussed this with the designer years ago before Netgear took over the ReadyNAS business ...

The data path is this:

Web Browser <-> http://readycloud.netgear.com/ <-> ReadyCloud cloud infrastructure <-http or https or much more a LeafNetworks "protected" IPv4 tunnel -> ReadyNAS or Netgear Consumer Router

Ok, to make this connection possible, the RedyNAS resp. the Netgear Router does establish a connection to the ReadyCloud cloud infrastructure using the Leaf Networks "tunnel" (yes, Jeff Capone never liked me stating it's a tunnel, but hey...) encapsulating/encrypting the Leaf Networks "borrowed" IPv4 subnet (available at the design time, now also assigned to a real Internet user) - certainly between the ReadyNAS and the ReadyCloud cloud infraructure. 

The restriction of the why ever crappy code and certificate handling on the Netgear consumer routers (sigh...) apparently not able to establish a https or secured connection to the cloud infrastructure can't explain why the ReadyNAS (which apparently does based on my investigations on the Intel x64 based units - not sure of this applies to the low power RN1xx).

Let's take the long story short: This does deny using ReadyCloud - certainly the Web portal which does indeed forced to http only - usage in todays Internet world.... even shorter: It's a DEAD HORSE.