Orbi and WEP

[j1n]

I’ve been under the assumption that using WPS encryption is insecure, and the best encryption is to use WPA2 (hopefully with the Krack exploit patched). I noticed that it seems the Orbi system does use WPS through pushing the sync button on the router and/or satellite(s). Previous routers I’ve owned had the ability to completely turn off WEP.

With that in mind, could someone comment on how secure using WEP (through the sync button) is when using an Orbi System?

Also, does anyone think it may be beneficial if down the road Netgear added the ability for an end user to choose if they want WEP enabled or disabled on each individual device through a future firmware update (of course, after Netgear fixes the bugs that have been causing a lot of people to experience seemingly random wireless internet disconnections)?

[st_shaw]

You are mixing up a few things here.

WPS is not the same as WEP. They aren't even the same type of thing.  WPS is a method for two devices to associate with each other without using a password or the WiFi SSID.  WEP and WPA2 are encryption methods. WEP is insecure.  WPA2 is the most secure.

WPS will only work on devices that support WPA or WPA2 encryptiion.

Orbi doesn't even support WEP.

WPS can be less secure than using a passphrase.  Orbi only supprts the push-button mode of WPS, which is the most secure WPS method.  However, this also means anyone that can touch your Orbi can access your network via WPS.

[j1n]

You are right. I did mix up “WPA” & “WEP” with WPS. Regardless, WPS can be turned on or off on the Orbi outdoor wireless satellite (RBS50Y) for security purposes. I guess that doesn’t make sense with the Orbi Router and indoor satellite(s).

[st_shaw]

I'm not sure if you have a question anymore, but clearly, WPS should be turned off on an outdoor device.

[larryindublin]

---

@st_shawwrote:

I'm not sure if you have a question anymore, but clearly, WPS should be turned off on an outdoor device.

---

I understand what is is saying. The risk of someone just coming up to your outdoor Orbi is you can connect just by pushing a button without knowing the password, so they allow turning WPS totally off. While a little lower risk, it still is there for the indoor units. For example: I have a contractor working on the house. I can CHOOSE to give them guest wifi access but they could also just push the WPS button and get connected to my router.

I agree, that functionality should be able to be totally turned off.

[st_shaw]

I agree with what you wrote.  But, if somoene can touch your Orbi to push the WPS button, they can plug something into a LAN port and access the LAN directly.  So, WPS ON or OFF doesn't make a huge difference in security if someone has physical access to your router.

[j1n]

“I agree with what you wrote. But, if somoene can touch your Orbi to push the WPS button, they can plug something into a LAN port and access the LAN directly. So, WPS ON or OFF doesn't make a huge difference in security if someone has physical access to your router.”

The Outdoor Orbi does not have any LAN ports, so they added the ability to turn off WPS (sync button) so no one can easily get access to your network. Since the other Orbi satellites have LAN ports, you’re saying that it wouldn’t matter if the WPS (sync) button was disabled or not because they could use a cable to get into your network.

Is the Sync Button (using WPS) only used to sync the router with the satellites, or could someone get wireless access to the network by pressing the sync button?

[FURRYe38]

The Sync buttons\ on Satellites is ONLY for getting the Satellite(s) connected to the main routers wifi. 

[st_shaw]

1n wrote:

“I agree with what you wrote. But, if somoene can touch your Orbi to push the WPS button, they can plug something into a LAN port and access the LAN directly. So, WPS ON or OFF doesn't make a huge difference in security if someone has physical access to your router.”

The Outdoor Orbi does not have any LAN ports, so they added the ability to turn off WPS (sync button) so no one can easily get access to your network. Since the other Orbi satellites have LAN ports, you’re saying that it wouldn’t matter if the WPS (sync) button was disabled or not because they could use a cable to get into your network.

Is the Sync Button (using WPS) only used to sync the router with the satellites, or could someone get wireless access to the network by pressing the sync button?

---

Makes sense there are no LAN ports on the outside Orbi, because "yes" anyone can access your network if they plug into the LAN. Unless you "Block all new devices" based on MAC addresses.

According to the Orbi User Manual the sync button on the router is used to connect WPS-enabled clients. The satellites are WPS clients, so their WPS button should not allow other clients to join the network.

Since it's a client, it makes no sense that the RBS50Y would allow you to disable WPS.  In fact, I don't see anything about disabling WPS in the RBS50Y user manual.  Where did you get the information that WPS could be disabled on the RBS50Y? 

[j1n]

The RBS50Y not only lets you disable the Sync (WPS) button, but the online setup manual (screenshot attached), states the physical sync button will automatically be disabled once the outdoor Orbi is synced to your router and Netgear recommends keeping the sync button turned off for security reasons. I was questioning that since I have the ability to turn on/off the physical sync button on the RBS50Y, that I would like to have that ability to turn on/off the Sync button on the router and satellites if I wanted to through the router interface.

[st_shaw]

@j1n Thanks for the information.  I have an RBS50Y arriving Monday.

After reading what you posted, I now see the part about the sync button being disabled in the RBS50Y user manual on page 19.

I checked on my RBR50 and there is no setting to disable sync/ WPS on the indoor RBS50 Orbi satellites, like you can with the outdoor satellite. I guess it's something NETGEAR could probably add, if they wanted to, but chose not to.