Secure Routers (resolved)

[django]

When setting up a Netgear WGR614 wireless router I
was surprised to discover that apparently it requires
Java-script to be enabled in order for the router to
function. Since every book on security that I've read
without exception identifies java-script as a security
risk and suggest that it be used sparingly if at all I went
searching for a different router.

I searched this forum with respect to routers in general
and in particular (Linksys, Netgear, etc.). I searched the
STD forum. I did a google search.

There was no shortage of information, in fact there is an
overwhelming amount but I haven't found anything that
addresses my concerns. I've read reviews of the WGR614
that don't mention that it requires java-script enabled.
I found out that one of the Linksys routers defaults to
wireless enabled (which seems like poor security practice).

Even if I would spend a couple of months digging through
these various links I have no confidence that the information
I want would be included.

Would someone here who runs with strong security (java
disabled, java-script disabled, etc. etc. etc. etc. etc.)
steer me to a few routers (preferably that do not smell like
a chemical factory) that do not require insecure
browser settings in order to function?

Django

[OErjan]

actually, i have several wireles routers, and NONE requires java. 3com, Netgear and Dlink (piece of junk imho), try without

[django]

I did try the WGR614 without java-script enabled on
my browser.

I didn't write down the exact wording but
the gist of the error message was that the enhanced
functionality of the router required java-script enabled
and I should either enable it in my browser or get a
browser that supported java-script. It also required
java-script enabled for the router setup and configuration
wouldn't work until I made a java-script exception for
the router's URL.

Which particular models are you using?

Django

PS: Rereading your post I noticed that you said the
routers didn't require java. The WGR614 didn't complain
about not having java enabled, it complained about not
having java-script enabled.

[OErjan]

i use among others a cheap Netgear WAG302EU the other two i can't remember and they are not here in my hotell room so...

[django]

Thanks for the information.

Before I hunt up a WAG302EU could you
confirm that you have both java and java-script
disabled in your browser and that the router
doesn't complain.

Thanks again.

Django

[OErjan]

as i use lynx it is not enabled as far as I know. lynx is a text only browser, it is very basic, even lacks suport for frames
, as far as i know it s only the wizards that require scripts. and as the configpart is only acessible from inside the network much of the threat is not as large (although not to be neglected)

[django]

Lynx sounds interesting.

Anyway, I am using Knqueror and Firefox and
I am mostly concerned with being able to access
websites with java and java-script turned off.

We could nail this down if you would be so kind
as to check

Command Center
--Internet & Network
----Web Browser
------Java & Java-script

and see whether or not java and java-script are enabled.

Django

[OErjan]

ah, ok, i think i understsand, you do not need script to surf using that router, just to configure with the wizard, and no i have no java or javascript enabled.

[Harry Kuhman]

ah, ok, i think i understsand, you do not need script to surf using that router, just to configure with the wizard, and no i have no java or javascript enabled.

You certainly don't need scripting enabled to surf with any router. You might come across one that went overboard on the user interface and wants it to configure the router, but one simple "fix" for that for someone who wanted to avoid any scripting support in their main browser would be to use a second browser just for the rare occasion when they want to configure the router (you could even do this from a virtual machine if you want to exercise extreme caution). If you don't use that browser for anything other than router configuration then the danger is nearly zero, even more so if you rename it, zip it or encrypt it and only put it back when you plan on using it again, but that seems like overkill.

[django]

Good to know that java and java-script are not enabled and your router
doesn't complain.

Regarding the WGR614, I configured it with exceptions for java and java-script
for the router's URL and with java and java-script disabled for all other URLs.
Configuration went smoothly. When I tried to go to a website the router complained
about not having java-script. It would not access the web without it.

If it just required java-script for configuration I could live with it. But the router wants java-script on to surf the web, it won't go anywhere without it on. If I try it
gives me the error message I posted earlier.

It is good to have a lead on a router that doesn't require poor security settings
to work.

Thanks for the help.

Django