Plusnet Hub 2 new firmware forcing https

[#1]

My Plusnet Hub 2 suddenly started forcing me to use https to access the web interface. 
As I hadn't seen the message before, I did a little searching to check it was legit - I couldn't find anything here or on the Plusnet site, but I found that this is something that was introduced last year on BT hubs that the Hub 2 is based on. 
It looks like the firmware is starting to roll out to us. 

Unfortunately, the new firmware means that you need to sign in as admin for more screens and the whole web app appears to be much more sluggish 😣

It's a shame that there isn't any info or warning before the roll-out!

Even the sticky post with current firmware is out of date.

New Firmware: v0.11.01.11071-PN


Here's a screenshot from the web app Technical Log page:

[#2]

@andyleonard Where are you being 'forced' to use HTTPS, which is designed as a security measure, and should be used in preference anyway, especially on sites involving potential leakage of personal data, anyway?

[#3]

@jab1, I assume that the OP means when accessing the admin page of the router using 192.168.1.254.

They have added an image of the firmware which states a release of the 2nd June.

[#4]

@mystreet1 I actually thought that was what they meant, but just wanted to make sure, as the question, or the use of 'forcing', didn't make much sense to me, and still doesn't.

[#5]

Yeah, @mystreet1 and @jab1  you are both right.
Re-reading my post, it's not as clear as I thought (I knew what I meant) - if I could edit it I would change the title and try to explain better.

When I was referring to https, it is specifically for the Hub 2 web interface - and I agree websites should use https for security. It's maybe a little overkill for a local IP (192.168.1.254) and somewhat undermined by the Hub is using a self-signed certificate, meaning you have to specifically disregard the browser warnings.

There is a thread over on the BT Community forum from December last year that explains the behaviour seen when the changes were applied to the BT Hub firmware.

tldr: There is a new undocumented firmware that changes the behaviour of how you access the Hub 2 management console.

• New firmware v0.11.01.11071-PN applied automatically on 2nd June (now showing in the sticky post PN Hub Latest Firmware Versions
• You are forced now need to use https to access the web interface on your local network
• More pages of the interface now need you to log in with your admin password
• The interface feels more sluggish

[#6]

Yes, you are both right - my post wasn't as clear as I thought it was. The new firmware now requires https to access the Hub 2 web interface.
I wrote a longer post to try to explain but the spam filter doesn’t like it!

Moderator's note:
Longer post released from the automatic Spam Filter.

[#7]

What is the problem, though - HTTPS is more secure and does not affect anything you do. Do you not see the same protocol being used on many other sites?

[#8]

I suspect the issue is that it is a self signed certificate and requires an extra click or two and bypassing a warning to get to the router interface.

[#9]

Thanks, @dvorak . Unfortunately, as I don't have Hub to test...

[#10]

Hi,

Plusnet have published some information regarding the new warning.  See here https://www.plus.net/help/hubgui/hub-warning

[#11]

Thanks, @bakerboy83 - I was unaware of that information as I don't use a  Hub -I'm not even a PN subscriber any more.

[#12]

If the GUI is accessed over HTTP rather than HTTPS, the user should be presented with a warning along with a link to the support article I shared.

Similar to changes introduced in recent BT/EE firmware updates, this behaviour is intended to align with updated cybersecurity requirements associated with the Radio Equipment Directive (RED), as part of CE / UKCA compliance.

[#13]

If I access from Firefox on http, I get the "Switch to HTTPS" message, I click the message and Firefox says "Performing a TLS handshake with 192.168.1.254.... and hangs up.

Edge also hangs.

After power cycling the Hub 2, I managed to get the Hub's home screen to show on my Samsung tablet, but selecting any option asks for the password - which I didn't have at the time, so I shut the browser tab and went on the PC.  Is there a bug that if you've been asked for the admin password on one device it fails to serve any other device?

This is just unnecessary agro for zero reason.

[#14]

On Friday in the early hours, my router was bouncing up and down, and resetting: I later realised it had updated, and I'm wondering if part of it was also a re-tuning of my VDSL link?

So, yes, need to access using HTTPS (makes sense), the bit that annoys me is that, to visit the status page now needs you to log in. Shame there's not an option to NOT need that.

Anyone happen to know what sort of stuff got upgraded in the code? I'll imagine improved TLS ciphers and similar stuff.