Plusnet Hub 2 new firmware forcing https

[#1]

---

@Talldave wrote:

If I access from Firefox on http, I get the "Switch to HTTPS" message, I click the message and Firefox says "Performing a TLS handshake with 192.168.1.254.... and hangs up.

Edge also hangs.

That shouldn't happen. Have you tried in a private browser window to rule out any issues with session data/browser extensions etc?

Is there a bug that if you've been asked for the admin password on one device it fails to serve any other device?

This is just unnecessary agro for zero reason.

---

Not that I'm aware. The reason for the changes is alluded to in @bakerboy83's reply earlier in this thread.

@paul_blitz wrote:

... I'm wondering if part of it was also a re-tuning of my VDSL link?

Outside of a single reboot to update the firmware, there should be no impact on the VDSL link.

Anyone happen to know what sort of stuff got upgraded in the code? I'll imagine improved TLS ciphers and similar stuff.

The link to the BT Speedtest and references to Plusnet Business have also been removed. Outside of that (and the HTTPS/login changes), it's largely housekeeping stuff.

[#2]

Hmm, just tripped over this today, mine seems to have updated 3 days ago. What a kludge!

Summary: Clunky, inelegant, confusing, ineffective and poorly implemented Tidy it up please. If I'd been responsible for this in my IT working life I'd have been mightily embarrassed! 🤢

[#3]

@HPsauce 

"Summary: Clunky, inelegant, confusing, ineffective and poorly implemented Tidy it up please."

Seemed to go smoothly enough to me! Only snag being the new security requirement to log in to Hub 2 to see or do anything.

If you have an existing browser shortcut to the Hub Manager, change the recorded shortcut link from http://192.168.1.254/ to https://192.168.1.254/

This means you now skip the "Secure Connection Required" warning page and go straight to the Hub 2 Home page as usual. If you then try to open any panel you are asked to log in. You only ever need to log in the once per browser session - presumably even from one session to another if you don't delete cookies on exit.

[#4]

@pvmb Maybe depends on your browser but Edge gives security warnings that you have to override initially and then displays a warning every time that it's insecure.

[#5]

@HPsauce 

"Edge gives security warnings that you have to override initially and then displays a warning every time that it's insecure."

I am using Edge and if you follow my previous post you will find, apart from needing to log in per new browser session, there are no warnings. Continuing warnings means you are accessing it via the old http link.

[#6]

@pvmb I updated my link before your posts. Not even this? 

[#7]

@HPsauce 

"Not even this?"

Yes, but that doesn't matter: https://www.plus.net/help/hubgui/hub-warning/

Your Plusnet Hub uses a self-signed security certificate to encrypt the connection between your device and the hub. Here’s what that means:

• security certificates are used to prove that a website or device is trustworthy and to encrypt the data sent between your browser and that site or device

• most websites use certificates issued by trusted third-party organisations called Certificate Authorities (CAs), which your browser automatically recognises

• self-signed certificate, like the one used by your Plusnet Hub, is created and signed by the device rather than a third party. Because your browser doesn’t recognise the hub as a trusted authority, it shows a warning, even though the connection is still encrypted and secure

It might even be possible to avoid that with suitable settings in Edge - I don't know. My post was how to avoid the warning pages, along with needing to click multiple times to reach Home, people get because of now using an old http link to the Hub's Home page.

[#8]

At least this ought to help with log in across browser sessions, even if you normally clear cookies on exit (as I do).

Edge::Settings::Cookies and data stored / Cookies and site data::Allow
"The following sites can save cookies on your device. To prevent these cookies from being cleared on exit, go to Clear browsing data on close."

Add: https://192.168.1.254/

Edge::Settings::Privacy, search, and services / Clear browsing data on close::Cookies and other site data::Don't clear
"Cookies for the following sites won't be cleared when you close the browser."

Add: https://192.168.1.254/

...Now tested. Seems to work!

[#9]

...Also noticed I previously elected to have "turned off warnings" in browser https security warning link - likely reason I don't get warning pages?

Have now downloaded the Hub 2's certificate: bthomehub.home

Issuer:
emailAddress = ********@bt.com
CN = BT Hub CA
O = British Telecommunications plc
L = London
ST = London
C = GB

- Possibly import it to MS Certificate store under "Others"?

This is getting complicated now. 🤔