Hacker News new | ask | show | jobs
by vel0city 830 days ago
> I don't trust my ISP to handle my personal information with discretion

I'll start off by saying I'm not a fan of being forced to use their gateway. It's essentially just superfluous equipment in my network closet and another point of failure in the chain. I'd rather just be able to reliably patch directly in, but such is life.

That said, there's no loss of privacy with the gateway in bridge mode and me patching directly in. In the end they see whatever I expose on my router and they see all my packets. There's no functional difference privacy-wise here, unless they've got microphones or something on the gateway. Maybe they're sniffing wifi, but so can a car driving by.

FWIW, AT&T does this because AT&T does what AT&T does. They were doing it back in the day with their DSL service as well. There's a little more compatibility challenges when it comes to PONs versus DOCSIS modems, but theoretically one could buy an ONT and have it participate on the network. The actual ONT is just a media converter though, and without AT&T's gateway to auth you properly you're not going to be able to send any traffic.

As mentioned elsewhere though, I've been using AT&T's service for a long time. I've never had a modem rental line item in my bill.

1 comments

AT&T Fiber in bridge mode is not actually bridge mode. It's some weird 1:1 NAT if I recall, and buggy in certain conditions.

You can get the 802.11x certificates off the gateway itself and auth via your own equipment though if you are sufficiently motivated[0].

I believe there are some newer methods as well, but I haven't kept up on it since I've luckily been able to get a different provider since that doesn't play games with the gateway devices. RCN at least lets you BYOD and is an ONT only.

[0] https://github.com/owenthewizard/opnatt

I'm aware of how the AT&T bridge mode works, it makes no functional difference to my security argument. The only issues I've personally seen is overloading the NAT state table, largely from running multiple crypto wallets or multiple torrent clients with wide open connection settings.

You can get the 802.11x certificates off the older gateway for now older firmware versions, but newer hardware doesn't have the same exploits.