HP printers try to send data back to HP about your devices and what you print

Re:HP printers try to send data back to HP about your device... by dvdkhlng on Sunday September 15, 2019 @09:57PM (#20980547)

These kinds of concerns are why I put all my "untrusted" devices on a separate VLANs, so I can reliably shut them out of the internet. Simple VLAN-enabled switches don't cost that much any more. Such a switch allows you to treat any port of the switch as a distinct network interface on your main router, where you can just disable forwarding for selected interfaces entirely. It also prevents your untrusted devices from seeing each other, i.e. your printer wont't be physically able to send ethernet frames to your VoIP phone, even if connected to the same switch. Here is some introduction to the concept:

http://corecom.com/external/livesecurity/vlans.htm

[ Parent | on HN ]

Re:HP printers try to send data back to HP about your device... by fucking_tragedy on Sunday September 15, 2019 @10:39PM (#20980698)

> Simple VLAN-enabled switches don't cost that much any more.

They're dirt cheap and have been for the better part of a decade. If you're looking to upgrade, cost isn't a reason not to.

[ Parent | on HN ]

Re:HP printers try to send data back to HP about your device... by dngray on Monday September 16, 2019 @06:22AM (#20982641)

I did exactly that:

• http://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_...

• https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...

My printer is in a VLAN which has no route out over the Internet. (The second link there uses VLANs).

[ Parent | on HN ]

Re:HP printers try to send data back to HP about your device... by dvfjsdhgfv on Monday September 16, 2019 @03:23AM (#20981780)

True, but assigning it a static IP and blocking egress traffic originating from it should accomplish the same thing.

[ Parent | on HN ]

Re:HP printers try to send data back to HP about your device... by dvdkhlng on Monday September 16, 2019 @03:38AM (#20981864)

I think static IPs and blocking egress traffic only keeps well-behaved devices from doing any harm.

It does not protect you from compromised, malicous (IoT) devices. Think about a network printer doing ARP spoofing and MiTM-attacking your VoIP phone or IP cam. E.g. googeling immediately turns up vulnerabilities like this [1] one. A properly configured VLAN setup can help to prevent or limit this threat.

[1] https://www.scmagazine.com/home/network-security/hp-officeje...

[ Parent | on HN ]

Re:HP printers try to send data back to HP about your device... by DCoder on Monday September 16, 2019 @09:18AM (#20983699)

New printer next year: "Hmm, I can't contact my telemetry server with these internet settings… time to connect to any open Wi-Fi I can find nearby!"

[ Parent | on HN ]

Re:HP printers try to send data back to HP about your device... by jlgaddis on Monday September 16, 2019 @02:09AM (#20981498)

VLANs, huh? I'll have to Google that sometime. ;)

[ Parent | on HN ]