Cybersecurity: Serious 'blind spot' discovered in home router privacy

Analysts from the international research center Cybernews studied the privacy policies of 25 major home router manufacturers in the US market and encountered an unexpected problem. It turns out that while technology brands detail how they collect users' personal data, they are often silent or provide vague information about what data the devices themselves collect. The lack of transparency in such devices, which are the main gateway for all data passing through a home network, is worrying digital security experts. This is reported by Ixbt.com reports.

It is worth noting that, according to ixbt.com, this study did not practically test the actual technical operation of the devices, i.e., network traffic, firmware, or hardware behavior. Experts only evaluated the manufacturers' public legal documents and privacy policies. The main problem is that most brands do not create separate documents for routers. Instead, they apply a single general policy intended for online stores, mobile apps, cloud services, surveillance cameras, and smart home devices.

DNS queries and internet traffic remain a secret

One of the most notable findings of the study concerns DNS queries. None of the 25 manufacturers analyzed directly stated whether their router logs a user's requests to domain names. Although DNS traffic does not reveal the exact content of web pages, the history of domain requests can tell a lot about a user's habits, interests, and activity.

The same uncertainty prevails regarding internet traffic analysis. Documents from 20 companies do not provide a clear answer on whether Deep Packet Inspection (DPI) technology is used:

• Google Nest and Ubiquiti Cloud have explicitly stated that such analysis is not used.
• Amazon Eero, MSI Radix, and AT&T Turbo Hotspot do not rule out the possibility of using this technology in certain configurations.

However, the process of collecting simple personal information, such as an email address or account name, is described in much more detail in the documents. 84% of companies stated that they collect emails, and almost half indicated that they directly receive four categories of data: name, email, phone number, and mailing address.

Geolocation and evaluation results

Researchers also paid special attention to the device's exact geolocation and data on surrounding Wi-Fi networks. Seven companies stated that they allow the determination of the device's exact location, while another six stated they do so under certain conditions. Only D-Link and Amazon Eero explicitly mentioned identifiers of nearby Wi-Fi access points (SSID and BSSID), which can be useful for determining physical location.

To assess the level of doubt and uncertainty, Cybernews rated each brand on a scale of 0 to 66 points. According to the results, the highest scores were achieved by D-Link (56), Omada / TP-Link (55), Amazon Eero (53), as well as Xiaomi Mesh, Wyze, and Cudy (52 points each). The lowest scores went to Asus (34), MSI Radix (38), and Google Nest (39).

Experts emphasize that this rating does not evaluate the most private routers, but rather the level of transparency in the companies' legal documents. However, for devices through which all home network traffic passes, such legal uncertainty raises serious questions regarding the privacy of ordinary users.