Skip to main content

For many years, DSL/Cable routers by German company AVM, sold under the Fritz!Box brand, did some internal dns tweaking so that when you typed in fritz.box it would lead you to the config page of the router in your network. Now, years later, there actually is a .box TLD (Top Level Domain) and AVM forgot to register the fritz.box domain. Someone else did. And activated Certificate Pinning (HSTS). #Oops

UPDATE 2024-01-27: Their dns entries are flaky ATM, sometimes there, mostly not.

#oops
This entry was edited (10 months ago)

reshared this

in reply to Jan Wildeboer 😷:krulorange:

Fynn Becker
Fynn Becker
• •
If you accidentally visit the “real” fritz.box outside the home network, you can’t use that domain inside the home network anymore to access the router admin interface: the “real” website has HSTS enabled and the Fritz!Box of course doesn’t have a valid certificate for the domain.
Screenshot of Chrome on Android showing the “Your connection is not private” page for the website fritz.box. The reason is an invalid certificate with HSTS enabled.

Gidi Kroon reshared this.

in reply to Fynn Becker

Chris
Chris
• •
hahaha the amount of fuckery by avm.
Well sure, they could not have known back in the day that .box will be a tld some day. But they could have changed the setup when it became available and they could not register it themselves
This entry was edited (10 months ago)
in reply to Chris

Beko Pharm (deprecated)
Beko Pharm (deprecated)
• •

uhm sorry, no. The idea to use some tld that does not exist was a bad idea to begin with and exactly the reason why .home.arpa was introduced back in the days. this mess is a result of hanging on to a fancy idea that was probably never changed for marketing reasons or some other stupid internal company politics.

They even made it extra hard to change this! Failing to grab the official domain just adds to this. Many did see this coming for years. I did.

Same for .local for different reasons

This entry was edited (10 months ago)
in reply to Beko Pharm (deprecated)

o'wolf
o'wolf
• •

@bekopharm @cy agreed that it was a bad idea to begin with, but AVM's use of fritz·box predates RFC 8375 (even most if not all "new" TLDs), and ICANN frowns upon the use of "private" (i.e., unregistered) domains for good reasons. (They don't have any say in what the IETF does with .arpa, though.)

What I request from AVM is to make the domain their DHCP provides configurable while keeping the DHCP and DNS of the Fritzbox.

@Beko Pharm (deprecated) @Chris
in reply to o'wolf

Beko Pharm (deprecated)
Beko Pharm (deprecated)
• •

@woelfisch even without that RFC was it only a question of time. Really anyone working in this has seen this coming.

AVM may be huge in Germany but international? cmon. Am Deutschen Wesen mal wieder, oder was?

Yeah, the ability to change this is long overdue. It's possible afair by downloading the config, set it there, recalculate the totally secret checksum and re-upload the config.

Or at least it was. I didn't keep taps. Using my own service for DNS ignoring this for years.

@o'wolf
in reply to Beko Pharm (deprecated)

o'wolf
o'wolf
• •

@bekopharm oh, it isn't (wasn't? I haven't dealt with any other home routers for quite some years...) only AVM doing that.

IIRC the whole thing started when .local was hijacked for mDNS in 2000, which was used by numerous home router vendors previously. AVM (foolishly) decided to use .box instead, though they should've registered a dedicated second-level domain under an existing TLD.

But hey, I bet marketing just loved "fritz·box"...

@Beko Pharm (deprecated)
in reply to Fynn Becker

Gidi Kroon
Gidi Kroon
•
I believe you can remove your browser's knowledge of hsts by removing all data it knows of that site. Also you can install your own certificate on your router to make it valid, or just mark the router's generated certificate as valid. The latter you would need to redo after each restart of your router I think.
#FritzBox
#fritzbox

Gidi Kroon reshared this.

⇧