I review routers for a living. Don’t buy a router just yet

Main takeaways:

• The Federal Communications Commission (FCC) has banned the sale of new foreign-made routers in the US, and this blanket order applies to almost every Wi-Fi router currently available on the US market.
• My expert advice is to hold off on purchasing a new router if you can.
• Under current rules, blocked routers will not receive firmware and essential security software updates after March 1, 2027.
• The FCC’s action has effectively frozen the entire market while router companies scramble for approval.
• More specific information about which router companies will be subject to the ban is expected to become clearer over the next month or two.

In my eight years of writing and reviewing broadband and routers, I’ve rarely seen news that I can call unprecedented. The recent decision by the Federal Communications Commission (FCC). Ban foreign-made routers Absolutely unprecedented.

the Sweeping order It applies to any router in which any phase of “manufacturing, assembly, design, and development” takes place outside the United States — in other words, almost any router you can buy now. The FCC order states that foreign-made routers pose “unacceptable risks” to national security.

The ban does not apply to routers that have already been licensed by the FCC, meaning every router currently for sale in the United States, and will only affect new models that have not yet been approved. This means that every router that was available pre-order is still available today, and router companies can still restock them using current manufacturing processes.

Essentially, the FCC is freezing the entire router market. like William Boddington“This is using a very blunt instrument,” Lee, a technical expert at the digital rights nonprofit Electronic Frontier Foundation, told me.

Previous bans imposed by the Federal Communications Commission (FCC) were limited to Specific companieslike last year’s push to ban TP-Link routers, this affects the entire industry. So where does that leave the person who needs the new Wi-Fi router? Should you buy a model you’ve had your eye on if it’s sold out? Or is it better to wait and see which companies the FCC considers to be foreign-made?

I know what I’m going to do, but I’ve checked my advice with some industry experts. It turns out we agree.

My advice: stop buying a new router right now

When I first saw the FCC announcement, I couldn’t stop thinking about how much chaos this would cause the US router market. As I tried to identify manufacturers that could be considered “foreign-made,” it quickly became clear how deep the supply chains for routers are internationally.

Understand the scope of the ban

Take change. Although it is a US-based company, it manufactures routers in Vietnam, Thailand, Indonesia and Taiwan. With the exception of Starlink, the company says its newest routers are made entirely in Texas. According to the BBC – I could not find a single brand of homemade router.

I have no problem recommending routers that are manufactured abroad. After all, they’ve already been through the FCC licensing process, and I haven’t seen convincing evidence that any router brand has more hardware vulnerabilities than others.

Thomas PeaceThe CEO of cybersecurity company NetRise told me last year during an interview about the potential TP-Link board: “We’ve analyzed an amazing amount of TP-Link firmware. We find things, but we find things in everything.”

I’ve just finished testing, reviewing, and evaluating over 30 routers, and after years of resistance, I’ve finally gotten around to it Wi-Fi 7 routers are worth the money For the speeds you get. While I stick to my recommendations, with this ban in place, the router you buy today may not be as good in a year.

Future security risks

Then I saw FCC Public Notice. regarding the ban, which states that manufacturers can continue to provide software and firmware updates “at least until March 1, 2027.” This means that if you own a foreign-made router — if you own any router, in other words — it won’t be able to get security patches after this deadline.

That’s why I think the wise move here is to wait to buy one if you can. Keep your router’s firmware updated It’s an essential part of securing your home network. If you buy from a router company that doesn’t get an exemption from this ban, you risk having an unsecured device a year from now.

It’s an ironic side effect of a system ostensibly designed to keep Americans safe: They may no longer have access to the latest security fixes.

“If you’re limiting people’s ability to get security updates, you’re making the problem worse, not better.” Alan ButlerA senior advisor at the Electronic Privacy Information Center told me. “A lot of these routers will turn into pumpkins within a year unless they extend this waiver.”

By saying that you can update your firmware”at least Until March 1, 2027, “The FCC leaves some wiggle room for an extension. But until we know more about which companies the FCC considers foreign-made and which will be exempt, I wouldn’t feel comfortable recommending spending money on a new router right now.”

Advice for your immediate router needs

If your old router stops working, I wouldn’t ask you to wait for clarity from the FCC to get back to Wi-Fi — the timeline to worry is more years than months. A good compromise might be to buy an older router on a budget instead of the latest Wi-Fi 7 model you’ve been eyeing. But if you can wait a month or two, it pays to exercise some caution.

“I think this is going to get messy very quickly,” Butler said.

This is the messiest point in the process we’re likely to see. As the dust settles in the coming weeks, we’ll likely have better information about which routers will still be safe to use a year from now.

Expert opinion: Is your current router still safe to use?

When I surveyed four cybersecurity experts, I was surprised to find that they generally supported the FCC taking action to protect router security in theory, but were critical of implementation.

“It will affect many harmless products in order to eliminate a real problem,” Buddington said. “It’s also not well targeted, since routers are only one part of the problem, along with IoT devices.”

Concern about national security risks

the The FCC says That foreign-produced routers were “directly involved” in the Volt and Linen crimes Salt hurricane Cyber ​​attacks. These attacks don’t necessarily target an average person’s data, but they can turn your router into a tool that can be used in malicious attacks.

“The individual user who owns the router probably doesn’t know anything about it,” Butler said. “It’s happening in the background without them knowing, and it doesn’t necessarily affect them directly in any way that they can notice.”

In the Salt Typhoon attack, hackers accessed millions of people’s data through Internet service providers, aiming to gain access to information through court-authorized eavesdropping operations. This was a particularly bold example of a tried-and-true hacker approach called “spray and pray”: find the default login credentials and try them on as many connected devices as possible.

“It could be just one router out of 5,000, but that one could be bingo.” Sergey ShekevichThe director of threat intelligence at Check Point Research told me about these types of attacks. “It’s mostly easy. In many cases, you don’t have to be a very sophisticated actor, or even a nation-state, to be successful.”

How can you secure your router now

It’s as easy for hackers to gain access through your router’s default credentials as it is for you to change your own settings. Most routers have an app that allows you to do this Update your login credentials From there, but you can also type your router’s IP address into the URL. It’s different from your Wi-Fi network name and password, which should also be changed every six months or so. It’s also a good idea to keep your firmware up to date, which you can do automatically in your router’s settings or by manually downloading updates in your router’s app or web portal.

When will we know more?

I wish I could point to another time when the FCC ordered a blanket ban on an entire category of consumer products, but nothing like this has ever happened before. Manufacturers can apply for “conditional approval” and will likely scramble behind the scenes to make the cut. When I reached out to the FCC to get more clarity on the matter, I was referred to the FCC’s “covered list.” Frequently asked questions page.

My best guess is that we’ll know more details about the banned companies in the next month or so — an estimate echoed by two industry observers I spoke to. But the wait may be longer. Buddington told me he thinks router companies might wait until the ban is lifted rather than rushing to try to move their entire supply chains to the United States.

No matter how impactful it is, we’ll likely look back at this as the messiest chapter in the router blocking story. Unless you need a new router right away, there’s a good chance you’ll be able to make a more informed decision a month from now.