Rural UK Fibre ISP Truespeed Criticised for Restrictive Router

Full fibre broadband ISP Truespeed, which is currently building a Fibre-to-the-Premises (FTTP) network across rural areas of South West England (here), has been criticised by a number of customers for their questionable approach to WiFi security, as well as other access restrictions on their bundled router.

At present it’s not uncommon for some broadband providers – usually the biggest players – to ship bundled routers to consumers that have been locked down (i.e. placing some restrictions on your control or access), although most of those will still enable you to perform common networking tasks like port forwarding, password changes and firewall adjustments etc. (experiences do vary).

The decision to restrict a router is usually based around a number of different considerations, such as the ISPs desire to better control the security or support of their network environment, and to prevent their device being used on rival broadband ISPs.

Often customers can get around many of these limitations by purchasing a third-party router and plugging it in via the WAN port of their existing kit (it’s uglier and inefficient to have multiple boxes, but it works). We’ve long campaigned for ISPs not to lock down their routers (here), which is a particular bugbear for IT people, but little progress has been made. Thankfully many smaller ISPs tend not to follow this practice.

However, every once in a while we come across a situation that is more extreme than most. In this case the problem stems from the router that Truespeed bundle to customers of their new FTTP network, which predominantly exists in areas where there may be little choice of alternative ISPs – unless you want to go back to slow speeds via Openreach’s copper network.

A Router Restriction Too Far?

We first started hearing about the customer frustrations with Truespeed’s router over a year ago and one recent post on Reddit by ExdigguserPies serves as a good example of the same issue. “Alarm bells started ringing when I discovered that [Truespeed’s] supplied router is completely locked down. I can’t control anything except to physically turn it off. The web interface is not accessible,” said the customer.

The ISP confirms this on their website (FAQ) by saying that “right now, we don’t allow customers to change their router settings themselves. This is to make sure we can keep both your home network and our Truespeed network fully secure.” Apparently, “If you want to make a change to your network or router configuration, contact our Customer Support Team.” That alone would be enough to discourage most experienced IT folk.

So if you need to do any normal networking tasks on your router (port forwarding, static IP assignments, DNS changes etc.) then you have to ask the ISP to do that for you, which is somewhat less than ideal. But the concerns don’t end there.

ExdigguserPies said:

“The engineer who installed their router wrote my wifi password down on the cardboard box and his phone was connected to it. Then I noticed that my wifi password was emailed to me in a pdf. They clearly know my wifi password. So I emailed them asking how I can change my wifi password. This was their response:”

Truespeed Support: At present any changes need to come via us, and we then push the changes to the router. We do have a portal in development which will mean you can do it without contacting us, but this is a way off at this time. If you want to let me know what you want the password to be (and we can change the SSID as well) I can get it done ASAP?

Just to be clear, in most cases this means that in order to change the WiFi password for your home network you’d have to send (most likely in unsecured plain text form) that password via email to the provider’s technical support team, which isn’t a particularly wise approach (example for why) and may conflict a little with their own usage policy.

Truespeed’s Fair Usage Policy

7. SECURITY

7.1 Security when using the Services is your responsibility. We are not responsible for your failure to take proper security measures on your computers, tablets, mobile phones, etc.

7.2 All wireless networking equipment that you use in relation to the Services must be password protected. All Wi-Fi passwords must be kept secure and confidential. We recommend that you change your Wi-Fi password regularly.

7.3 We may suspend your services if your devices are attacking others. If we identify devices on your connection causing a significant impact on our Services, or are part of a botnet type attack, we reserve the right to suspend or disconnect your access to the Services without notice. We will contact you as soon as practicable to attempt to resolve the situation.

7.4 All users using The Services must ensure that their devices are protected with up to date anti-virus software and a properly configured firewall (where applicable).

The good news is that you can use a third-party router instead, although the ISP states this on their website: “We are not able to put the Truespeed router into a bridge or ‘Pass Through’ mode. We use a DMZ on the Truespeed router to forward all external traffic to your own router, without any interference from the Truespeed router’s security.”

The other alternative is to pick one of their business packages, which includes a router that does at least support bridge mode.

Alex Huscroft, Head of Customer at Truespeed, told ISPreview.co.uk:

“We strive to offer the best possible service at all times so take all customer feedback very seriously. This feedback also helps to inform our future plans.

We are aware of concerns from a small number of customers who are keen to reconfigure some of the router settings themselves. To date, we have taken a very cautious approach to how we manage our routers and customer data to ensure ubiquity of service. As one of only a handful of full fibre ISPs also providing a VoIP telephony service, we opted to control the router partly to ensure that this service is not compromised by consumers inadvertently changing router configurations.

The good news, though, is that we have taken these concerns on board and are actively working on amending our policy so that customers will be able to change SSID/Wi-Fi password settings on their Truespeed-owned router. This will happen in phases, with the first phase scheduled to coincide with the launch of our new mesh wi-fi extender service this summer. We invite any customer who has any questions to get in touch with us here: ultrafast@truespeed.com.”

Truespeed’s website also confirms that they’re “working on making router configuration more open in the future so you can access your Truespeed router,” although we’d ideally like to see a lot more control than just the ability to change the WiFi password and SSID of the customer’s home network.

All of this is quite disappointing because Truespeed has otherwise been doing an excellent job on their rural FTTP build in South West England. Nevertheless, some people may not be prepared for the level of access restrictions that are imposed via their bundled router. In fairness, the ISP does make most of this clear on their FAQ pages and, of course, many users almost never touch the admin side of their router.