10mo ago

New ASUS router firmware now requires a user to be 16y or older and will restrict features and even security upgrades if you opt out

ASUS rolled out an update to its firmware (3.0.0.6.102_34791) that now requires users to be over the age of 16 and to send a slew of metrics and data back to ASUS. If you do not agree or do not check the box to verify you are 16y or older, you cannot use the router. At this time, I’m not sure if ASUS has meant to disable the router for anyone under 16 or if it’s a bug.

You can opt out at any time but lose access to a slew of features:

Please note that users are required to agree to share their information before using DDNS, Remote Connection (ASUS Router APP, Lyra APP. AiCloud, AiDisk), AiProtection, Traffic analyzer, Apps analyzer, Adaptive QoS, Game Boost and Web history. At any time, users can search the contents of the terms at this page or stop sharing their information with other parties by choosing Withdraw.

Moreover, ASUS disables automatic firmware updates and worse, all security upgrades unless you opt into the data sharing. Security upgrades perform the following:

Security upgrade incorporates security measures that continuously update its security file and scans to protect against malware, malicious scripts, and emerging threats in order to secure the router and ensure system stability. Some upgrades addressing important security issues or meeting legal/regulatory requirements will still be downloaded and installed automatically, even if "Security Upgrade" is turned off.

Edit: I have personally contacted their CEO's office, but if others would like to voice their disapproval as well, here is a link: https://www.asus.com/us/support/article/787/

160 comments

Is Asus just asking to have a shitload of lawsuits?
- It doesn’t seem like they give a shit. This is the company that strong armed NexusGaming with their repairs and have scammed a slew of people thru their warranty system.
  If you search for “ASUS repair scam” they have a sorted history of this kind of douchery.
  
  I think the word you're looking for is "sordid".
  
  Watching the GN video was insane because I had that exact same experience with ASUS 10 years ago. Back when they made the Nexus 7. I had to RMA 3 of those dam things and each time I had to go through that song and dance with the RMA forms. I think when the 4th one failed I just gave up, recycled it, and moved on from this company as a whole.
  Looks like nothing's changed, which means this way of treating their customers is endemic at this point. They're a lost cause.
  
  And in return Gamers Nexus is teaching all of their viewers what their consumer rights are, and how to report fraudulent activity to the proper regulatory authorities. This isn't the first time Gamers Nexus has gotten regulatory agencies involved with computer part manufacturers fucking over customers, and the history of those incidents didn't go very well for other companies involved.
  On the other hand Gamers Nexus has also gone out of their way to point out companies that have done the right thing when issues came up, to make sure those companies are getting kudos for NOT fucking over consumers. Because sadly that's all we really want.
  If the FTC gets enough complaints to warrant the manpower to investigate ASUS warranty fraud, there is no doubt in my mind that they're gonna be fucked based on what we've seen so far.
- Yes.
- How many 14 year olds can afford a lawyer?
  
  All you need is one lawyer in this case to handle the class action lawsuit that would follow. There is power in numbers.
  
  No need, they can just lie :)

The title could use the word "router" somewhere.
- Fr. Had me thinking ASUS Motherboards. Really had me going there😅
  
  They are next 🫠
- New ASUS firmware now requires a user to be 16y or older router and will restrict features and even security upgrades if you opt out
  Like that?
  
  New ASUS firmware now requires a user to be 16y or older router and will restrict features and even security upgrades if you router out
  Missed a spot.
  
  Wow thanks I never could have figured that one out myself!
- Done 🙏

Give it a minute: Tech Jesus and his Nexus friends are having a great time with ASUS recently. I'm sincerely looking forward to how far they take things.
- Who is this "Tech Jesus"?
  
  Stephen Burke, Editor-in-Chief and founder of Gamers Nexus. They do computer hardware reviews, consumer advocacy and sometimes even investigative journalism. Steve has a majestic mane, earning him that nickname.
  See https://gamersnexus.net/ and https://www.youtube.com/@GamersNexus
  
  Hello there

The last thing I want is my router sharing information with other parties.
- I worry about that more than I should. But yeah, that is the central hub that everything goes thru. I actually don't even want it to ping Asus's update servers because I can't be sure what kind of data is being sent.
  I moved to Merlin firmware and hoping that doesn't have any telemetry. Unfortunately OpenWRT doesn't support wifi 6/6E routers and even the rare ones it does support, aren't really the greatest.
  I want the asus hardware, just not their shitty software.
  
  The list of supported WiFi 6-capable routers has a good number of entries.
  
  But yeah, that is the central hub that everything goes thru
  Does vpn help with this?

Nasty. Thanks for the heads up.
- NP. I was pretty pissed as they haven’t released a new update in almost a year and when they did, this is all that’s been changed.
  Good news is moving to WRT Merlin is a piece of cake and even carries over all your original settings. Hopefully they rip out this crap with their own firmware.
  
  I wanted to swap over to Merlin last year but my router isn't supported. Grrrr!

Asus went the bad way. Check out louis rossman vídeos about asus, héroes one of them. https://www.youtube.com/watch?v=NHQqKi9NcTs It is a company to be avoided. It went the non ethical way.
- Here is an alternative Piped link(s):
  https://www.piped.video/watch?v=NHQqKi9NcTs
  Piped is a privacy-respecting open-source alternative frontend to YouTube.
  I'm open-source; check me out at GitHub.
- It went the non ethical way.
  Sadly, you can swap Asus with pretty much any popular company's name and it still holds true.
  
  Gamers nexus mentioned two decent brands (arctic and fractal) in their most recent video about Asus.
  https://www.youtube.com/watch?v=uYdtpU8FKO8 around the 11:11 mark
  But yes, sadly most popular companies seem to be garbage nowadays.
  
  Yes... But some more than others
- Every other company seems to charge for parental controls. It's so stupid, I don't need another fee just because I have a child in my life.
  I wanted to degoogle, so I looked for a new router and ended up with an Asus.

Asus would do good in hiring a real lawyer. Parents accept, kid uses router, data collected of child, illegal. So easy to rip them a new one.

If you own a router from ASUS and find OpenWRT too difficult:
install Asuswrt-Merlin
- The data sharing happens on merlin too
  
  It builds on devices' source code published by ASUS. The is no data sharing with ASUS.
  Merlin's privacy disclosure:
  The only outbound connection made with me by this firmware is when the firmware checks for availability of a new version.

Because they aren't legally allowed to spy on minors they add this shit to bypass it?
- Precisely
  
  Is the train of thought that if the adult approves they can harvest data from minors regardless? It harvests data from anybody using the internet, not just person handling the settings. It doesn't seem legal that the data harvest agreement binds all users in a household rather than the one managing the settings?
  Is that legal in Europe? is it legal to suddenly semi brick a device if you dont allow them to data harvest? Is it really considered giving consent freely when the device you paid $$ for suddenly no longer does 90% because you disagree with sudden data harvest practices?
  I can understand a feature not working because you disagree on sharing something. E.g: can't tell you which pizza place is near you if you dont share your location.
  But this? I hope it's illegal and they get sued into oblivion for this. This is super invasive.

OpenWRT is better for a lot of reasons. It isn't as user friendly but if you know a little networking you will be fine. The big thing is that automatic updates aren't a thing so make sure you manually update.
- OpenWRT is pretty user friendly, in my experience.
  
  It isn't half bad but it does use a lot of terminology and can be overwhelming because it has so many options

This is sickening.
People should use alternative routers and software such as OpenWRT, DDWRT, and Gl.iNet routers
- Yeah. When I bought my ASUS router I was looking into OpenWRT supported routers but they are really hard to come by (at least in NA) and quite dated. Router manufacturers really don't want to have their telemetry removed.
  
  One of those tiny low power PCs with OpenSense is a good alternative, but a bit more work. The only downside is that you need a separate switch and wifi access point.

If I bought one of their routers and this came up, I would simply be returning it and giving the person at the counter a printout as to why. Sorry, but this router is not "suitable for purpose". Look up that phrase and "merchantability".
- Agree. Straight back for refund. In Australia we can legally choose the manufacturer, or the retailer. I'd go straight to Asus, to give them the message directly.
  
  Trying to refund through Asus will result in them dragging their feet, being as unhelpful as possible, or claiming you damaged the product.
- For the downvoters, in the US:
  https://www.findlaw.com/consumer/consumer-transactions/what-is-the-warranty-of-merchantability.html
  The implied warranty of merchantability guarantees that a product sold to you will work for its intended purposes. In other words, it means you can expect a toaster to toast your bread. If it doesn't, you have legal protection against losing money on a product that doesn't work.
  If you bought the router expecting it to work as advertised, you may make a claim if it doesn't. They would have to spell out ahead of time what the limitations and requirements are in order to avoid trouble.
  
  You have no claim. The update does not disable the router and even if you opt out, the router itself still functions, except with a few additional features missing. Telemetry and data collection does not void a warranty. There is no claim here.
- I would rather not have less options in this world and force companies not to be dicks. I guess to each their own. My router is also 2y old so no returns available.

never use stock router firmware
- Any other open source alternative you recommend?
  
  Usually it's OpenWRT
  
  openwrt
  
  openwrt or ddwrt
  
  On ASUS routers, the best choices are OpenWRT or Asuswrt-Merlin.
- You know, I'd 99% of the time agree with you but has anyone else tried out the little (travel?) routers from GL-iNet?
  Their default router interface ain't half bad at all, and if you do need to use Luci you can simply do that too
  I bought a couple of them for a family member and they haven't poked me once for help with them.
  
  i dont blame you. GL-inet routers have always seemed so cool to me. always wanted to get one.
  paired with the blue merle firmware it would be a godlike setup
  https://github.com/srlabs/blue-merle
  but i think blue merle is not being maintained anymore.. is there any other firmware with similar functionality? like imei rotation, mac randomizer, etc? that you know of, even for similar hardware

Okay ASUS is out. Recommendations?
- There's a few routes (pun intended) you could go.
  DIY with opnsense on an old PC will give you the most flexibility and will allow you to build your router to your exact needs.
  Ubiquiti is also another choice albeit a contentious one. Their hardware is pretty good which also doesn't require a recurring charge to use (unfortunately rare when you get into the enterprise grade gear). The software side is where people have such mixed feelings as for consumers and prosumers it's pretty good but when you start getting into enterprise level configurations you'll find their software pretty lacking. For example if you need a L3 switch for inter VLAN routing you'll want to go with a different vendor as ubiquiti's L3 is practically broken.
  
  I went with Mikrotik and it's great, but honestly I cannot endorse them as consumer routers, they are very hard to set up
  
  And Ubiquiti's support is non-existent. Don't get me wrong, I like their hardware, and their software works just fine for my needs, especially at their price point. But if you have issues, you're searching forums or are SOL.
  Ruckus gear is pretty good too, though I don't have much hands-on experience with it. And it's expensive. Like really expensive.
  
  You can also get a Celeron-based (for example with a N100) fanless mini-pc meant for use as DIY routers like these and install something like pfSense on it.
  Personally my really old router still does what I need so I'm leaving it be, though I've replaced my media box and my NAS with a similar device running Lubuntu but can't really make it also be the router since it only has 1 ethernet port.
- PC with opnsense.
- Man, idk. I installed WRT Merlin in hopes this doesn't make it there. OpenWRT is really hard to get onto routers. Even the ones that support it (which tend to be pretty dated) have a ton of hurdles or restrictions as manufacturers really don't want to lose the telemetry.
  Asus makes great hardware unfortunately. Some of the fastest and most performant routers out there. Moreover, they don't rely on subscriptions to gate some of the features like pretty much every one else.
  I tried TP Link and Netgear (if their "legendary" Nighthawk) and the Asus just blew them away on every level. Especially stability and reliability.
  
  OpenWRT is really hard to get onto routers
  I bought the Nanopi R4S, and it was extremely easy to switch out their modified OpenWRT for vanilla (literally just use a command/program to install the image on an SDcard). Granted, I did have to find a solution for wifi, but even that was easy with the Belkin RT3200s and the instructions (more in-depth, but still hand-holding). I also flashed it onto a Netgear AC1200 using nmrpflash, which sounds imposing, but really just entailed installing the pre-reqs, hooking the router's ethernet port directly to my PC's and running the command.
  I did have to do my research to arrive at my decision to buy these specific models for their compatibility with OpenWRT. If you don't, you might end up with something that requires popping open the shell and setting up serial comms, which is a pain.
  As far as I could find, out of the three Wifi6 enabled Asus models (RT-AX###) that are compatible with OpenWRT, 2 require ssh and running commands that are given in the guide; the other one, and all of the supported AC### models, seemed to work using ASUS's built-in web-app to upload the OWRT image. I wouldn't say any of it is easy, but I also can't agree with "really hard."
  Another consideration is setup and maintenance. Proprietary firmware tends toward being as "click here to set and forget everything, here are the only 3 pieces of info you need to know from now on"; OpenWRT is definitely more hands on and requires a lot of RTFMing and routine maintenance.
- Something with OpenWRT. Turris Omnia is pretty good.
- Synology seems ok to me.

FYI the open source OpenWRT based Banana Pi R3 AX 4x4 is a thing. Don't buy closed source Routers/APs on purpose.
- You can just buy a off the shelf router and flash OpenWRT many devices are supported. If you want to be sure just look it up before you buy.

I remember seeing that Openwrt is working on getting their own hardware sometime in the future. Might be worth looking at when the time comes. I'll stick with merlin until that goes the same way.
- Isn't the Banana Pi R64/R3/R4 close enough to that?
- I like Linksys for OpenWRT. They are cheaper and the chipset is often the same. They aren't high performance devices by any stretch but they are pretty solid in my experience.
  I do wish OpenWRT would partner with a existing company instead of trying to go alone. There are several companies that make hardware specifically for OpenWRT. It would be nice if they would just work to have a "certified by OpenWRT" badge. They could then donate a percentage of the sale to the project.

Next DEFCON is in two months, can't wait to see them get absolutely pwned.

openwrt is pretty nice
- Unfortunately, lots of ASUS routers (especially the “gamer” oriented ones) use Broadcom chipsets. Broadcom support is severely lacking, (because Broadcom has refused to allow open source drivers) so in many cases switching to openwrt will severely cripple the router. Even basic shit like WiFi will stop working, because there isn’t a WiFi driver available.
  
  this is dissapointing. the enshitification of asus in general has been dissapointing...
  
  Fresh tomato does Broadcom.

- Probably. But still so shady to give the choice when it doesn't actually work. Feels worse this way TBH.

I'm seeing a few comments suggesting OpenWRT, which is what I use and love: the correct response to this level of capitalist tomfoolery should absolutely be to 1. buy hardware that supports FOSS out of the box, or 2. install FOSS firmware.
BUT: OpenWRT isn't for everyone. Installation on supported devices is usually pretty easy, but it does require being invested in setup, maintenance, and understanding of the software. There is little built-in handholding, and most setup beyond basic functions requires reading the docs and wiki; sometimes, some functionality requires running commands directly on the device rather than the LuCI web-interface.
This kind of understanding and investment should be the end-goal of all privacy-oriented tech users. Technology is complicated, and each layer of handholding that devs add also necessarily obfuscates behind-the-scenes functionality, which runs counter to privacy and security. That being said, the barrier for entry to privacy-respecting tech shouldn't be "a masters in CompSci," and thus any alternative to major tech brands is still a step up from just accepting what they give you. Just be aware that your current firmware may be a stepping stone towards software freedom, instead of a stopping point.

Top level comment to remind the Open WRT fanboys that this ASUS router uses a Broadcom chipset, which is not supported on OpenWRT. Been seeing it recommended by a lot of replies to comments when it won't be helpful in this case, since Broadcom chips don't have open drivers
- However, freshtomato is another router firmware, that isn't as feature rich or well supported as opwnwrt, but is focused on supporting broadcom chipsets.
  https://www.freshtomato.org/
  https://wiki.freshtomato.org/doku.php/hardware_compatibility
  I flashed it to my netgear router with a broadcom chipset, it works wonderfully!
- Yeah I’ve stayed out of those because it’s just felt like a knee jerk without actually even reading anything. “Someone said something critical about a router firmware, quick put OpenWRT on blast!” 😏

Good thing openWRT works on those

THE YEAR OF OPENWRT!
/s not /s

Should I need a new motherboard, which vendor would you guys recommend that's not crap (as a company)? Gigabyte? GamersNexus had a few very negative reports on MSI as well.
- IMO, ASRock.
  Considering that they're probably the only mobo manufacturer that officially supports using consumer AM4 CPUs on a server (see ASRock Rack), and always supported ECC ram on all AM4 motherboards - and that I haven't had anything negative happen with any of their products so far (at work) - I personally would choose ASRock next.
  Haven't had the chance to try them for AM5 yet, sadly.
  
  I had an ASRock X570 Taichi once. It had a great feature set, but unfortunately every few cold boots the BIOS would completely forget all settings and reset everything to default. This may have been related to my memory's XMP profile, but the same memory ran just fine with XMP and the exact same CPU on a much older ASUS X370 Crosshair VI Hero. So I eventually switched to the ASUS ROG Strix B550-E, which was/is a very good board I would say. So naturally, I went with the ASUS ROG Strix B650E-E when I switched to AM5, and while the board is generally stable, the Intel NIC has issues the way ASUS configured it (see my reply to the other commenter).
- Yeah gigabyte is solid. I was quite happy with the Aorus line up. I have never bought MSI because I’ve always felt them to be cheap and dodgy. So not surprised NG was having issues with them.
  
  The GIGABYTE B650E AORUS Master looks quite interesting with its 4 PCIe 5.0 x4 NVMe slots. I eventually settled for the ASUS ROG Strix B650E-E though when I got my Ryzen 7000 CPU at the beginning of last year, but if I got to choose again it wouldn't be an ASUS board.
  The mainboard I have is mostly fine (great even, in terms of general stability), but ASUS fucked up their version of the firmware or power management of the Intel 2.5 GbE adapter so it can just completely die after a few hours under Linux, and sometimes get the connection speed wrong under Windows. A workaround under Linux is to disable PCIe power management entirely in the Linux kernel parameters (pcie_aspm.policy=performance pcie_port_pm=off), but that's hardly ideal. I don't see myself spending hundreds of dollars on a new mainboard just because of this issue though. ASUS fails to even acknowledge the issue.
  
  I hate gigabyte with a passion. The 980Ti Gaming G1 has explosion issues (literally) including mine and some other people. They didn't step up. Then there's the PSU debacle. There was an r/fuckgigabyte for a reason. I think just AsRock is left?

The data sharing persists even with merlin. I get a prompt about it as soon as I tried to enable those advanced features. I still get updates though.
- That was the case before the update, but they didn’t bar security updates and firmware upgrades or not let you even into the router without consent. I had those disabled but the update makes opting in mandatory.
  
  https://www.snbforums.com/threads/withdraw-privacy-permission-disables-features.90169/

All you need is Protectli with OPNsense and cheap TP-Link in AP mode.
- I just write letters to the websites I interact with. I get a good deal on stamps.
- I don't think that would have enough RAM

Fantastic. Time to deliver opnsense and/or pfsense to the masses. Or better, recycle a router with openwrt or similar

I guess I'm not updating my routers anymore then. Sucks though. It seemed to be the only Asus product that wasn't garbage.
- Look into OpenWRT. It is more complex to setup but it is a Swiss army knife.
  
  Sadly, many ASUS routers use Broadcom chipsets, which has major compatibility issues with openwrt. Notably, Broadcom has refused to allow open source drivers, and OpenWRT only uses open source. So installing any kind of OpenWRT on a Broadcom router will effectively cripple it, because even basic functions like WiFi will be unavailable due to the lack of drivers.
- That sucks too because you miss out security fixes. I would rather run a secure and up to date firmware that leaks data to ASUS than one with known security exploits. If those were my only options.
  
  I'd rather update it as well. But the routers are behind my ISP router and aren't externally accessible. The attack surface is smaller in that regard. I'm not happy with the thought of an unpatched router. Maybe I can hold out long enough for merlin to support my routers.
  I dont think the latest few updates I did mentioned any security updates. Only bugfixes.
  I'll tackle the problem when it presents itself I guess.
- I'm sure asuswrt-merlin won't have this nonsense.
  
  Routers aren't supported by merlin unfortunately :(

Because nobody has ever lied on one of these lol. Still criminally stupid of ASUS though.
- They don't care if you're under 16. They have to ask if they want to collect and sell your data. This is a big red sign that says "WE'RE WATCHING EVERYTHING THAT GOES THROUGH YOUR NETWORK AND SELLING IT TO WHOEVER WILL PAY US!"
  
  Yeah I don’t get why so many focus on “well, just lie and say you’re under 16.” Literally nothing to do with the state of affairs.
- This isn’t pornhub buddy. This is a setting on a purchased product. Also, lying has nothing to do with collecting telemetry or forcing customers into it. You may want to realign your priorities.

I mean if you're using their servers for all of that cloud management can you really expect them not to take a look? You can buy a router and install open source firmware that doesn't scrub your data or keep giving money to giant corporations that put profits over customers.

160 comments