Beware the dreaded "white list" -- HP is guilty as charged

[cytherian]

Beware the dreaded "white list"

I don't normally start threads like this. Not all product manufacturers are created equal and some are notably better than others. But what bothers me is when a company makes a very decent product and then in a covert manner, cripples it as a means to gouge/fleece the consumer. I contacted HP about this issue and was politely told "thank you, we'll take it under advisement" and that was it. Based on what I've read thus far, I'm confident I will not see any actions taken on the issue I raised.


So, with that out of the way I'll get right to the point:

Hewlett-Packard has been putting a "white list" in their computers (in the BIOS). They started this sometime in 2010. What is it? It's a list of "acceptable hardware" that may be installed in the computer. The most common internally installed piece of hardware is the network card. While many laptop motherboards have the graphics card (GPU) soldered directly in place, the network (WiFi) card is an optionally installed device that goes in an internal PCIe slot.

The devious thing that HP did was that if you go out and buy a newer/better WiFi card and install it, upon cold booting the computer will check to see if that WiFi card is in the "white list". If it isn't, the computer WILL NOT BOOT.

Now, HP claims they did this in the "best interests of the consumer", because they supposedly test the best WiFi cards of the day and put those in the white list. However, networking technology has been moving at a rather rapid pace, making network cards from 2-3 years ago about half as fast as the latest offerings. Thus a 150Mbps card is now rather slow compared to a 300Mbps or even 450Mbps card. NOT ONLY THAT, but it turns out that HP has made numerous mistakes with the white list, and the list is often shorter than what is described in the service manual. Meaning, you can very easily end up buying a WiFi card that is supposed to be supported but is not.

If you search the Internet about "wifi card white list" you will find thousands of hits. HP is not the only computer manufacturer to do this, HOWEVER, they are the most aggressive at preventing the consumer from overriding it. In more recent laptops (2011 and later), HP loads an RSA signed BIOS into the computer, whereby any attempt to load a modified BIOS will result in a semi-bricked computer. Even changing just one bit in one of the files will cause the RSA signature to fail. They did this to prevent the hacker communities from coming up with a workaround.


I am posting this a as a warning to prospective HP laptop buyers. Now, something like a WiFi card may not be an issue for you if you frequently use your laptop in fairly close range to your wireless router. You may also be the kind of person who changes out their laptops every 3 years or so. But if being able to upgrade your wireless card as newer/better ones emerge on the market is important to you, I strongly advise against getting a Hewlett-Packard laptop.

I really wish I didn't have to post this, because HP does make very decent laptops for the money. I have had 3 of them. But upon getting the 3rd, I discovered this glaring issue that has completely shaken my loyalty to the brand. You can bet I will not return to Hewlett-Packard unless I hear confirmation of them rescinding the white list program.


NOTE: Please read the RESOLUTION to this issue.

 

[Lady Fitzgerald]

I've already been boycotting all HP products for several years now because of their poor customer service and their policy of abandoning older products, etc. Up until this, their latest outrage had been the smug announcement that their newest machines that came with Win 8 installed would not be backwards compatible with Win 7 because they had no plans to make drivers for it. They pulled a similar stunt when Vista came out and the refused to update the drivers for many of their older printers.

 

[Gary]

I have an HP printer in the closet as I am not going to pay for the ink. The cartridges costs more than the printer.

 

[cytherian]

I've already been boycotting all HP products for several years now because of their poor customer service and their policy of abandoning older products, etc. Up until this, their latest outrage had been the smug announcement that their newest machines that came with Win 8 installed would not be backwards compatible with Win 7 because they had no plans to make drivers for it. They pulled a similar stunt when Vista came out and the refused to update the drivers for many of their older printers.

I haven't had problems with HP giving poor customer service (I actually had a very good experience the last time I called upon them), but I did hear about the whole Win7/Win8 fiasco with their hardware. That's partly why I stuck with a Win7 laptop for my subsequent purchase.

I have an HP printer in the closet as I am not going to pay for the ink. The cartridges costs more than the printer.

Unfortunately, this is not a unique problem with HP, as Canon and others charge outrageous amounts for their ink cartridges. Thankfully the 3rd party aftermarket cartridge makers have made decent progress, and so you can cut your costs by more than half. But, there's still room for improvement in terms of color accuracy.

 

[kbrady1979]

My best friend has a Toshiba laptop with a "white list" identical to what HP is doing. I don't know if all models have it, but the mid-range models as of 3-ish years ago had it. He ran into the problem upgrading to a newer wireless card and found a workaround, but that is not the point......there shouldn't be a need to "rig" something like that up.

 

[cytherian]

My best friend has a Toshiba laptop with a "white list" identical to what HP is doing. I don't know if all models have it, but the mid-range models as of 3-ish years ago had it. He ran into the problem upgrading to a newer wireless card and found a workaround, but that is not the point......there shouldn't be a need to "rig" something like that up.

True that, but at least in the case of Toshiba there was a work around. Sometimes it's a simple matter of going into the BIOS and finding a hidden menu or something to that effect. With HP, there was a period where an enterprising programmer could "hack" the white list code and either completely bypass the need to check it or introduce the codes for the desired WiFi cards. But then HP decided to RSA sign the BIOS, which essentially cripples the ability to do this. Granted, most of HP's consumers wouldn't know about this or even feel confident to trust 3rd party software to do this, but they've managed to impede people who would have the wherewithal to do it. The deliberate RSA signing wasn't meant as a protection against malware or other forms of potential abuse--it was specifically targeted at the developer community to prevent them from editing the BIOS. There is no license agreement made when buying the laptop that you must use it precisely according to HP's wishes. HP is guilty of a practice that has "class action lawsuit" written all over it.

 

[unifex]

As long as they don't hide the existence of this "white list", I don't see the problem. I've changed many laptops over the years and I never even thought about a possibility of changing the Wi-Fi card. Honestly, as far as my own laptop is concerned, I have no idea whether there is a separate card, or it's onboard. I know that in my desktop the network controller is indeed onboard, making any additional network card useless. If you don't like them - don't buy from them. I don't.

On the other hand, my printer is from HP. I bought it 5 years ago and it still works as advertized. I don't print too much at home, so I order ink once or twice a year. On that schedule I don't think their price is excessive.

 

[Thorsen]

Thank you for this info cytherian. I will keep that in mind if I need a new laptop as I value the ability to change out parts if anything breaks and I don't like being stuck with having to buy from the manufacturer at 3x the price vs. getting a better product elsewhere.

besides that point, I don't like supporting companies who implement unnecessary policies or restrictions with the intention of hindering the very customers they rely on.

 

[Lady Fitzgerald]

...I don't like supporting companies who implement unnecessary policies or restrictions with the intention of hindering the very customers they rely on.

Welcome to the club!

 

[bobafetthotmail]

Now, HP claims they did this in the "best interests of the consumer", because they supposedly test the best WiFi cards of the day and put those in the white list.

Which is an obvious blatant and outrageous lie. They just want the customer to buy a more expensive laptop.

There is no license agreement made when buying the laptop that you must use it precisely according to HP's wishes.

Frankly, while it's a A++ grade asshole move (mainly because they shut down bios modding for the hell of it, not like they were losing any money over it as they live off companies mostly), they aren't doing much differently than say Apple. As they are exploiting less-than-tech-savyy people to make more cash.

Honestly, as far as my own laptop is concerned, I have no idea whether there is a separate card, or it's onboard.

99.99% of modern wifi is in a mini pci-e card due to mass-production cutting costs. I'm pretty sure that even Apple stuff uses that method even if it's not compatible with anything else (as usual).

 

[cytherian]

Interesting...

Today I received a voice message from Hewlett Packard, in reaction to the e-mail I sent. It wasn't a robo-response. It was a real person who clearly demonstrated that she had read my e-mail and that she was personally elevating it to the appropriate management staff for consideration. She also invited me to call back and discuss it further, to provide any additional details I may wish to contribute.

This is not the HP that I was expecting. I wasn't able to call back today but will do so tomorrow. I'll report back here on what happens.

 

[indianacarnie]

Thank you for this info cytherian. I will keep that in mind if I need a new laptop as I value the ability to change out parts if anything breaks and I don't like being stuck with having to buy from the manufacturer at 3x the price vs. getting a better product elsewhere.

besides that point, I don't like supporting companies who implement unnecessary policies or restrictions with the intention of hindering the very customers they rely on.

My thoughts exactly! Very well said.

 

[cytherian]

Another update... I spoke with a direct representative from the HP Notebook product line. The conversation went for a solid 20 minutes and it was mostly a note taking affair for them, with my supplying some clarifications and more details. I was given their contact info, a new case number, and a promise that this information will be relayed to a technical representative of the product team to assist me further.

The next thing is what rather surprised me...


A few hours later I got a call back and HP is attempting to rectify the preliminary part of the issue I had faced (the WiFi card I bought was supposed to be supported by WASN'T for by the BIOS). This card apparently was sold in two forms, one for HP and one for "others". They are sending me, free of charge, a replacement WiFi card. This is really surprising, especially given how my laptop is no longer under warranty. I will know for certain once it is installed and operating (I'm expecting it sometime next week).

It still doesn't address the fundamental problem here, in that the white list is still in effect and I've not gained any flexibility here. And I do realize that the cost of the WiFi card is nominal for HP (can't cost them more than $5 for the part and $3 to ship), far cheaper than having a software team release an updated BIOS. So... what really matters most is how HP will be doing things going forward. THIS is what concerns me the most and I'm going to do what I can to help impress upon HP just how significant this is.

 

[bobafetthotmail]

Let's see if the new card is an Intel one. This happened already in the past but they did supply another random brand card (within the ones accepted by the BIOS).

Hats off to you for the bravery.

 

[jimbo45]

I have an HP printer in the closet as I am not going to pay for the ink. The cartridges costs more than the printer.

Hi there
Thanks for the white list info -- I was thinking of getting a new laptop (yes even in these days of tablets some people STILL want a decent laptop) and HP was on my list. I'd never heard of the White list --thanks again for the info.

I shan't be getting one now -- I know the Wi-Fi issue isn't a priority for me but the whole idea that the peripherals can be controlled is not good -- what happens if for example they decide to block external USB drives later than a certain period or only allow specific SSD's to be fitted.

I don't have issue with HP printers --I don't print a lot anyway - but I think a lot of printers of ALL makes end to use expensive inks and it seems to me also the ink volume in the cartridges seems a lot less than they used to be.

You can often find considerably CHEAPER ink cartridges if you search the net -- some may be re-cycled but if they work who cares --I'm not printing special quality documents for The Smithsonian Institute. I'm perfectly happy with my HP deskjet 3520 -- I tend to use it as a scanner far more than a printer anyway and in a Sale in the UK it only cost me 32 GBP / 40 EUR. A set of cartridges lasts me over 6 months anyway --as I said I don't print much.

For Photo quality print I have a high quality Epson A3+ professional photo printer -- and for mega quality photo prints (from professional quality DSLR's) I'm not too bothered about the cost of the cartridges here --high quality archival quality photo paper is expensive too. I don't also print a lot but occasionally it's nice to have a few really top quality prints framed and on your walls.

Cheers
jimbo

 

[cytherian]

OK, I have an update on all of this.


First and foremost... you can forget about modifying an RSA signed BIOS. It's a real mess. There are some enterprising hackers out there who know a thing or two about RSA security algorithms and can cobble together some hacks to get around it, but the result is generally not reliable. I read about a couple of people who had to pull their CMOS battery every 3 hours because of periodic lock-ups.

I abandoned my quest to modify the BIOS... mainly because HP stepped up to the plate. Here's what happened:

• I wrote an e-mail to HP's 'executive complaint' representatives, describing the white list issue and the significant frustration it presents for the customer. After several days, I received a phone call from HP. They left a message because I could not take the call at that time. When I called back, they put me in touch with a representative from the HP Notebook division.
• The rep from the HP Notebook division was not technical, but conducted a Q&A with me and took additional details from me. I made it clear that I was "not yet" soured with HP, but if I cannot get a good resolution I will likely not be a repeat customer. They took my details and forwarded them to someone in their technical department. I was given contact info and a ticket number so I could check on things.
• Later that same day, the rep called me back and said that they had a replacement WiFi card for me. NO CHARGE! Mind you, I am out of warranty by over a year. This was the "HP sourced" version of the same WiFi card I had tried to install previously. Anyway, we confirmed the details and I was promised that a card would be sent in the mail free of charge.
• HP had actually sent the WiFi card via Fedex, next business day. The call was on late Friday, so I would have to wait for it to ship on Monday and arrive Tuesday. It did arrive today.
• The WiFi card was a little ambiguous. I found two different model numbers, depending upon where I looked. But worst of all, the default WiFi drivers would not function. I had to install the old card again and then seek out the drivers. I also found a Realtek diagnostic utility to help. Anyway, I got the software installed and the WiFi card started working. IMMEDIATELY I noticed an improvement. Whereas before I was getting 2-3 signal strength bars, I was now getting 4-5. An astounding difference.

So...

The Ralink RT5390 is junk. They may have better WiFi cards, but I opted for Realtek and got much better performance. My laptop sits 3 floors up from where the wireless router is. My Intel cards would show about a 3-4 bar signal strength, never touching 5 bars. The Realtek is clearly better. The card? RTL8188CE. It also shows up as RTL8192SE... which is supposed to be a 300Mbps card, whereas the RTL8188CE is 150Mbps. Whatever the case, I'm doing much better now.

Bottom line: HP customer service really stepped up. I'm very impressed. The white list issue is still there, but it's not as crippling as I expected. It may be that the card supplied is actually an RTL8192SE, but was firmware re-labeled to show as an RTL8188CE so that it would pass the white list check.

 

[Lady Fitzgerald]

OK, I have an update on all of this.


First and foremost... you can forget about modifying an RSA signed BIOS. It's a real mess. There are some enterprising hackers out there who know a thing or two about RSA security algorithms and can cobble together some hacks to get around it, but the result is generally not reliable. I read about a couple of people who had to pull their CMOS battery every 3 hours because of periodic lock-ups.

I abandoned my quest to modify the BIOS... mainly because HP stepped up to the plate. Here's what happened:

• I wrote an e-mail to HP's 'executive complaint' representatives, describing the white list issue and the significant frustration it presents for the customer. After several days, I received a phone call from HP. They left a message because I could not take the call at that time. When I called back, they put me in touch with a representative from the HP Notebook division.
• The rep from the HP Notebook division was not technical, but conducted a Q&A with me and took additional details from me. I made it clear that I was "not yet" soured with HP, but if I cannot get a good resolution I will likely not be a repeat customer. They took my details and forwarded them to someone in their technical department. I was given contact info and a ticket number so I could check on things.
• Later that same day, the rep called me back and said that they had a replacement WiFi card for me. NO CHARGE! Mind you, I am out of warranty by over a year. This was the "HP sourced" version of the same WiFi card I had tried to install previously. Anyway, we confirmed the details and I was promised that a card would be sent in the mail free of charge.
• HP had actually sent the WiFi card via Fedex, next business day. The call was on late Friday, so I would have to wait for it to ship on Monday and arrive Tuesday. It did arrive today.
• The WiFi card was a little ambiguous. I found two different model numbers, depending upon where I looked. But worst of all, the default WiFi drivers would not function. I had to install the old card again and then seek out the drivers. I also found a Realtek diagnostic utility to help. Anyway, I got the software installed and the WiFi card started working. IMMEDIATELY I noticed an improvement. Whereas before I was getting 2-3 signal strength bars, I was now getting 4-5. An astounding difference.

So...

The Ralink RT5390 is junk. They may have better WiFi cards, but I opted for Realtek and got much better performance. My laptop sits 3 floors up from where the wireless router is. My Intel cards would show about a 3-4 bar signal strength, never touching 5 bars. The Realtek is clearly better. The card? RTL8188CE. It also shows up as RTL8192SE... which is supposed to be a 300Mbps card, whereas the RTL8188CE is 150Mbps. Whatever the case, I'm doing much better now.

Bottom line: HP customer service really stepped up. I'm very impressed. The white list issue is still there, but it's not as crippling as I expected. It may be that the card supplied is actually an RTL8192SE, but was firmware re-labeled to show as an RTL8188CE so that it would pass the white list check.

WOW! That's NOTHING like the experience I had when their monitor wouldn't rotate the image automatically when I physically rotated the monitor. The rep kept saying I would have to get a supposedly missing file from Acer (the manufacturer of the POS...er...computer I had) but couldn't tell me what the file was. Even when I pointed out that the computer was out of warranty and calling Acer would cost me money, the clown wouldn't budge. He wouldn't even escalate the ticket. That monitor was the last HP product I ever bought.

 

[Solarstarshines]

I have an HP printer in the closet as I am not going to pay for the ink. The cartridges costs more than the printer.

No they don't go to Costco refills are super cheap

@LADY I only buy Monitors I used before and with that being said I only trust ViewSonic I had Nice one that had ultra bright back in the day and Envison

 

[Lady Fitzgerald]

...@LADY I only buy Monitors I used before and with that being said I only trust ViewSonic I had Nice one that had ultra bright back in the day and Envison

I'm lusting after this one. Besides good reviews, it also has a display port and DVI inputs (which I need, especially the display port). I want to set three of them up with one in portrait and two in landscape and also feed my TV. I'm holding off for now in hopes it or something similar will get USB 3.0 hubs. Right now, the only monitor I've seen with USB 3.0 hubs is an ASUS and it gets somewhat less than glowing reviews.

 

[Solarstarshines]

...@LADY I only buy Monitors I used before and with that being said I only trust ViewSonic I had Nice one that had ultra bright back in the day and Envison

I'm lusting after this one. Besides good reviews, it also has a display port and DVI inputs (which I need, especially the display port). I want to set three of them up with one in portrait and two in landscape and also feed my TV. I'm holding off for now in hopes it or something similar will get USB 3.0 hubs. Right now, the only monitor I've seen with USB 3.0 hubs is an ASUS and it gets somewhat less than glowing reviews.

That is a nice one At the time I was looking
I wanted something like a 30 inch
I had a couple choices but I think I got a good deal it was $80.00 cheaper when I picked it up making it extra sweet
I happen to get a 27 inch not a 30 Btw a View Sonic