One day, I was playing around with my router configuration. As the result I was able to view TR-069 configuration. I was able to see that the updates server was using HTTP protocol, instead of HTTPS. This made me worried about my router security. From Defcon 22 ( https://youtu.be/rz0SNEFZ8h0 ) I know that TR-069 should be used together with HTTPS protocol, to minimize risk of attacks. I have disabled my TR-069 at my router to not be vulnerable.
Today however I received an email from my ISP, asking me to format my router using reset button on back. While the email does not explain why this is needed, I expect this to be because of disabled TR-069. For now I ignored the email, however if my ISP requires me to have TR-069 enabled, I at least want to be sure that such things can not put my security at risk.
My question is how can I encourage my ISP to use better security?
As a side note I would like to point out that I live in UK, and I would not like to get into any troubles.