The problem with requiring a plaintext password is that it may slow down attacks when a device is simply connected to the open internet, but it is trivial to de

The problem with requiring a plaintext password is that it may slow down attacks when a device is simply connected to the open internet, but it is trivial to defeat in all other cases. Modbus RTU is broadcast, so you would just listen for the password. Modbus TCP can be defeated with ARP stuffing and man-in-the-middle attack (I've seen this automated for taking over SCADA systems). A better solution would be a shared symmetric key that is manually programmed into all devices. However, this complicates install and maintenance. Its a hard sell when your controls are installed by contractors paid by the hour. Pretty soon everyone is setting their 128-bit key to 0x12345678 so nobody forgets it during emergency maintenance.