4 ms·
I've seen more devices do this recently. Most ISPs will not ship a router with an "admin" or any other default password. Instead there's a sticker on the side o
by djsumdog 8y ago
I've seen more devices do this recently. Most ISPs will not ship a router with an "admin" or any other default password. Instead there's a sticker on the side of the device with a password that got generated and assigned to it on the way out.
It may slow down the production process, but it's a step in the right direction for security. All this bill means is that manufactures who don't have that process in place can't sell their devices in California. It will probably mean more devices with random passwords for the whole country.
- freeflight 8y ago> Instead there's a sticker on the side of the device with a password that got generated and assigned to it on the way out. This has been a thing for a while for WLAN routers. But I still don't really trust those, for all I know these passwords could be seeded on something very predictable, like the devices serial number.
- thecatspaw 8y agoof course, but its still better to make someone waste their cpu time and slow down the attack, instead of beeing just able to enter admin/admin
- freeflight 8y agoI'm just saying for this to be even better I'd like some transparency from manufacturers about their password generating process. If they do it properly then there should be no problem with surfacing their methodology and I'd have less hassle by actually being able to trust those complex individual passwords the device comes with out of the box.
- pdonis 8y agoI don't think anyone should be trusting any password generated by anyone but themselves. To me, the only viable option is the second option in the California bill: the device requires the user to generate a new password before it can be accessed for the first time.
- JoeAltmaier 8y agoIf the serial number is not widely known, then that's at least nearly as good as a secret password, no? And it can be changed immediately on installation...
- mirashii 8y agoNo. Serial numbers generally have really low entropy. They're often a fixed format assigned sequentially or in batches, which makes attacking them substantially easier.
- ryandrake 8y agoHence the name serial numbers. Often times they are actually assigned 1, 2, 3, 4, ...
- JoeAltmaier 8y agoOf course. But nobody knows which one you have. So you have time to change it. I shipped firmware for an IoT device, had the initial password == the serial number. The client said "Nah, just make it open, our installers don't want to fool with passwords". Sigh.
- posterboy 8y agoYoud simply buy one and try a bunch up and down the sequence. Serial numbers of captured German tank parts were actually used to estimate how many there are. That story was an application of Bayesian inference, and is used to explain that. However, I didn't understand the argument.
- user5994461 8y agoIf you followed articles in the news, some ISP were seeding passwords based on the MAC address.
- chris_mc 8y agoCradlepoint 4G modem/routers (several models) use the last/first 8 MAC address digits as the default password.
- zeta0134 8y agoI don't trust them either, but I muuuuch prefer this practice over the old "admin:admin" standard. Someone going through the trouble of cracking a Pseudo-Random Number Generator, even if that's a weakness, is a heck of a lot more effort than typing the model number into Google along with "default password" and clicking the first result.
- x3n0ph3n3 8y agoAt least the "admin:admin" can be googled by a novice who has lost the sticker. Otherwise, the device becomes unusable.
- michaelmrose 8y agoIt can be reset just not by some asshole connected via wifi to an open network.
- zaarn 8y agoDon't remove the sticker. Most people will have the router simply rot in a corner so it's unlikely to get lost.
- MrStonedOne 8y agoThis has happened actually. I can't remember the details, but for some routers you could guess the wpa password based off of the mac.
- asaph 8y ago> Instead there's a sticker on the side of the device with a password that got generated and assigned to it on the way out. And sometimes this sticker is left on the router and can be plainly seen by anyone nearby, even through a glass window.
- bhuga 8y agoIt's a step in the right direction. The effort required to look through every window in one city is a lot more than scanning every router owned by an ISP globally.
- IshKebab 8y agoAll ISP's routers in the UK for maybe the last 10 years haven't had weak default password and I've never once seen them print it in an easily visible place. It is always on the bottom, and a few years ago the started adding cards with it on.
- tazard 8y agoThe threat model of someone looking through your window is significantly different than the threat model of someone googling "default password for XXXXXXX". You are correct, but we shouldn't let perfect be the enemy of good.
- pdonis 8y agoIf anyone who will be within plain sight of the router should not know the password, then obviously you should not use the default password that's printed on the router. You should set a new password yourself.
- tinus_hn 8y ago> It may slow down the production process [...] Generally device already have their MAC address and serial number both printed on the outside and burned into an EPROM in the device, so printing a password really won’t make much of a difference.
- eh78ssxv2f 8y ago> printing a password really won’t make much of a difference. It's not just printing the password. There is also an overhead of configuring the device with a unique password.
- rad_gruchalski 8y agoEach device is flashed at production stage. It's not that difficult to put a password in. Firmware can be loaded from a server and it does not take much time, when done right.