4 ms·

Iirc (it's been a few decades..) if you have an ADSL service your password is stored in plaintext because that's the only way RADIUS can check your password wit

Iirc (it's been a few decades..) if you have an ADSL service your password is stored in plaintext because that's the only way RADIUS can check your password with the various authentication protocols there are. Iirc the two mainly used authentication protocols for PPPOE connections are CHAP or MSCHAPv2, the former requires that both sides know the plaintext but the latter uses an NTLM hash that can be cracked. Everything is built around horrible old auth protocols ISPs usually have you use the same password for email, account and pppoe which all comes from RADIUS. They don't all support the same support for hashing algorithms etc ISP's should be changing them before sending them out but then you'll be without internet for a week or two depending on how slow your postal service is.

jonathantf2 5y ago
Virgin is a DOCSIS service and I'm fairly sure you have to use their CPE so there aren't any connection login credentials that the user has - this is most likely just awful security on their part.
- bogantech 5y ago
  From what I can see they used to have DSL too. But they should modernise things a bit if they don't need to deal with ancient crap.
Nextgrid 5y ago
There is no reason why your web portal password should have anything to do with the modem’s RADIUS passwords. Frankly, there’s no reason to even have a modem password as you can just identify them based on the line (and an attacker that manages to get physical access to the like can trivially MITM to get the password anyway). But as another comment mentions, this is DOCSIS which doesn’t use any user-entered passwords for modems. As far as I understand it uses certificates that are built into the modems at manufacture time.
- bogantech 5y ago
  > There is no reason why your web portal password should have anything to do with the modem’s RADIUS passwords. It usually does just because they want the same password to be used for both > Frankly, there’s no reason to even have a modem password as you can just identify them based on the line (and an attacker that manages to get physical access to the like can trivially MITM to get the password anyway). DSL makes use of PPPOE so they don't have any choice to auth you any any other way. Also DSL services are terminated at DSLAMs that are not necessarily owned by your ISP. They use the radius realm (the bit after the @ in your username) to proxy your authentication request to the correct ISP. It would be nice if ADSL services didn't do PPPOE with CHAP authentication but they do. This is how they work whether you think there's a reason for them to or not. > But as another comment mentions, this is DOCSIS which doesn’t use any user-entered passwords for modems. The company previously did DSL and when they stopped doing that I'd hazard a guess they didn't re-engineer the whole organisation to change how they auth users for webmail etc

jonathantf2 5y ago

Virgin is a DOCSIS service and I'm fairly sure you have to use their CPE so there aren't any connection login credentials that the user has - this is most likely just awful security on their part.

bogantech 5y ago
From what I can see they used to have DSL too. But they should modernise things a bit if they don't need to deal with ancient crap.

Nextgrid 5y ago

There is no reason why your web portal password should have anything to do with the modem’s RADIUS passwords. Frankly, there’s no reason to even have a modem password as you can just identify them based on the line (and an attacker that manages to get physical access to the like can trivially MITM to get the password anyway). But as another comment mentions, this is DOCSIS which doesn’t use any user-entered passwords for modems. As far as I understand it uses certificates that are built into the modems at manufacture time.

bogantech 5y ago
> There is no reason why your web portal password should have anything to do with the modem’s RADIUS passwords. It usually does just because they want the same password to be used for both > Frankly, there’s no reason to even have a modem password as you can just identify them based on the line (and an attacker that manages to get physical access to the like can trivially MITM to get the password anyway). DSL makes use of PPPOE so they don't have any choice to auth you any any other way. Also DSL services are terminated at DSLAMs that are not necessarily owned by your ISP. They use the radius realm (the bit after the @ in your username) to proxy your authentication request to the correct ISP. It would be nice if ADSL services didn't do PPPOE with CHAP authentication but they do. This is how they work whether you think there's a reason for them to or not. > But as another comment mentions, this is DOCSIS which doesn’t use any user-entered passwords for modems. The company previously did DSL and when they stopped doing that I'd hazard a guess they didn't re-engineer the whole organisation to change how they auth users for webmail etc