2 ms·

There is no reason why your web portal password should have anything to do with the modem’s RADIUS passwords. Frankly, there’s no reason to even have a modem pa

There is no reason why your web portal password should have anything to do with the modem’s RADIUS passwords. Frankly, there’s no reason to even have a modem password as you can just identify them based on the line (and an attacker that manages to get physical access to the like can trivially MITM to get the password anyway). But as another comment mentions, this is DOCSIS which doesn’t use any user-entered passwords for modems. As far as I understand it uses certificates that are built into the modems at manufacture time.

bogantech 5y ago
> There is no reason why your web portal password should have anything to do with the modem’s RADIUS passwords. It usually does just because they want the same password to be used for both > Frankly, there’s no reason to even have a modem password as you can just identify them based on the line (and an attacker that manages to get physical access to the like can trivially MITM to get the password anyway). DSL makes use of PPPOE so they don't have any choice to auth you any any other way. Also DSL services are terminated at DSLAMs that are not necessarily owned by your ISP. They use the radius realm (the bit after the @ in your username) to proxy your authentication request to the correct ISP. It would be nice if ADSL services didn't do PPPOE with CHAP authentication but they do. This is how they work whether you think there's a reason for them to or not. > But as another comment mentions, this is DOCSIS which doesn’t use any user-entered passwords for modems. The company previously did DSL and when they stopped doing that I'd hazard a guess they didn't re-engineer the whole organisation to change how they auth users for webmail etc