I say you're wrong. You're right that it really doesn't matter which encryption algorithm is used. It's the premise that encryption should be used in the firs

I say you're wrong. You're right that it really doesn't matter which encryption algorithm is used. It's the premise that encryption should be used in the first place that's wrong. See, you don't store passwords -- not plaintext, not encrypted. Ever. (Well, unless your software is password manager, but a router is definitely not that.) You also don't store password hashes. You don't even store salted password hashes. You'll get it wrong, and you won't even know it. The only thing anybody should ever store is the output of a well known and well tested implementation of a well known and thoroughly studied key derivation function. (This implies that somebody else wrote it.) That's it. Anything else is broken. So which key derivation function did they use? Oh, they didn't use one? That's what's atrocious. It doesn't matter if it's binary-not, triple-DES, AES, md5, or 10 rounds of salted sha256. Use a key derivation function.