Hacker News new | past | comments | ask | show | jobs | submit login

Consumer routers have had this issue solved for ages: you generate a random password and put it physically on the device.



I don't want some complicated random password. At least where I live, my router password is a very modest security shim to protect against very random casual access. If I have a visitor who needs WiFi access, I want to give them an easy password to type in.


So change it afterwards. Good defaults are important. If someone doesn't change it, it's important that they be on the right path instead of...this one.

(See also: opt-in versus opt-out for retirement plans, organ donation...heck, even this from yesterday: https://news.ycombinator.com/item?id=43144611)


You can always change the passwords. I was bringing this up as a solution to the default passwords issue. You don't want to have a static default password used by everyone, so you need the initial password to be randomized. People are dumb so you need to print it on the device. There is no need to default to cloud-based authentication to close the default password security hole.


If it's too hard for a guest to type in a password, you can also have them join by scanning a QR code. Obviously this works better for phones and tablets with QR scanning built into the camera, but that's what guests are frequently using.

https://en.wikipedia.org/wiki/QR_code#Joining_a_Wi%E2%80%91F...


Wifi password != admin password. The admin password should be random and then you can change it when you take ownership of the device.


> I don't want some complicated random password.

It doesn't have to be complicated. A random passphrase can be much simpler and include significantly more entropy: four to six words plus a six-digit number. Any password generator worth a damn can generate something like this.


Correct! No need to horse around with passwords. A staple approach saves your mental battery.


OpenWRT, the crown jewel of open source firmwares for "insecure" consumer routers, uses a blank (null) password by default with full root access.


No device comes off the shelf with OpenWRT. If you're the type of person that's aware of OpenWRT and then install it, it's not that far of a stretch to think you'd also be the type to know to check the password.


GL-inet devices come off the shelf with OpenWRT. They don't have a blank password. Every single one ships with 'goodlife' as the default password, as printed on the label on the back.

(But remote ssh login is disabled by default.)


Thanks. I was unaware of that company.


[flagged]


Your assumption is large.

I am only thinking of a router with OpenWRT installed. Nothing about a wifi router with OpenWRT has anything to do with a door access device installed by a trained technician or not. The conversation only pertains to the words used, not the unwritten ones you're trying to insert in between the lines of my comment to make a totally unrelated point




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: