This seems like a really bad idea, guys:The administration password is always displayed in plain text by default when you log into the administration interface. Questions:1. Is there a way to disable it?2. Otherwise, can you please make it optional in the next firmware update?

FURRYe38 wrote:"basic security best practices" by whom? By anyone who knows anything about security. That's who. That it has been like this for years is irrelevant. If Netgear is concerned about the security and privacy of their customers, they will fix this.

JollyRoger8X wrote:1. Is there way to disable this behavior?No. There is not.2. If not, how do I officially request that this be disabled (made optional and OFF by default) in future firmware updates?You can post a suggestion on the Netgear Idea Exchange:https://community.netgear.com/t5/Idea-Exchange-For-Home/idb-p/idea-exchange-for-home One might imagine that the assumption is that this Orbi is not in a public space where some stranger can look over your shoulder and observe the WiFi password. If the WiFi password must be kept secret from people living in the house, then do not open the admin home page when someone can see the screen. Considering the major issues that Netgear should be assigning engineers to fix, this is not likely to rise to the top any time soon.

CrimpOn wrote:JollyRoger8X wrote:1. Is there way to disable this behavior?No. There is not.2. If not, how do I officially request that this be disabled (made optional and OFF by default) in future firmware updates?You can post a suggestion on the Netgear Idea Exchange:https://community.netgear.com/t5/Idea-Exchange-For-Home/idb-p/idea-exchange-for-home One might imagine that the assumption is that this Orbi is not in a public space where some stranger can look over your shoulder and observe the WiFi password. If the WiFi password must be kept secret from people living in the house, then do not open the admin home page when someone can see the screen. Considering the major issues that Netgear should be assigning engineers to fix, this is not likely to rise to the top any time soon.The fact is displaying an administration password in plain text by default after login is indeed a bad security practice and should be rectified. Any organization that is security conscious should immediately see the importance of this. If this is an indication of the security best practices being followed (or more to the point NOT being followed) by the Netgear development team, then anyone who is security conscious should be rightfully concerned. Thanks for the link to the Netgear Idea Exchange. I truly hope they will treat it with the urgency it deserves.

Sorry, but "other Netgear routers do it too", "you only see it after logging in", and "just don't let anyone see your screen" are never valid excuses for ignoring basic security best practices. There is a good reason most password entry fields display ******* characters to obscure passwords while you type them - and the same principle should be applied here. I understand you may think this is no a big deal, but there is nothing you can say that will change the fact that it's not a good practice. If someone needs to see their password, then Netgear should make that an optional and opt-in feature rather than displaying it by default as soon as you log in. I sincerely hope Netgear employees end up reading this thread, because this is important.

FURRYe38 wrote:"basic security best practices" by whom? Something to discuss with NG support or post over here:https://community.netgear.com/t5/Idea-Exchange-For-Home/idb-p/idea-exchange-for-home Again, been like this for years across many NG routers. Even my R7800 does this. Been around for a while now. Good Luck. How is this post helpful?

Admin password is prominently displayed on the start page by default

14 Replies

vajim
Master
Mar 23, 2021
App or pc login?

if pc login which browser?
- JollyRoger8X
  Guide
  Mar 23, 2021
  Not sure why the screenshot image I added to my post didn't show up, since the post preview showed it just fine. But you can see the screenshot here instead:
  https://i.imgur.com/n3HFHuz.png
  
  The password is displayed in plain text on the front administration page in all web browsers I have tried.
  
  Passwords should never be displayed on web pages in plain text if you care about security - especially immediately upon login. This is considered a bad security practice in general.
  
  My questions are:
  
  1. Is there w way to disable this behavior?
  
  2. If not, how do I officially request that this be disabled (made optional and OFF by default) in future firmware updates?
  - vajim
    Master
    Mar 23, 2021
    What model orbi do you have?

Forum Discussion

Admin password is prominently displayed on the start page by default