Can't login with correct credentials

[majkinetor]

2 times in last year it happened that I can't login with correct credentials. Orbi RBK353 and 2 RBS350.

There is not "Invalid user/pass" but page simply refreshes. Later I can login (for instance tomorrow or sometimes from another machine).

Other users reported similar/same bug: https://community.netgear.com/t5/Orbi-App/Orbi-App-has-decided-not-to-let-me-log-in-from-my-phone/m-...4

I am on latest firmware V4.4.1.29_3.10.80

Also, on the login screen, Enter doesn't work but the one must click Log in with the mouse. I am amazed that company behind 400+ EUR mash system can't produce login page and can't log you in.

[FURRYe38]

What mobile platform are you using? 

What is the app version your using? 

Try removing the app and re-installing it. 

If on Apple, be sure to disable WiFi Private IP address as well:

https://community.netgear.com/t5/Orbi-App/NETGEAR-Mobile-Applications-and-Apple-Devices-FAQ/td-p/222...

[majkinetor]

I am using Chrome browser on Windows 10.

[FURRYe38]

And does using the password recovery option help get you back in? 

Be sure to clear out ALL browser caches and clear any saved password configurations within the browser as well. 

[majkinetor]

There is no password recovery on that page

---

@FURRYe38 wrote:

And does using the password recovery option help get you back in? 

Be sure to clear out ALL browser caches and clear any saved password configurations within the browser as well. 

---

I did.

[FURRYe38]

Wire connect a PC to the router and factory reset the router using the back push pin button. Hold it in for 15 seconds then let go. Wait for the WHITE led to slowly pulsate on top of the RBR, then log in to orbilogin.com using a web browser and walk thru the setup wizard. This time write down all important information for safe keeping later on.

[majkinetor]

Nice!

I guess I will sell it if it happens again. 

[CrimpOn]

---

@majkinetor wrote:

There is no password recovery on that page

---

When the credentials I enter are rejected three times in a row, the router display a page called Password Recovery.

The user enters the serial number from the product label on the bottom of the case, answers two security questions, and can then reset the password.  I have done this on my ancient RBR50, and it works.

Unfortunately, many users manage to go through the original setup and do not set up security questions. (How I got into the situation in the first place.)  After doing a full Factory Reset, during the next setup I was very deliberate about pulling down the menu to select each question, filling in the answer, and finally clicking "Apply".  I then went through the Password Recovery process to verity that it worked.... and it did.

After three rejections, does the Password Recovery screen not come up?

[majkinetor]

No, I can enter credentials infinite times and it just refreshes. That was yesterday,I tried like 20 credentials in a row in case I am going crazy. Today, it works.  I noticed today that there is a invalid username and pass message if I fail. It shows today reset after 3 failures. 

[majkinetor]

Also, while doing that, internet and network do work correctly. I wanted to login to check some devices. 

[CrimpOn]

---

@majkinetor wrote:

There is no password recovery on that page

---

How interesting.  Chrome on Windows 10 (for me) shows the login window like this:

Either:

• Chrome is really different in different countries,
  No mention of IP address.  No comment on web site being insecure.
• The Login page is seriously different in different parts of the world
  No NETGEAR on my login page. (the credentials are filled in because I let the browser save them.  If someone gets to my desktop computer and would rather mess with my WiFi router than steal the silverware.... oh, well.
  One button for Login rather than two separate buttons.... OR....
• This popup is not from the Orbi web browser interface.  Perhaps from some other Netgear equipment, such as a modem?

[majkinetor]

This is obviosly not a browser login screen used for HTML basic authentication.

This is some junk from some junior developer. Entire thing is junk, there is even a WiFi password rotating on the initial screen after login so everybody can see it! Honestly, I am amazed at the level of failure. 

Take a look (password obfuscated

 

[CrimpOn]

---

@majkinetor wrote:

This is obviously not a browser login screen used for HTML basic authentication.

---

That is exactly the point.  What was entered in the browser address field to bring up this prompt?

(an IP address? Clicked on a link? ??)

As to the rotating password, this is true.  When you are sitting with the Home Page open, anyone standing behind you can see the WiFi password.  The last time I checked, there was no one standing behind me in my house at the time I had the Home Page open.  A more frequent complaint is that the web browser interface is not encrypted (https).  For someone to reach the home page and attempt to defeat my 24 character admin password, they have to already be on my network.

[FURRYe38]

Does this happen with MS Edge or Firefox browsers? 

[majkinetor]

I typed 10.0.0.1 in the URL, as is typical. 

> The last time I checked, there was no one standing behind me in my house at the time I had the Home Page open

Your use case is irrelevant. Almost everybody knows that passwords should NEVER be shown or saved in plain text. 

[majkinetor]

> Does this happen with MS Edge or Firefox browsers? 

Yes. 

[FURRYe38]

Maybe however it's what NG sets. And is a convivence to the admin user of the system. As long as your the only one accessing the web page, this isn't a concern. Only one user should be accessing the routers web page. The PW enter box is hidden. 

I suggest you either contact NG support and ask for additional help and information on this or find something else that fits your needs. 

Good Luck. 

[majkinetor]

OK, thanks for trying.

Definitelly selling this thing.

[michaelkenward]

---

@majkinetor wrote:

OK, thanks for trying.

Definitelly selling this thing.

---

Check that whatever else you plan to buy doesn't do the same thing.

Quite a few brands have similar approaches to setting up and accessing routers.

As to the issues you raise, people do turn up here complaining from time to time, not because they have evidene that anyone has compromised their security but because it upsets perfectionists and paranoiacs.

[majkinetor]

That is currently irrelevant.

What is rellevant is that it doesn't let me log in with correct credentials. Multiple people reported this. If that is not lame, I don't know what is.

[michaelkenward]

The reply was to the quoted comment.

If you didn't want anyone to respond, why did you throw in that observation?

[FURRYe38]

Still wondering if the factory reset and setup from scratch and clearing the browser cache before walking thru the setup wizard got you in. 

Also try this after the reset and setup from scratch? http://admin:password@192.168.1.1

[majkinetor]

I don't want to repeat the process lasting 10 or so minutes, particularly because I don't see a point in doing so.

It cleraly has nothing to do with browser cache given my descriptions so far. I don't cache credentials in browser anyway. 

---

Also try this after the reset and setup from scratch? http://admin:password@192.168.1.1

---

Tried it now without reset, it doesn't work. I have never seen this method working in web apps... is this a real thing?

[FURRYe38]

Works in Web browsers only. 

Possible your system is just faulty as well. Might ask NG about an RMA. 

[CrimpOn]

The process for accessing a web site that requires authentication is fairly straightforward, as explained in these articles:

https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication 

https://en.wikipedia.org/wiki/Basic_access_authentication#See_alsohttps://en.wikipedia.org/wiki/Basi... 

If the user does not supply authentication with the original HTTP GET, then the web site responds with an HTTP 401 message and the browser pops up a request for authentication.  It is not the web site displaying anything, it is the web browser.  I loaded up every Windows web browser I could find and used them to access my router (which is at 192.168.1.1).  The results are attached in a pdf.  Notice that every web browser displays a similar, but not identical pop up window.  Every one of them indicates the IP address of the web site requiring authentication, empty boxes for user name and password, and options for Sign In and Cancel.  None of them display the word NETGEAR or have only a single option: LOGIN (all caps)

(As an aside, I have often been annoyed that Netgear does not fill in the user name field with "admin" since it cannot be changed. It is now clear that the browser cannot fill in any fields because the web browser creates this authentication box by itself.  In the pdf file, Firefox is my default browser and it has saved the credentials for the web site, so the browser helpfully filled in the credentials for me.)

I have no doubt that something is rejecting the attempts to connect, but it is not clear to me what it is.  Is there some browser add-in?  A VPN?  Some sort of Firewall device?

Another simple test would be to connect with the credentials supplied up front, i.e.

http://admin:password@10.0.0.1

(the colon is why user names cannot contain a colon)

I would love to see a Wireshark capture of this browser session, to capture the IP address that is responding.