Security of Orbs Network

Netgear's Orbi has the same security features as most WiFi systems.  It appears that some part of the initial setup was incorrect.  Straight out of the box, Orbi has two sets of credentials:

1. A WiFi name (SSID) and password that are printed on a label on the bottom of the router.
   While any device with an ethernet cord can be connected to a jack, WiFi devices must authenticate.
   When the Orbi was configured using the phone, were any WiFi credentials requested?
   One of the first things most people do is change the WiFi name and password to something that they are comfortable with.
   In my case, I always set up a new WiFi router with exactly the same credentials as the one I am replacing.
   That way, I do not have to go around to every WiFi device in the house and teach it a new network.
   If this is what happened, then of course devices that were able to connect to the old WiFi will connect automatically.
2. An administrative login "admin" (which is very hard to change, and almost nobody even tries) and a default password "password", which the setup badgers people into changing (and complains if it is "too easy")  Although not required, most people choose to make the admin password different from the WiFi password.  The login splash screen keeps coming up because the credentials entered are not correct.
   
   The Orbi web interface (i.e. orbilogin.com) is http, not https (secured).  Many browsers will complain about entering passwords into a "non-secure" web site.  Most consumer WiFi routers do things this way.  The theory is that someone already had to guess the WiFi password to get at the Orbi, and WiFi communications are encrypted, so doing more is "diminishing returns."

Once logged into the admin account, Orbi users have the same sorts of security capabilities that other WiFi routers enjoy.  On the Advanced Tab, under Security, there is "Access Control" where you can define which MAC addresses are allowed to access the system.  (Most users do not set up Access Control because it makes adding a new device a chore, but it's certainly there.)

So, some pervert on the sidewalk can download porn once he (she?) guesses the complicated WiFi password.  And, if Access Control is turned on, they can't get access even if they did.