11

I recently noticed that when logged into my ISPs (Spectrum) public, external site that can be accessed outside my network, I can see my home network's WPA2 password in plain text.

This clearly means they at least aren't hashing passwords. I have unique, randomly generated password for my wifi, so if their customer WiFi database is exposed, the risk to me is limited, but obviously the same is not true for most.

Should I be worried about this? Or is there something about router wifi passwords that makes it ok to not hash the password?

If there is a problem here, how can I pressure Spectrum to properly secure their passwords?

Improve this question
3
  • Why did you supply your PSK to your ISP in the first place?
    – defalt
    Dec 14, 2017 at 4:32
  • @DavidGrinberg You can supply them with incorrect PSK. They won't bother.
    – defalt
    Dec 14, 2017 at 5:42
  • 2
    @DavidGrinberg that clears things up - and no, they do not need to hash this data.
    – schroeder ♦
    Dec 14, 2017 at 8:53

5 Answers 5

Reset to default
9

What surprises me here is not the fact that the passwords are displayed in plaintext, but that your ISP keeps a copy of your wifi password at all. This is not something they need to do in order to provide internet to you. It's the router that takes care of the wifi, so only the router needs to know the password.

So why have they chosen to do it this way? My guess is that it is as a convenience to their customer, allowing them to remind them of their wifi password in a simple way. Hashing the password would then defeat the whole purpose of storing it, since a hashed password can't be turned back into plaintext.

So, what to do? Don't expect to be able to change the policy of your ISP. At most, you can annoy someone in customer service. Instead, I would opt for using a strong and unique password. If that isn't good enough for you, you can buy your own wifi router to use, either as your only router if that works or as a second one connected to your gateway. (I am asumming here that they are automatically harvesting the passwords from the routers, and that you can not simply lie to them and give them a false password.)

And as entrop-x suggests, you can also just change ISP.

Improve this answer
3
  • 4
    If I discovered that my ISP was displaying publicly my wifi password, I think my first reaction would be to change ISP. However, the very least indeed, is to switch off that wifi function of your router, and place your own wifi router behind it. When you are at it, I would also install my own firewall, because obviously, whatever the router is doing, cannot be trusted. On the positive side, you have now plausible deniability, and you can hack away using that wifi connection: as it could be just anyone in the neighbourhood, you can do what you want and get away with it !
    – entrop-x
    Dec 14, 2017 at 9:57
  • @entrop-x Changing my ISP isn't really possible in my area unfortunately, but disabling wfi and putting my own router behind it is not a bad idea.
    – David says Reinstate Monica
    Dec 17, 2017 at 5:55
  • @David: in principle, you only need to put your own wifi router on your local network and switch off the ISP router wifi function to avoid the consequences of the blunder they make, if it is the only blunder. However, I wouldn't trust them to have them on my local network, and hence, indeed, would only connect a router+firewall to them, which is the real gateway of my local network, and consider them an "external untrusted internet router".
    – entrop-x
    Dec 17, 2017 at 6:23
2

Should I be worried about this?

Yes. Your local network should be as secure as you can reasonably make it. More importantly, your ISP should be responsible for the pipe between your local network (which is your responsibility, and includes access to your devices), and the Internet (which is more or less the Wild Wild West).

For all the other answers regarding "it's only a problem for people who are close to get it", once it gets leaked onto the Internet, all the people who are already close enough - and their bored teenage and preteen kids - will be able to find that wifi password.

Or is there something about router wifi passwords that makes it ok to not hash the password?

Your question is based on incorrect founding assumptions. A web site should indeed use a password hashing algorithm if they are going to store passwords with which to authenticate their users; i.e. whatever their user logs in with.

In your case, the ISP is storing something your are NOT logging in to THEIR web site with; the question is not the manner in which they store it, the question is how you stop them from storing it entirely, since there is no need for them to have it at all.

Note that this is triply true for a wifi password - unlike good storage encryption passwords, where if you lose the password, you lose your data, if you lose your wifi password, you just reset it on the access point/router and your devices, which has the side benefit of rendering everyone else with it unable to get in anymore (if you do it right).

If there is a problem here, how can I pressure Spectrum to properly secure their passwords?

How do you pressure Spectrum? You go to another ISP that doesn't keep your wifi passwords, and tell Spectrum why you're leaving.

How do you solve the problem of their having a password they shouldn't? You buy your own access point, or access point + firewall, or home wifi router/"firewall", change the Spectrum wifi password to something long and random, then disable the Spectrum wifi completely, using only your own device, ideally behind your own firewall to protect you from Spectrum.

Improve this answer
1

It's probably not really that big a deal that they have your wifi password.

Wifi passwords are only useful to people nearby, so even if compromised from the database mostly it is not expected to be able to be exploited conveniently, which is to say at all if you aren't expected to be valuable.

If you have unique network SSID or your physical address is stored with it there is some chance someone local might attack you in the case of a published dump, but chances are there are enough unsecured or "password1" secured networks in your neighborhood that no one would bother.

More worrying in a breach is your account with Spectrum is very likely linked to other personal data like credit card information.

However it is worrying that they acquired your wifi password.

How did this password came to be in their database? If you didn't give it to them your router did, which means it is reporting on you, and may mean they have remote access to it. If they do it is that login being released that is worrisome because it could be exploited by anyone anywhere.

Improve this answer
1
  • 2
    Yep, the router has to be reporting on me since their site updates when I update my password. I'm also pretty sure they have remote access capabilities for support related issues.
    – David says Reinstate Monica
    Dec 14, 2017 at 5:51
1

Kudos for using random passwords, and not using the same value for everything.

In the grand scheme of things, as others have said, it's not that big of a deal. It's really a proximity thing. Now, that said, I operate in somewhat of a paranoia level, and would be concerned, here is why:

It sounds like you have a gateway device provided and provisioned by your ISP. I've run into this with Comcast ("xFinity"). I always request an E-MTA from them. They are always surprised that I don't want their gateway device (have moved a few times..).

I played around with their device a bit, because I got stuck with it for a while. When they were "installing" the equipment, I played dumb with them to see what would happen. The tech asked what the key should be, and wrote it on the work order. We were then shown that part of their connect "X1" platform, allows speak to the TV remote, and ask 'What's my WiFi password?', and Voila!. At that point, they would have seen the plain-text anyways, even if I had entered it myself.

My point with all of this is that I consider this to be a fair level of exposure. There are a multitude of access points from which to obtain the key and there are no compliance standards for storing them (like PCI for credit cards, HIPAA for medical records). Since there are no compliance standards, while it would "raise some eyebrows", there is nothing specific in place that would "force" them to encrypt, tokenize, or otherwise obfuscate the values, either at rest (database), or in transit (between systems, to the TV, to your browser).

We already know that their is a relationship between your address and the Wifi key, so the mapping piece is done. Maybe it is as easy as SELECT * FROM CUSTOMER_WIFI. Now, someone just needs to get in the car. Do you think anyone at your ISP lives nearby? Maybe a few employees that want to have some easy tech fun on a Friday night?

Just some food for thought.

Improve this answer
1
  • My bigger concern was that since most people reuse the same password for everything, then this becomes a big target since its passwords in effectively plain text.
    – David says Reinstate Monica
    Dec 14, 2017 at 5:52
1

In WPA personal, the security is based on a shared password (the passphrase) between the station (your device) and the access point. On the access point (your router), the Wifi passphrase is stored in plaintext (not hashed). It won't work otherwise.

To be more precise, in WPA-PSK, you only need to share the PSK (which is a deterministic function of the passphrase and the SSID). In practice, the PSK is the real shared secret/password between the station and the access point. It is not hashed. It won't work otherwise.

In WPA3-SAE, there is no PSK: the AC need to know the passphrase.

To summarize, the passphrase (or the PSK when using WPA-PSK) must already be stored in plaintext in the router/AP.

Now you might wonder if this is a good idea to store it on the ISP server. I would argue that it is not unreasonable for the ISP to store your Wifi passphrase (or PSK) in plaintext if your router is managed through the ISP administration interface. I suspect this practice must be quite common: many ISP routers are remotely managed by the ISP. However you should not reuse this passphrase anywhere else.

There are several reasons why reusing a WPA-PSK passphrases somewhere else is a especially a bad idea:

  • the passphrase is often shared by many devices;
  • the passphrase is stored in plaintext in many cases (in the AC, in consoles, IoT devices);
  • you might want to shared the passphrase with guests.

(Some ISP goes as far as providing a button on the modem which displays a QR code for connecting to the Wifi network (i.e. containing the WPA-PSK passphrase): anyone passing in the same room as your modem can easily scan the QR code and get the Wifi passphrase.)

If the ISP is breached and your modem is managed by the ISP, the attacker could change your Wifi configuration anyway. If you are not comfortable with that, you might either:

  • use your own modem (not always possible/allowed);
  • place your own router between the ISP modem and your network;
  • use your own access point.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .