The new router I was given by my internet and phone provider can only be configured via their website. I logged in and went to the page where you can set things like the SSID and password for the WiFi signal, and changed some of the settings. The changes were accepted and everything works fine.

However, later I noticed that they had sent an automated text message to my phone, which had the WiFi password in plain text. This surprised me, because I have always been told that sending passwords in plain text is a sign of unprofessional security arrangements. However, this is one of the biggest ISP's in my (European) country, with millions of clients and decades of experience, and I can't imagine that their security is amateurish.

Is there a way in which sending passwords in plain text in a text message to a phone is not a security risk? Maybe they only store it temporarily after the settings have changed, and it is wiped after being sent? Maybe sending it by text is less of a problem than sending it over the internet? Maybe a WiFi password is less of a problem because a hacker would have to physically come to my house to do anything with it? Or is this ISP indeed not following best practices?

  • We have had a few questions like this over the years: security.stackexchange.com/questions/175418/… and security.stackexchange.com/questions/256551/… and security.stackexchange.com/questions/220580/…
    – schroeder
    Commented Sep 21, 2023 at 8:24
  • Many ISPs store and even manage customer router settings. Is it secure for you? No. But it is a major convenience for them as it simplifies their help desk processes.
    – schroeder
    Commented Sep 21, 2023 at 8:26
  • @schroeder Thanks for the links. Would you say this is a common practice used by many ISP's around the world?
    – insecure
    Commented Sep 21, 2023 at 8:30
  • In France, ISPs usually print the WiFi password on a sticker that’s on the back of the router (or use WPS). It then can be changed through a local access (through WiFi or cable). The new password is not shared with the ISPs. In case of an issue, the procedure is to reset the router and its password to its default random value. Even though the router’s administration interface is accessed by a URL like myrouter.myisp.fr, this is a redirection to the router’s local webserver, only accessible though the LAN.
    – A. Hersean
    Commented Sep 21, 2023 at 9:05
  • I would say that it's not unusual, not necessarily "common practice".
    – schroeder
    Commented Sep 21, 2023 at 10:57


You must log in to answer this question.

Browse other questions tagged .