This has been a thing for a while for WLAN routers. But I still don't really trust those, for all I know these passwords could be seeded on something very predictable, like the devices serial number.
This has been a thing for a while for WLAN routers. But I still don't really trust those, for all I know these passwords could be seeded on something very predictable, like the devices serial number.
If they do it properly then there should be no problem with surfacing their methodology and I'd have less hassle by actually being able to trust those complex individual passwords the device comes with out of the box.
Serial numbers generally have really low entropy. They're often a fixed format assigned sequentially or in batches, which makes attacking them substantially easier.
I shipped firmware for an IoT device, had the initial password == the serial number. The client said "Nah, just make it open, our installers don't want to fool with passwords". Sigh.