Linksys Velop 6E, Velop Pro 7 - sending credentials to cloud in clear text

[sfx2000]

This might be rather uncomfortable for the Linksys folks...

Their SmartWifi solution is storing the WiFi credentials in plaintext up in their cloud servers...

Linksys Velop routers send Wi-Fi passwords in plaintext to US servers

According to Testaankoop, the Belgian equivalent of the Consumers' Association, two types of Linksys routers are sending Wi-Fi login details in plaintext

stackdiary.com

 

[jerry6]

what a great idea wish i had one of those routers just to test see if it is true

 

[Justinh]

Why does Linksys need users' Wi-Fi credentials anyway?
Well, I'm sure the data is encrypted in their AWS database, right?

 

[sfx2000]

What was really interesting is this was discovered over in Europe (Belgium to be exact) - this is a GDPR issue as the Cloud Servers were hosted in the AWS in the US, not in the EU...

Why do they need the WiFi credentials - so that they can provision the satellite nodes over their mobile app...

From my perspective, it's a bunch of engineering decisions that started to get away from the dev teams control - might be down to the pressure of "it must ship" and we'll fix things in updates later on...