<story><title>TP-Link Archer VR1600V V2 Super User Password Cracked</title><url>https://www.marcelvarallo.com/so-we-cracked-the-archer-vr1600v-v2-super-user-password/</url></story><parent_chain><item><author>reaperducer</author><text>&lt;i&gt;I think this is a good argument for developers spending at least some time working on customer service&lt;/i&gt;&lt;p&gt;My company does this.  (Or at least, did before the pandemic.)&lt;p&gt;My job is to build web sites.  My company is in healthcare.  that means this web dev has been literally hands-on with actual customers.  Actual patients.  And their children.&lt;p&gt;It really changes your view once you&amp;#x27;re back in the office in front of a keyboard.  You start to think about what you design and build in a different way.  You start to remember that the people using your web site aren&amp;#x27;t on the latest whiz-bank iPhone 16.  They&amp;#x27;re on a craptastic pre-paid piece of garbage that they bought at 7-Eleven and share with other members of their family.  A phone you and I would use as a weekend burner is all the internet access some people will ever have.</text></item><item><author>bArray</author><text>&amp;gt; After requesting the SU password, they were told flat out&lt;p&gt;&amp;gt; it doesn’t exist and referred to the manual by the vendor.&lt;p&gt;This kind of flat out lying happens a lot. I suspect some of it is that the customer service teams have zero to no interaction with the developers, so if it&amp;#x27;s not written down it doesn&amp;#x27;t exist.&lt;p&gt;I think this is a good argument for developers spending at least some time working on customer service per week (even just a few hours). You could escalate queries such as this one to a developer, where clearly somebody is asking a more technical question.&lt;p&gt;Before anybody says &amp;quot;that&amp;#x27;s unrealistic, they don&amp;#x27;t have time&amp;quot; - first consider the amount of ridiculous meetings a developer will normally find themselves in, or how long they spend answering emails every day.&lt;p&gt;Of course, it doesn&amp;#x27;t mean that such a password would be given away, but at the very least it could start an internal discussion about it&amp;#x27;s existence. Having a single shared super-password is a problem waiting to happen.&lt;p&gt;Regarding the point with small firmware-based devices and security (i.e. IoT), I believe the practice is changing where each device will have entirely unique credentials (something that&amp;#x27;s relatively easy to do these days).</text></item></parent_chain><comment><author>alxlaz</author><text>&amp;gt;  You start to think about what you design and build in a different way. You start to remember that the people using your web site aren&amp;#x27;t on the latest whiz-bank iPhone 16. They&amp;#x27;re on a craptastic pre-paid piece of garbage that they bought at 7-Eleven and share with other members of their family.&lt;p&gt;Your realization is spot-on, but what&amp;#x27;s disturbing is that this is done by having developers work front desk-ish and hoping they learn the lessons, instead of being imposed, top-down, from a higher level.&lt;p&gt;&amp;quot;We should write software for the kind of devices our users are using&amp;quot; isn&amp;#x27;t a story from the trenches, it&amp;#x27;s product and software development management 101. &amp;quot;We should target devices with these baseline specs&amp;quot; isn&amp;#x27;t something you get by having developers eyeball what phones their users are on, you get them by having Marketing put those fancy analytics tools that cost an arm and a leg every month to good use, and then by having those smart-ass program managers come up with a product definition that includes them, instead of the same generic &amp;quot;engaging, easy-to-use software that enables our customers to yadda yadda yadda&amp;quot; that gets cranked out each year.&lt;p&gt;This way everyone&amp;#x27;s writing against the same specs. Otherwise the two developers who ended up in the VIP clinic and have seen nothing but iPhones all day will keep cranking out the code that turns the phones everyone uses into egg frying machines, while the other guys will write lean, mean software that the UX lead and the CTO will laugh at and then they&amp;#x27;ll go berserk about how premature optimization is the root of all evil because they&amp;#x27;re on iPhones, too, and the whole thing work just fine.</text></comment>
<story><title>TP-Link Archer VR1600V V2 Super User Password Cracked</title><url>https://www.marcelvarallo.com/so-we-cracked-the-archer-vr1600v-v2-super-user-password/</url></story><parent_chain><item><author>reaperducer</author><text>&lt;i&gt;I think this is a good argument for developers spending at least some time working on customer service&lt;/i&gt;&lt;p&gt;My company does this.  (Or at least, did before the pandemic.)&lt;p&gt;My job is to build web sites.  My company is in healthcare.  that means this web dev has been literally hands-on with actual customers.  Actual patients.  And their children.&lt;p&gt;It really changes your view once you&amp;#x27;re back in the office in front of a keyboard.  You start to think about what you design and build in a different way.  You start to remember that the people using your web site aren&amp;#x27;t on the latest whiz-bank iPhone 16.  They&amp;#x27;re on a craptastic pre-paid piece of garbage that they bought at 7-Eleven and share with other members of their family.  A phone you and I would use as a weekend burner is all the internet access some people will ever have.</text></item><item><author>bArray</author><text>&amp;gt; After requesting the SU password, they were told flat out&lt;p&gt;&amp;gt; it doesn’t exist and referred to the manual by the vendor.&lt;p&gt;This kind of flat out lying happens a lot. I suspect some of it is that the customer service teams have zero to no interaction with the developers, so if it&amp;#x27;s not written down it doesn&amp;#x27;t exist.&lt;p&gt;I think this is a good argument for developers spending at least some time working on customer service per week (even just a few hours). You could escalate queries such as this one to a developer, where clearly somebody is asking a more technical question.&lt;p&gt;Before anybody says &amp;quot;that&amp;#x27;s unrealistic, they don&amp;#x27;t have time&amp;quot; - first consider the amount of ridiculous meetings a developer will normally find themselves in, or how long they spend answering emails every day.&lt;p&gt;Of course, it doesn&amp;#x27;t mean that such a password would be given away, but at the very least it could start an internal discussion about it&amp;#x27;s existence. Having a single shared super-password is a problem waiting to happen.&lt;p&gt;Regarding the point with small firmware-based devices and security (i.e. IoT), I believe the practice is changing where each device will have entirely unique credentials (something that&amp;#x27;s relatively easy to do these days).</text></item></parent_chain><comment><author>foepys</author><text>It&amp;#x27;s very important not step outside the ivory tower regularly or else one loses touch with non-IT people. The way something is design and how it&amp;#x27;s used can differ extremely.&lt;p&gt;My company is selling software for industry automation and the people using it often enough don&amp;#x27;t even have a PC at home. They learned using a PC at work and anything happening that isn&amp;#x27;t part of their trained workflow (sometimes even a simple additional optional input field) overwhelms them. Getting to know customers is very, very important for developers.</text></comment>