LOS red light on ONT

[#1]

---

@geoffday67 wrote:

... if there's a data breach like the co-op etc ...

---

What do you mean "IF" ?, it has already happened multiple times !

On at least four breach events, I personally have had to change passwords and email accounts, directly due to Plusnet leaks.

This list appears to cover some of the known breaches, but is missing events like the ACS Law incident.

.

[#2]

@geoffday67  I'm not sure why all this password discussion has taken over the thread, the important matter is have you got an Openreach appointment to fix your fibre LOS fault?

Also you should not have needed to enter your username and password in the router, that is assuming you are using a Plusnet supplied Hub. It should configure automatically when your service is activated using the TR-069 Remote Management protocol which on Openreach FTTP uses a dedicated secure VPN channel. At the Plusnet end the router serial number is used to indentify the account and transmit the Username and password to the hub. You could ask Plusnet to check that your hub is set up correctly on the management platform.

Just to recap on the Password question, I have been active on this forum for many years and the security of having to reveal letters of your password has been questioned on occasions. Plusnet say it is secure but will, understandably not give any details. I would tend to agree with @jab1  in post #11. If the system really is insecure I'm sure there would be a lot of forum posts about it.

[#3]

Wow I had no idea. The ACS Law report talks about sending unencrypted data - that's exactly why I don't want my password stored in a decryptable way. If this kind of incident happens I want to know that the worst that's exposed is a one-way hash of my password.

[#4]

---

@geoffday67 wrote:
 The ACS Law report talks about sending unencrypted data 

---

15 years ago - I'm fairly certain that, and other, potential security issues will have been plugged.

[#5]

Storing decryptable passwords is inherently insecure for the reasons highlighted by the ACS case.

The installer didn't say anything about waiting for credentials, hence I fixed it myself.

And yes I do have an engineer appointment for tomorrow so🤞 all will be well again! It's been great to have fibre bandwidth, don't want to come across as just complaining!

[#6]

The ACS Law incident did not say passwords were leaked:

All; Firstly, we would like to apologise again to customers affected by the leak of data from ACS Law. We can confirm that we did send unencrypted data to ACS Law. However, this was not the cause of the leak. At a later date, due to a cyber-attack on the systems of the law firm, data that it held was leaked.

[#7]

And this Wiki link clearly shows that ACS:Law were, to put it politely, incompetent.https://en.wikipedia.org/wiki/ACS:Law

[#8]

Obviously a reversible hash (not a one-way hash).