TP-Link Archer VR1600V V2 Super User Password Cracked
> After requesting the SU password, they were told flat out> it doesn’t exist and referred to the manual by the vendor.This kind of flat out lying happens a lot. I suspect some of it is that the customer service teams have zero to no interaction with the developers, so if it's not written down it doesn't exist.I think this is a good argument for developers spending at least some time working on customer service per week (even just a few hours). You could escalate queries such as this one to a developer, where clearly somebody is asking a more technical question.Before anybody says "that's unrealistic, they don't have time" - first consider the amount of ridiculous meetings a developer will normally find themselves in, or how long they spend answering emails every day.Of course, it doesn't mean that such a password would be given away, but at the very least it could start an internal discussion about it's existence. Having a single shared super-password is a problem waiting to happen.Regarding the point with small firmware-based devices and security (i.e. IoT), I believe the practice is changing where each device will have entirely unique credentials (something that's relatively easy to do these days).