@Sparky672 

Thanks for the share.  I was actually waiting for him to respond further to me.  I'll follow up too but please if you don't mind share any follow up that he provides.  You can leave it here or at ussupportteam@tp-link.com 

thank you

Carl wrote

@Sparky672 

 

Thanks for the share.  I was actually waiting for him to respond further to me.  I'll follow up too but please if you don't mind share any follow up that he provides.

@Carl 

Here's the response from Fitz:

Dear John,
After getting your reply, I get to check with my leader and our RD engineer further about this matter.
This advice to add TLS/SSL support in this function has been uploaded before, but due to multiple reasons, this function cannot be handled properly.
I will follow your advice to communicate with our PM and RD engineer for analyzing if we can remove this function instead.
Thanks for your valued feedback and support with us!

Truly unbelievable that a company like TP-Link cannot get this "handled properly" especially when they have other devices that do it (cameras, etc).  But at least now they seem to realize it's stupid to have a function in place that practically nobody can get working.  We'll see.

@Sparky672 

Hi,

Yeah i got a similar response.  I have already asked that they feature either be removed or we find a way to provide it with out needing emial. I suggested linking to a TP-Link ID account.  so we will see.  If I hear anthing I'll let you know.

@Carl 

Carl wrote

@Sparky672 

 

Yeah i got a similar response.  I have already asked that they feature either be removed...

I vote for removal of anything that is pointless or broken.  Too bad they can't just get it to work.  

Carl wrote

... or we find a way to provide it with out needing emial. I suggested linking to a TP-Link ID account.  so we will see.

This router already has that function.  If I create a TP-Link ID account, I can do a password recovery and/or use their Tether app.  

I just don't feel comfortable trusting a company that has no concept of email security to securely store my login credentials and be actively connected to my router.  Ironic, right?  

@Sparky672 

I can understand that and yes I know the router already has the ability to link to your TP-Link cloud.  Yes it creates an alternative to logging in as well as gives you cloud based remote access via the Tether app and OTA updates.  

My thought would be that If a customer didn't want to link their router but has a TP-Link cloud account (a requirement to use the Tether app).  That it could be used as an authenitcation point.  Something like forgot password > yes >  Type in your TP-Link ID  and password > Verified choose a new password.  

Not sure if it is something that they can do but If it is I'll let you know. 

Carl wrote

@Sparky672 

 

My thought would be that If a customer didn't want to link their router but has a TP-Link cloud account (a requirement to use the Tether app).  That it could be used as an authenitcation point.  Something like forgot password > yes >  Type in your TP-Link ID  and password > Verified choose a new password.  

@Carl 

Ah yes.  Then a TP-Link server would send the verification/reset email out, which I'm sure already has SSL/TLS in place.  

Interesting idea, as long as the actual router password never goes through TP-Link it would be secure enough for me.

blubber wrote

They probably have a covert channel/Backdoor to this routers as well better run a sniffer to see what’s going on.

@blubber 

Nothing would surprise me, but they can't even figure out email encryption.  

@Sparky672 Same problem on my Archer C6 (V2) and GMAIL... i not find way to configure ports etc....