I recently published an article about purchasing a new modem – the ARRIS SURFboard SB8200 – and getting it set up with Spectrum, my Internet Service Provider. After a minor hiccup, the set-up was successful. But that was not the end of my modem story. Below, I will tell you about my second and final modem challenge: Signing in.
The ARRIS SURFboard SB8200 is a simple modem. It has no router functionality and does not support a phone line. I use a MikroTik hAP ac3 as my router with a separate TP-Link access point for wi-fi.
Because the SURFboard is a “dumb” modem so to speak, I did not think much about it beyond setting it up. In fact, I did not dig into the box to find its “Quick Start Card” – which we can describe as a very to-the-point instruction booklet about getting the thing set up with an ISP.
(Perhaps its app would have simplified the set-up. We shall never know. I actually installed it on my Teracube 2e, which is no longer my daily-driver phone. It wanted me to make an online account and I decided that I did not need an online account for my modem.)
The quick start card noted signing into the modem. Moreover, it listed the default sign-in credentials:
- Username: admin
- Password: password
I doubted that I would have much to do after signing into my modem. In order to access my modem directly, one would need to be connected to my internet But I still decided it would be best to change the default username and password. To be sure, it is possible that I could not do better than the super secure default admin/password username/password combination, but there is no harm in trying.
I accessed the modem’s log-in page from my web browser (that is always http://192.168.100.1). I was presented with a log-in screen asking me for my username and password.
Before I say what happened next, I want to make sure that we are all on the same page.
- The quick start card informed me that the default user name is “admin”
- The quick start card informed me that the default password is “password”
- Expected behavior: Entering “admin” for username and “password” for password would allow me to log into my modem
I fully expected to login to my modem with the modem-provided credentials. However, my hopes were dashed when the modem rejected my login. I tried once or twice more thinking there must be a mistake. But not only was I unable to log-in, the modem informed me that I would have to wait five minutes before making another attempt.
I was thoroughly perplexed at this point. I contemplated the possibility that someone had used the modem before and changed the credentials (I noted in my previous article that I purchased it on Ebay in “open box” condition), but this seemed unlikely. The modem looked like it had never been taken out of the box, much less used.
Because I had about five minutes to kill, I decided to look into the issue with a few searches using Startpage (Startpage is a front-end for Google). Unsurprisingly, it appeared that I was not the first person to have encountered this log-in issue with the SB8200. I found a couple of forum posts stating that while “admin” is always the default username, there are cases where the default password is actually the last eight digits of the modem’s serial number instead of “password.”
(Note: I thought to myself that assuming the last eight digits of the serial number were the default password, that would be an improvement over the password being “password.”)
Fortunately, I did not have to flip my modem over for the serial number. It was included on the quick start card (not on the page I posted above) which apparently lied to me about the default password. The modem’s serial number had 15 digits (three groups of four followed by one group of three) which meant I had to be careful in selecting the last eight. I entered “admin” as the password followed by the last eight digits of the serial. Unfortunately, it had not been five minutes since I had been locked out of my own modem, so I had to wait. I waited a few minutes (enough to make sure there would be no doubt) and tried again.
I was in.
The quick start card lied. The password was not “password.” The password was the last eight digits of the serial number.
Once I was logged in, the modem prompted me to pick a new password. The new password had to be between 8-20 characters and have at least one upper case and lower case letter, one number, and one special character. Having learned my lesson about how passwords can be finicky, I opted to use diceware to generate a three-word password and then add one number and punctuation manually. It took two tries to get a password less than 20 characters. The modem accepted my password.
What about the username?
It turns out there is no way to change the username on the modem. The username is always “admin.” I wondered whether there was any point of assigning a username when there is only one possibility – but who am I to tell ARRIS how to make their modems.
Sure enough, there was very little to do in the modem UI. There is a single toggle for enabling link aggregation set-up which I left off (I do not know the use-case as of the moment I am writing this). Having changed the password, I logged out of the modem.
Had ARRIS not provided misleading log-in credentials for the modem, it would have been very easy for me to log in and change the default password. When one receives a “Quick Start Card” with default credentials, he or she naturally assumes that those credentials will work. Having to look up the real default log-in credentials online is not a good user experience and I will venture than many modem users would resort to calling ARRIS instead of digging around like I did – which would be less than desirable from ARRIS’ perspective. While no one needs to take my advice, I recommend ensuring that products (A) come with the correct log-in credentials and (B) have a slightly better default password than “password.”