On: Linksys Velop routers send Wi-Fi passwords in plai...

[abadpoli]

The article and source material are light on details here. My guess is that it is using HTTPS, but the researchers saw the plaintext password in the request and assumed “password in plaintext always bad”.

If the app isn’t using HTTPS, then the story would be much bigger than just the password being plaintext.

[nerdbert → abadpoli]

How would they have been able to see the content of a request from the router to AWS if it was HTTPS?

[KomoD → nerdbert]

You can MITM HTTPS, the device just needs to trust the cert (which isn't hard to do)