OTA Password Retention In ESP8266 Core 3.0.0 Firmware Migration

The Arduino OTA authentication model stores password credentials in device flash memory, where they persist across resets and firmware updates. A precise design question emerges regarding how these credentials behave when the ESP8266 core version transitions, such as from 2.7.4 to 3.0.0, which altered the OTA handshake and may require password re-entry. The goal is to characterize whether stored passwords are retained, silently rejected, or demand explicit reconfiguration across version boundaries, and whether any implicit expiry mechanism exists.

Constraints include the absence of a built-in credential expiry flag, the default 'admin' password used when no password is set, and limited flash write endurance that discourages frequent credential resets. Version-specific changes in the OTA protocol are documented across core releases, but the exact interaction between stored passwords and new handshake expectations remains unresolved.

How does the ArduinoOTA library reconcile a previously stored password with a core version that expects a different handshake format? Does migration always require password re-entry, or can a legacy password be accepted without modification? What is the practical impact on device security when the default 'admin' credential persists across firmware updates without user intervention?