Today, to set up an IoT device, the owner needs to either enter credentials in the factory, even if the device is weeks or months away from being on the shelves, or make users go through a tedious, insecure enrollment process. In these scenarios it is extremely hard to maintain security of the supply chain, as malicious devices may pretend to be real, genuine IoT devices. Additionally, issues with user experience leads to weak passwords, unchanged default passwords, and password reuse by both manufacturers and end users.