UK becomes first country to ban default bad passwords on IoT devices

https://therecord.media/united-kingdom-bans-defalt-passwords-iot-devices

by bookofjoe • 2 years ago

60 21 2 years ago

teddyh• 2 years ago

“OK, the new default password for all our newly-sold devices is now ‘by%8MmRsVWt#m4ZO’. Problem solved.”

I’m sorry. That’s not allowed. For security reasons, every new password must contain at least one emoji, three greek letters and one set-theoretic operator.

stetrain• 2 years ago

I'm sorry, based on our records you have used this emoji in a previous password. Please choose a new unique emoji.

ThrowawayTestr• 2 years ago

You joke but emojis should be allowed in password fields.

compressedgas• 2 years ago

I couldn't find the text in the act that actually did anything related to what the article states it does. I looked to see if it hadn't just banned weak default passwords but banned default passwords entirely. That is that each device must have its own randomly generated passwords which are generated by another computer with sufficient entropy after the firmware is written to the device.

raesene9• 2 years ago

IIRC the requirement is that where there's a default, the user must be required to change it on first login.

IshKebab2• 2 years ago

And the device also shouldn't work until they do, right?

woodrowbarlow• 2 years ago

i feel that stance would be defensible. there are plenty of great engineering reasons to generate a per-device randomized UID during intial provisioning. default password, serial number, seeding/salting, mac randomization, licensing/drm, anonymized logs, etc.

timthorn• 2 years ago

The PSTI Regulations that the bill gives legal effect to are here: https://www.legislation.gov.uk/uksi/2023/1007/schedule/1/mad...

  (2) Passwords must be—
   (a)unique per product; or
   (b)defined by the user of the product.
  (3) Passwords which are unique per product must not be—
   (a)based on incremental counters;
   (b)based on or derived from publicly available information;
   (c)based on or derived from unique product identifiers, such as serial numbers, unless this is done using an encryption method, or keyed hashing algorithm, that is accepted as part of good industry practice;
   (d)otherwise guessable in a manner unacceptable as part of good industry practice.

wolverine876• 2 years ago

Also:

  “unique per product” means unique for each individual product
  of a given product class or type.

Overall, why not just require random passwords of a certain length? Compared to generating a hash, generating a random password is easier (no data input, such as the serial number, is needed) and no less user-friendly.

Or, define it in terms of entropy? Maybe that kind of technicality is too hard to understand.

mjmdavis• 2 years ago

This is pretty sensible cybersecurity policy. Just don’t do what BT did on their HomeHubs and generate a brute forceable password based on a hash of the ssid and some serial numbers.

rnhmjoj• 2 years ago

A lot of italian ISPs did that too in the early 2010s. Eventually someone figured out the algorithm to derive the WP2 passphrase from the SSID (and MAC address, I think) and wrote a handy tool. You were literally able to drive around a neighborhood and connect to any WiFi network you wanted.

shrikant• 2 years ago

When I moved to the UK, I figured this out and used this for a month or so of free internet while waiting for my own internet connection to be set up.

bragr• 2 years ago

Here's the actual law: https://www.legislation.gov.uk/ukpga/2022/46

cesarb• 2 years ago

UK becomes first country to ban default bad passwords on IoT devices

It might be the first country, but as far as I know, not the first place to do that; I've read at https://www.servethehome.com/why-your-favorite-default-passw... that one state of another country has already implemented a similar law.

skilled• 2 years ago

From yesterday,

Default passwords in 'smart' devices now banned in UK (https://news.ycombinator.com/item?id=40195841) - (no comments)

-> https://www.ncsc.gov.uk/blog-post/smart-devices-law

IshKebab2• 2 years ago

Under the PSTI, weak or easily guessable default passwords such as “admin” or “12345” are explicitly banned

Really? The law doesn't even contain the word "password", let alone ban any.

This seems to be bullshit.

UK becomes first country to ban default bad passwords on IoT devices

Related Stories