How they know what password we use in our device ? Do they scan our device without our permission ?
The law is for devices that come out of the box with a weak default. Like buying a wifi hotspot where the default is “admin123” would be bad. The default being random and printed on a label in the device is probably what this is aiming to usher in.
it’s been a very long time since I’ve seen a default that wasn’t random or a unique pass phrase
No, others do that for them: insecam.org
I like the easy default passwords for when I’m setting stuff up. If the end user doesn’t change it, that’s on them. This is one of those laws that just inconveniences the 90% to protect the lazy/stupid 10%.
I feel like there’s a level of easy, that’s still secure. I used to be the kind of person who used the same password for everything. Now, I’ve changed that password on everything and I’m particular about using a password manager even for most local uses. But when I’m performing first time set up, I use a variation on that easy to type, burned into my brain old password. It’s not incredibly secure, but it’s not 4 digits or my birthday or anything of the like.
Usually, an impact study is made before such type of laws are made:
- if this law is enacted, how much will it cost to the manufacturers to update their factory settings?
- how will this be impacted on the device cost in the UK compared to other markets?
- how many users will get stuck when losing the unique ID of the device, what are the recovery procedures, how costly is it to end users?
- how many users will be protected by the measure and what cost for society does it represent?
- how many users will set a dumb password anyhow and what is the cost for society?
I’d be curious to see the impact study, as many of those are actually botched.
a user set weak password is infinitly more strong than a known default.
admin
admin
Most routers already have non-standard passwords by default. At least in EU. I’m not sure which devices besides routers and IoT peripherals are affected by this bill.
All of them I’ve seen do use non-standard passwords for the web access portion, however it’s been a mixed bag for the admin controls on the router OS itself. It’s often just admin/admin.
Which is crazy. I could, if I were inclined, log into the router in someone’s house/business if they haven’t changed the admin password, but they have provided me with a password to access the web. Most people don’t bother changing the admin password.
Don’t worry, this law doesn’t affect luggage.
Is the flying squad going to kick down my door if I use 12345 as a password?
