UK becomes first country to ban default bad passwords on IoT devices

Re:UK becomes first country to ban default bad passwords on ... by compressedgas on Tuesday April 30, 2024 @11:11AM (#40211860)

I couldn't find the text in the act that actually did anything related to what the article states it does. I looked to see if it hadn't just banned weak default passwords but banned default passwords entirely. That is that each device must have its own randomly generated passwords which are generated by another computer with sufficient entropy after the firmware is written to the device.

[ Parent | on HN ]

Re:UK becomes first country to ban default bad passwords on ... by timthorn on Tuesday April 30, 2024 @11:48AM (#40212385)

The PSTI Regulations that the bill gives legal effect to are here: https://www.legislation.gov.uk/uksi/2023/1007/schedule/1/mad...

  (2) Passwords must be—
   (a)unique per product; or
   (b)defined by the user of the product.
  (3) Passwords which are unique per product must not be—
   (a)based on incremental counters;
   (b)based on or derived from publicly available information;
   (c)based on or derived from unique product identifiers, such as serial numbers, unless this is done using an encryption method, or keyed hashing algorithm, that is accepted as part of good industry practice;
   (d)otherwise guessable in a manner unacceptable as part of good industry practice.

[ Parent | on HN ]

Re:UK becomes first country to ban default bad passwords on ... by wolverine876 on Thursday May 02, 2024 @12:16PM (#40237952)

Also:

  “unique per product” means unique for each individual product
  of a given product class or type.

Overall, why not just require random passwords of a certain length? Compared to generating a hash, generating a random password is easier (no data input, such as the serial number, is needed) and no less user-friendly.

Or, define it in terms of entropy? Maybe that kind of technicality is too hard to understand.

[ Parent | on HN ]

Re:UK becomes first country to ban default bad passwords on ... by raesene9 on Tuesday April 30, 2024 @11:13AM (#40211901)

IIRC the requirement is that where there's a default, the user must be required to change it on first login.

[ Parent | on HN ]

Re:UK becomes first country to ban default bad passwords on ... by IshKebab on Tuesday April 30, 2024 @11:48AM (#40212391)

And the device also shouldn't work until they do, right?

[ Parent | on HN ]

Re:UK becomes first country to ban default bad passwords on ... by woodrowbarlow on Tuesday April 30, 2024 @11:20AM (#40211981)

i feel that stance would be defensible. there are plenty of great engineering reasons to generate a per-device randomized UID during intial provisioning. default password, serial number, seeding/salting, mac randomization, licensing/drm, anonymized logs, etc.

[ Parent | on HN ]