News for hackers. Stuff that matters.
Re:White House unveils Cyber Trust Mark program for consumer... by silisili on Wednesday January 08, 2025 @03:27PM (#42638114)
What's to stop the bad actors from just printing the logo on their gear anyways? Like they do with UL and N95?
Re:White House unveils Cyber Trust Mark program for consumer... by Jtsummers on Wednesday January 08, 2025 @03:41PM (#42638231)
They describe it as being like EnergyStar which suggests they'll have a consumer accessible registry as described here:

https://www.ul.com/news/ul-solutions-named-lead-administrato...

> UL Solutions will also work with the FCC and program stakeholders to develop a national registry of certified products that consumers can access via QR code on the label. The registry will have more detailed information about each product. Additionally, UL Solutions will serve as liaison between the FCC and other CLAs, as well as other key stakeholders. [emphasis added]

and here:

https://www.fcc.gov/CyberTrustMark

> The logo will be accompanied by a QR code that consumers can scan, linking to a registry of information with easy-to-understand details about the security of the product, such as the support period for the product and whether software patches and security updates are automatic.

This doesn't block full-blown counterfeit products (recreating certified devices including the label), but does address non-compliant devices trying to pose as compliant.

Re:White House unveils Cyber Trust Mark program for consumer... by likeabatterycar on Wednesday January 08, 2025 @03:53PM (#42638327)
> They describe it as being like EnergyStar which suggests they'll have a consumer accessible registry

I've seen Energy Star logos for 30 years and never knew there was a public database, never thought to verify, and I don't think anyone else has either. The only thing Energy Star has been useful for is extracting rebates from utility companies and buying shitty dishwashers which were certain to be worse than what they were replacing.

Verification is useless if no one knows about it, or if the data isn't actionable. I have verified UL mark numbers for questionable products, but they often resolve to some Chinese ODM you've never heard of like 'Xionshang Industrial Electric Company' whose name certainly doesn't match the product label. Do you know the components haven't been swapped out since certification was achieved? Was the product actually sourced from there or counterfeit? You have no way to verify any of that.

UL issues holographic stickers but I've seen those like 10% of the time and probably just as easily faked.

Re:White House unveils Cyber Trust Mark program for consumer... by Jtsummers on Wednesday January 08, 2025 @03:54PM (#42638332)
https://www.energystar.gov/ - Here's the registry.

And I'm not saying this will be that useful, just that it's not going to be a sticker and nothing else. That would be truly useless and pretty much just make money for sticker makers.

Re:White House unveils Cyber Trust Mark program for consumer... by timewizard on Wednesday January 08, 2025 @10:26PM (#42641299)
"Find all the information you need to start shopping for ENERGY STAR certified products, including product details, rebates, and retailers near you."

So, the product search works like a shopping cart site, and has no historical products, only new ones, and helpfully lists the prices.

Who is this meant to benefit?

Re:White House unveils Cyber Trust Mark program for consumer... by Bjartr on Thursday January 09, 2025 @03:06PM (#42649366)
You want the "Product Specifications & Partner Commitments Search"[0], not the "Product Finder"[1]. Both are available from the top level "Find Products" menu

[0] https://www.energystar.gov/products/spec

[1] https://www.energystar.gov/productfinder

Re:White House unveils Cyber Trust Mark program for consumer... by timewizard on Thursday January 09, 2025 @05:22PM (#42650450)
That just shows specifications. I don't see a way to _confirm_ that the device I currently have in my hands, bearing the Energy Star logo, has actually earned it.
Re:White House unveils Cyber Trust Mark program for consumer... by Bjartr on Friday January 10, 2025 @11:14AM (#42656940)
Oh, I see where I misunderstood. I agree there doesn't appear to be a built in way to check, given a label, that the label is legit.

However, I was able to at least verify the label on my dishwasher by doing a google search for `site:energystar.gov <model number>` and seeing that that model comes up in the search results.

After some more digging around I think the expectation is that the trust would stem from an assumed effectiveness of the FTC to squash materially misleading advertising. Though even that needs someone to first notice a discrepancy and bother to look into it.

Kinda like how we trust that the nutrition information box on food is accurate because anyone selling food that falsifies that is going to have a bad time when the FDA comes knocking.

Is it possible to find sketchy products? Yeah, but there's often signs they're sketchy. If it's a concern for you, stick to large, established brands from large, established retailers. They're getting scrutinized up down and sideways for this kind of stuff.

Re:White House unveils Cyber Trust Mark program for consumer... by knowitnone on Wednesday January 08, 2025 @09:42PM (#42641057)
how many people search the registries when they buy stuff? I've only done it once and the product(made in China) looked janky and as cheap as can be.
Re:White House unveils Cyber Trust Mark program for consumer... by ehaskins on Wednesday January 08, 2025 @03:33PM (#42638165)
You have to have rules before you can enforce them...

It looks like part of the label [1] will include a QR or link to a public registry, so in theory you can easily confirm the device has actually been certified.

[1] https://docs.fcc.gov/public/attachments/FCC-23-65A1.pdf point 42

Re:White House unveils Cyber Trust Mark program for consumer... by anotherhue on Wednesday January 08, 2025 @03:29PM (#42638139)
The vendor is supposed to check I think. Not that that makes sense in a comingling inventory world.
Re:White House unveils Cyber Trust Mark program for consumer... by likeabatterycar on Wednesday January 08, 2025 @03:37PM (#42638193)
I'm sure Amazon - whose store is mostly generic Chinese schlock nowadays - will check.

Not that it matters, posters on this very site who claim to care will continue buying stuff off AliExpress, proud they got it for pennies on the dollar.

Look ma, a mini PC for $22! And they didn't even charge for the preinstalled malware!

Has anyone ever considered this junk is sold at a loss as a price of doing business, to expand a PRC-controlled botnet?

Re:White House unveils Cyber Trust Mark program for consumer... by simne on Wednesday January 08, 2025 @05:20PM (#42639103)
Looks like you just have not deal with bad traders on platforms. I once found on local aggregator product too cheap to be good (unfortunately at that moment only two stores sell these product).

I stored their number in my notebook and going to my shopping, calling them from bus stop, and they answered me some nonsense.

I made my shopping, and some walk, then opened platform and these shops already disappear. Less than hour.

In other case I managed to make order and paid from card, and also shop disappeared. - In a week I received SMS from bank "your payment returned to your account".

Re:White House unveils Cyber Trust Mark program for consumer... by likeabatterycar on Wednesday January 08, 2025 @05:38PM (#42639271)
Sorry my post was sarcasm. If English is a second language I can see where that could be lost in translation. I don't expect any of these vendors, especially Amazon 3rd party, to check.
Re:White House unveils Cyber Trust Mark program for consumer... by simne on Wednesday January 08, 2025 @05:51PM (#42639371)
You are welcome! I just looking on these things very serious and trying to use my knowledge to make better products/services. And sometimes I'm really surprised in good way.
Re:White House unveils Cyber Trust Mark program for consumer... by knowitnone on Wednesday January 08, 2025 @09:43PM (#42641067)
assertion without proof is paranoia. not saying you are wrong but go get some proof first
Re:White House unveils Cyber Trust Mark program for consumer... by simne on Wednesday January 08, 2025 @04:26PM (#42638616)
> What's to stop the bad actors from just printing the logo on their gear anyways?

This is federal offense, like document falsification.

So if somebody will be caught on doing it - could go to jail.

Re:White House unveils Cyber Trust Mark program for consumer... by knowitnone on Wednesday January 08, 2025 @09:44PM (#42641071)
except they are not in your country so how can to go to jail and why do they care about you laws?
Re:White House unveils Cyber Trust Mark program for consumer... by simne on Thursday January 09, 2025 @10:18AM (#42646485)
Have you hear about customs?
Re:White House unveils Cyber Trust Mark program for consumer... by ssl-3 on Thursday January 09, 2025 @01:29PM (#42648474)
None of the electronic widgets I've bought stateside from overseas sources have ever shown any evidence that they've ever been actually-inspected by US Customs.

How would they know that an item is fraudulently marked if they never look?

Re:White House unveils Cyber Trust Mark program for consumer... by simne on Thursday January 09, 2025 @02:19PM (#42648955)
For all things you buy in local shop, responsible owners of shop. If you buy anything abroad, this is your own problem and it is not relevant to subject.
Re:White House unveils Cyber Trust Mark program for consumer... by ssl-3 on Thursday January 09, 2025 @04:19PM (#42649892)
I note that none of these entities are the "customs" that I have heard about.
Re:White House unveils Cyber Trust Mark program for consumer... by simne on Thursday January 09, 2025 @05:46PM (#42650638)
You just don't know, how work defense of internal market in typical country.

1. Organizations listed in subject (NIST, FCC, deputies from tech companies) constantly create or even invent methods to check products quality and to enforce penalties for offenders, and propose regulations to approve by parliament.

2. Parliament make juridical documents and approve budgets for 1 (and 3,4 when need).

3. Customs limit penetration of abroad subjects to internal market.

4. Police, courts, deal with internal offenders, or with abroad offenders managed to infiltrate through customs to internal market.

In real life, local shop become responsible when sell products from abroad, and regulations limited possibilities to create local shops for foreigners.

Unfortunately, life is constantly changed, technologies constantly grow, so old regulations eventually become obsolete, so all these things work in endless loop.

Re:White House unveils Cyber Trust Mark program for consumer... by ssl-3 on Monday January 13, 2025 @04:59PM (#42690005)
It doesn't fucking matter how things "work defense of internal market in typical country".

Typical doesn't fucking matter here. This is a fucking US fucking policy, and the only fucking place it fucking matters to a fucking consumer in the fucking US.

For fuck's sake! Fuck.