Removal of default passwords legislation

[Ozone]

I'm sure everyone is aware of this and I thought I might have seen a thread on this on PH as its my go to for the latest but haven't seen anything.

From Monday the 29th of April the UK’s consumer connectable product security regime will come into effect:

Link

[FourWheelDrift]

Basically, if the password is "password" or "admin" they suggest it's changed.

[Ozone]

The legislation is for all connectable hardware devices sold from Monday from routers to printers to web cams, everything.

https://www.technologylawdispatch.com/2023/05/regu...

Edited by Ozone on Wednesday 24th April 21:40

[babelfish]

FourWheelDrift said:

Basically, if the password is "password" or "admin" they suggest it's changed.

No - "the creation of default passwords (which must be unique for each product (and not easily guessable) or defined by the user);" - Part 1 Product Security and Telecommunications Infrastructure Act 2022

[Griffith4ever]

I guess everything will come with a bar code now and a horrific username and password. Will be fun when a remote mounted cam or CPE resets to defaults , 20 ft up a pole...... Devices changing back to defaults has been a life saver in terms of hassle. We are going to end up binning a lot of used gear.

I understand the reasoning but hmm....

[Solocle]

Hmm, hadn't heard of this, and wondering whether it actually applies to products we manufacture! The connectable bit is an exempt desktop PC, but the product is far more than a PC.

I think it's moot as it seems that products made available in NI are exempt!?
The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023

[Ozone]

I believe the same rules will be implemented in the EU next year so be prepared to have the necessary certificates for manufactured products.

[Solocle]

Ozone said:

I believe the same rules will be implemented in the EU next year so be prepared to have the necessary certificates for manufactured products.

Ah, digging deeper into the Act it does specify consumer products. So it doesn't apply.

[Mr Whippy]

Great until manufacturer X gets attacked/leaked their password generation algo and every device’s Mac and password are known.

When will they learn!



Tbf most of this issue is caused by account/password saturation and user apathy… because you need an account for everything these days, needlessly so.

It’d be better if account-less operation modes were more common so you could just use devices as generic user A, B, C etc…
Apple TV for instance… or BBC iPlayer, or YouTube on your TV, etc etc.

[Griffith4ever]

Mr Whippy said:

Tbf most of this issue is caused by account/password saturation and user apathy… because you need an account for everything these days, needlessly so.

Amen to that! I've stopped using some things because they insist on an account logon.

- Radio X - no more - can't even stream the website without an account.
- I ditched a hardware manufacturer for my business (I sell a LOT of a specific type of unit) because they changed their app to insist on the creation of a user account for absolutely no benefit to the end user, and my customers found it annoying and intrusive.
- As per another thread, I'm so overwhelmed with strong password requirements for SO many things I've given up and let google password manager handle it, and if it won't remember a specific one, I just reset the password to something auto generated every time I log on.