Three cheers for the U.K. on this one. Kevin Purdy reports:
If you build a gadget that connects to the Internet and sell it in the United Kingdom, you can no longer make the default password “password.” In fact, you’re not supposed to have default passwords at all.
A new version of the 2022 Product Security and Telecommunications Infrastructure Act (PTSI) is now in effect, covering just about everything that a consumer can buy that connects to the web. Under the guidelines, even the tiniest Wi-Fi board must either have a randomized password or else generate a password upon initialization (through a smartphone app or other means). This password can’t be incremental (“password1,” “password54”), and it can’t be “related in an obvious way to public information,” such as MAC addresses or Wi-Fi network names. A device should be sufficiently strong against brute-force access attacks, including credential stuffing, and should have a “simple mechanism” for changing the password.
Read more at Ars Technica.
In related coverage, Bruce Schneier notes that while the U.K. may be the first country to enact such legislation, California was the first jurisdiction: “It banned default passwords in 2018, the law taking effect in 2020.”
Thanks to Joe Cadillic for sending this along.