> HTTPS, certificate pinning, no hardocded backdoors, and per-device random initial passwords would probably be a huge boon That's what I meant by check-mark s

> HTTPS, certificate pinning, no hardocded backdoors, and per-device random initial passwords would probably be a huge boon That's what I meant by check-mark security. Yes, it is better than nothing, and by all means let's do that. It's low hanging fruit, and it should be plucked. But in the end it amounts to little more than hanging an air re-freshener on a huge pile of garbage. I'm just pointing out that such certification might cause executives in companies that today put more effort into securing their devices to stop putting in that effort. If it's all the same to the consumer, why spend any more than the bare minimum to get a check mark? Today there's no clear bar, and a good engineering team will always be able to convince a responsible management that they need to put effort in security. But once that fairly low bar is set, I think that the next order from the management will be "make our devices certifiable and nothing more".