29 ms·

This is a really misleading headline...but it did get my attention, I guess.

by ejz 8y ago

gh02t 8y ago
Agreed. According to the summary text of the bill: This bill, beginning on January 1, 2020, would require a manufacturer of a connected device, as those terms are defined, to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure, as specified. A better title would be "California to ban weak default passwords on devices." Edit: or "California to require more security features on internet-connected devices."
- kevin_thibedeau 8y ago
  That portion is pretty much toothless without any concrete definition of "reasonable". The password provisions have some merit though: Subject to all of the requirements of subdivision (a), if a connected device is equipped with a means for authentication outside a local area network, it shall be deemed a reasonable security feature under subdivision (a) if either of the following requirements are met: (1) The preprogrammed password is unique to each device manufactured. (2) The device contains a security feature that requires a user to generate a new means of authentication before access is granted to the device for the first time. Even this can be weaseled out of for most consumer IoT products as they aren't typically intended for direct access from outside the LAN.
  - macspoofing 8y ago
    >The password provisions have some merit though Does it? The problem is that they defined a very specific solution to the problem they are trying to solve as comprising of either approach (1) or (2) ... what if there is some innovative third option that neither people here nor the regulators was creative enough to think of? Now you've killed a potential innovative market from developing. >Even this can be weaseled out of That's not 'weaseling out'. That's a real world example of an approach that is perfectly secure and would be hurt by this if a regulator interpreted the law as applying to the device in question.
    - tinus_hn 8y ago
      Your browser does not know the difference between your lan and the internet so any website you visit can instruct it to interact with websites on your lan. It’s nowhere near ‘perfectly secure’ to have weak security on the lan. Besides, having weak security on a network means one compromise leads to a lot more. That isn’t very ‘perfectly secure’ either.
  - r00fus 8y ago
    > IoT products as they aren't typically intended for direct access from outside the LAN For "cloud-only IoT devices" this ban is clearly in effect.
    - kevin_thibedeau 8y ago
      Cloud only devices that push to a server are not covered.
- vezycash 8y ago
  >This bill, beginning on January 1, 2020, would require a manufacturer of a connected device, as those terms are defined, to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure, as specified. Quoted text are hard to read on HN. It's impossible to read without multiple horizontal scrolling both on PC an mobile. Just use the ">" symbol instead.
  - mikeyouse 8y ago
    Yep, I've found that the carrot + " * " marks attached before the first letter and after the last period to italicize it are a good multi-platform solution for quoting: > This bill, beginning on January 1, 2020, would require a manufacturer of a connected device, as those terms are defined, to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure, as specified.
    - mistersquid 8y ago
      This symbol ^ is a "caret" (or a "circumflex accent"). This symbol > is a "greater-than sign" or a "right angle bracket". EDIT: added Unicode name for ^.
      - mikeyouse 8y ago
        Yep, good call..
- deleted 8y ago
  [deleted]
- nashashmi 8y ago
  > A better title California requires manufacturers use better password security measures. But that is boring... so California bans manufacturers from setting weak passwords (this title creation job is hard enough for a technical person to do. journalists will have a more difficult time.)
- dang 8y ago
  OK, we'll use that. Thanks!
briga 8y ago
Maybe it's just my imagination, but I've noticed a real decline in journalistic standards at the BBC in the past few years. It's front page reads more like a clickbait tabloid than a serious news site nowadays. I guess even the big news outlets need to resort to clickbait to stay afloat.
- partiallypro 8y ago
  It's not just the BBC, it's a race to the bottom out there.
- MaxBarraclough 8y ago
  Agreed. I expect them to be above clickbaiting, but, they're really not.
macspoofing 8y ago
These kinds of laws are 'feel good' measures. The ideas behind them make sense (easy default passwords are 'bad' ... sometimes. Sensible security precautions should be taken into account when designing IoT devices). But those same precautions completely fail when used as part of a one-size fits all regulatory framework. The regulatory, enforcement and licensing mechanisms that such laws entail are either going to be ignored, in which case the entire exercise was a waste of time, or they will be needlessly onerous and create undue burden with negligible benefits ... and be ignored by many manufacturers anyway (because how are you going to police on order for some IoT widget from China). Also, it is not a good idea for lawmakers and regulators to mandate an implementation within a law (and that's exactly what mandating that per-device password needs to be unique is). Maybe my IoT device has a simple default password but has other security measures that the regulator didn't even envision that makes the solution secure. On the other end, maybe my network stack has a critical vulnerability that a unique password does nothing to mitigate. I'm not a Libertarian as I do believe in sensible government oversight and regulation but lawmakers and regulators have to be cognizant that every single regulation they put out has a cost and that cost needs to be balanced with benefits. As it stands this is a poorly thought out law, and will do nothing for security, will punish local manufacturers by increasing overhead, and will make local manufacturers less competitive against external ones that simply ignore these directives. Typical California stupidness.
- wpietri 8y ago
  Lawmakers and regulators are already cognizant that regulations have costs; they hear that from everybody already. Often they are, surprise, legally required to consider it. I agree it would be better if industry self-regulated. But they didn't. e.g.: https://www.bleepingcomputer.com/news/security/router-crapfest-malware-author-builds-18-000-strong-botnet-in-a-day/ https://www.bleepingcomputer.com/news/security/router-crapfe... If this were a problem where only the device owners were harmed, I wouldn't care a lot. Market mechanisms would take care of it. But here bad vendor security is imposing large negative externalities on the rest of the world. If government is for anything at all, it's for making people experience the consequences of their own actions instead of inflicting harm on others. This is not a perfect regulation, but it's better than nothing. Hopefully device-makers will take this as a warning shot a and get their acts together.

This is a really misleading headline...but it did get my attention, I guess.

by ejz 8y ago

This is a really misleading headline...but it did get my attention, I guess.

Agreed. According to the summary text of the bill: This bill, beginning on January 1, 2020, would require a manufacturer of a connected device, as those terms are defined, to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure, as specified. A better title would be "California to ban weak default passwords on devices." Edit: or "California to require more security features on internet-connected devices."

kevin_thibedeau 8y ago
That portion is pretty much toothless without any concrete definition of "reasonable". The password provisions have some merit though: Subject to all of the requirements of subdivision (a), if a connected device is equipped with a means for authentication outside a local area network, it shall be deemed a reasonable security feature under subdivision (a) if either of the following requirements are met: (1) The preprogrammed password is unique to each device manufactured. (2) The device contains a security feature that requires a user to generate a new means of authentication before access is granted to the device for the first time. Even this can be weaseled out of for most consumer IoT products as they aren't typically intended for direct access from outside the LAN.
- macspoofing 8y ago
  >The password provisions have some merit though Does it? The problem is that they defined a very specific solution to the problem they are trying to solve as comprising of either approach (1) or (2) ... what if there is some innovative third option that neither people here nor the regulators was creative enough to think of? Now you've killed a potential innovative market from developing. >Even this can be weaseled out of That's not 'weaseling out'. That's a real world example of an approach that is perfectly secure and would be hurt by this if a regulator interpreted the law as applying to the device in question.
  - tinus_hn 8y ago
    Your browser does not know the difference between your lan and the internet so any website you visit can instruct it to interact with websites on your lan. It’s nowhere near ‘perfectly secure’ to have weak security on the lan. Besides, having weak security on a network means one compromise leads to a lot more. That isn’t very ‘perfectly secure’ either.
- r00fus 8y ago
  > IoT products as they aren't typically intended for direct access from outside the LAN For "cloud-only IoT devices" this ban is clearly in effect.
  - kevin_thibedeau 8y ago
    Cloud only devices that push to a server are not covered.
vezycash 8y ago
>This bill, beginning on January 1, 2020, would require a manufacturer of a connected device, as those terms are defined, to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure, as specified. Quoted text are hard to read on HN. It's impossible to read without multiple horizontal scrolling both on PC an mobile. Just use the ">" symbol instead.
- mikeyouse 8y ago
  Yep, I've found that the carrot + " * " marks attached before the first letter and after the last period to italicize it are a good multi-platform solution for quoting: > This bill, beginning on January 1, 2020, would require a manufacturer of a connected device, as those terms are defined, to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure, as specified.
  - mistersquid 8y ago
    This symbol ^ is a "caret" (or a "circumflex accent"). This symbol > is a "greater-than sign" or a "right angle bracket". EDIT: added Unicode name for ^.
    - mikeyouse 8y ago
      Yep, good call..
deleted 8y ago
[deleted]
nashashmi 8y ago
> A better title California requires manufacturers use better password security measures. But that is boring... so California bans manufacturers from setting weak passwords (this title creation job is hard enough for a technical person to do. journalists will have a more difficult time.)
dang 8y ago
OK, we'll use that. Thanks!

briga 8y ago

Maybe it's just my imagination, but I've noticed a real decline in journalistic standards at the BBC in the past few years. It's front page reads more like a clickbait tabloid than a serious news site nowadays. I guess even the big news outlets need to resort to clickbait to stay afloat.

partiallypro 8y ago
It's not just the BBC, it's a race to the bottom out there.
MaxBarraclough 8y ago
Agreed. I expect them to be above clickbaiting, but, they're really not.

macspoofing 8y ago

These kinds of laws are 'feel good' measures. The ideas behind them make sense (easy default passwords are 'bad' ... sometimes. Sensible security precautions should be taken into account when designing IoT devices). But those same precautions completely fail when used as part of a one-size fits all regulatory framework. The regulatory, enforcement and licensing mechanisms that such laws entail are either going to be ignored, in which case the entire exercise was a waste of time, or they will be needlessly onerous and create undue burden with negligible benefits ... and be ignored by many manufacturers anyway (because how are you going to police on order for some IoT widget from China). Also, it is not a good idea for lawmakers and regulators to mandate an implementation within a law (and that's exactly what mandating that per-device password needs to be unique is). Maybe my IoT device has a simple default password but has other security measures that the regulator didn't even envision that makes the solution secure. On the other end, maybe my network stack has a critical vulnerability that a unique password does nothing to mitigate. I'm not a Libertarian as I do believe in sensible government oversight and regulation but lawmakers and regulators have to be cognizant that every single regulation they put out has a cost and that cost needs to be balanced with benefits. As it stands this is a poorly thought out law, and will do nothing for security, will punish local manufacturers by increasing overhead, and will make local manufacturers less competitive against external ones that simply ignore these directives. Typical California stupidness.

wpietri 8y ago
Lawmakers and regulators are already cognizant that regulations have costs; they hear that from everybody already. Often they are, surprise, legally required to consider it. I agree it would be better if industry self-regulated. But they didn't. e.g.: https://www.bleepingcomputer.com/news/security/router-crapfest-malware-author-builds-18-000-strong-botnet-in-a-day/ https://www.bleepingcomputer.com/news/security/router-crapfe... If this were a problem where only the device owners were harmed, I wouldn't care a lot. Market mechanisms would take care of it. But here bad vendor security is imposing large negative externalities on the rest of the world. If government is for anything at all, it's for making people experience the consequences of their own actions instead of inflicting harm on others. This is not a perfect regulation, but it's better than nothing. Hopefully device-makers will take this as a warning shot a and get their acts together.