3 ms·

These kinds of laws are 'feel good' measures. The ideas behind them make sense (easy default passwords are 'bad' ... sometimes. Sensible security precautions sh

These kinds of laws are 'feel good' measures. The ideas behind them make sense (easy default passwords are 'bad' ... sometimes. Sensible security precautions should be taken into account when designing IoT devices). But those same precautions completely fail when used as part of a one-size fits all regulatory framework. The regulatory, enforcement and licensing mechanisms that such laws entail are either going to be ignored, in which case the entire exercise was a waste of time, or they will be needlessly onerous and create undue burden with negligible benefits ... and be ignored by many manufacturers anyway (because how are you going to police on order for some IoT widget from China). Also, it is not a good idea for lawmakers and regulators to mandate an implementation within a law (and that's exactly what mandating that per-device password needs to be unique is). Maybe my IoT device has a simple default password but has other security measures that the regulator didn't even envision that makes the solution secure. On the other end, maybe my network stack has a critical vulnerability that a unique password does nothing to mitigate. I'm not a Libertarian as I do believe in sensible government oversight and regulation but lawmakers and regulators have to be cognizant that every single regulation they put out has a cost and that cost needs to be balanced with benefits. As it stands this is a poorly thought out law, and will do nothing for security, will punish local manufacturers by increasing overhead, and will make local manufacturers less competitive against external ones that simply ignore these directives. Typical California stupidness.

wpietri 8y ago
Lawmakers and regulators are already cognizant that regulations have costs; they hear that from everybody already. Often they are, surprise, legally required to consider it. I agree it would be better if industry self-regulated. But they didn't. e.g.: https://www.bleepingcomputer.com/news/security/router-crapfest-malware-author-builds-18-000-strong-botnet-in-a-day/ https://www.bleepingcomputer.com/news/security/router-crapfe... If this were a problem where only the device owners were harmed, I wouldn't care a lot. Market mechanisms would take care of it. But here bad vendor security is imposing large negative externalities on the rest of the world. If government is for anything at all, it's for making people experience the consequences of their own actions instead of inflicting harm on others. This is not a perfect regulation, but it's better than nothing. Hopefully device-makers will take this as a warning shot a and get their acts together.
- macspoofing 8y ago
  >Often they are, surprise, legally required to consider it. Well. They don't. This law is an example. >but it's better than nothing. No. It's worse than nothing, and that's the point. It will do nothing to improve security and but leave the associated burden that wasn't there before.

wpietri 8y ago

Lawmakers and regulators are already cognizant that regulations have costs; they hear that from everybody already. Often they are, surprise, legally required to consider it. I agree it would be better if industry self-regulated. But they didn't. e.g.: https://www.bleepingcomputer.com/news/security/router-crapfest-malware-author-builds-18-000-strong-botnet-in-a-day/ https://www.bleepingcomputer.com/news/security/router-crapfe... If this were a problem where only the device owners were harmed, I wouldn't care a lot. Market mechanisms would take care of it. But here bad vendor security is imposing large negative externalities on the rest of the world. If government is for anything at all, it's for making people experience the consequences of their own actions instead of inflicting harm on others. This is not a perfect regulation, but it's better than nothing. Hopefully device-makers will take this as a warning shot a and get their acts together.

macspoofing 8y ago
>Often they are, surprise, legally required to consider it. Well. They don't. This law is an example. >but it's better than nothing. No. It's worse than nothing, and that's the point. It will do nothing to improve security and but leave the associated burden that wasn't there before.