>The password provisions have some merit though Does it? The problem is that they defined a very specific solution to the problem they are trying to solve as c

>The password provisions have some merit though Does it? The problem is that they defined a very specific solution to the problem they are trying to solve as comprising of either approach (1) or (2) ... what if there is some innovative third option that neither people here nor the regulators was creative enough to think of? Now you've killed a potential innovative market from developing. >Even this can be weaseled out of That's not 'weaseling out'. That's a real world example of an approach that is perfectly secure and would be hurt by this if a regulator interpreted the law as applying to the device in question.