4 ms·

Fines and a ban on default passwords in new UK law

• raxxorrax 5y ago
  I feel this just makes some things more difficult. You have to set the pwd externally in addition to flashing an image and missing or lost stickers will result in support cases. In such a case where the device is rendered useless and has to go back to the manufacturer and be reflashed or destroyed if there is no database with default password. The presence of the latter would be a security risk itself.
  • OJFord 5y ago
    I think that's just poor phrasing in the article - seems like unique passwords that can be reset to are ok, just not a common default of <manufacturer>1234 for example. I think they've mostly improved, but you used to be able to just search '<manufacturer/ISP> router default password' and get admin access assuming it hadn't been changed (and who here knows someone that doesn't read HN and would change a router password...)
    • raxxorrax 5y ago
      That would require me to have a note with the generated password around otherwise you can only reset it in a state inaccessible for everyone. Or the manufacturer has a db with all serial number and pwd combination, which remains a security issue. You could as well force the user to set a password for the device to work and a way to reset to factory default. But this would probably now be against the law.
      • OJFord 5y ago
        They tend to be printed on the device itself, along with serial number and default SSID etc.