Storbritannien bliver første land til at forbyde nemt gættbare standard adgangskoder på forbrugernes smarte enheder
On April 29, 2024, the United Kingdom became the first country to make easily guessable default passwords on consumer smart devices a legal problem, not a user problem. The Product Security and Telecommunications Infrastructure Act does not ban every factory password. It bans the ones everyone already knows: admin, 12345, the string printed in a PDF on the manufacturer’s website. A device can still ship with a credential if that credential is unique to the unit, or if setup forces the buyer to set their own.
Two other rules sit next to the password ban. Makers must publish a way for researchers and owners to report holes. They must also say, in public, how long the gadget will get security updates. Those three lines track the ETSI EN 303 645 standard that has become the global IoT floor. The Office for Product Safety and Standards, inside the Department for Business and Trade, enforces it. The fine is up to £10 million or 4 percent of worldwide turnover, whichever is larger. Importers and retailers are in the net, not just the factory in Shenzhen.
The law covers speakers, TVs, doorbells, baby monitors, cameras, tablets, phones, consoles, fitness trackers, bulbs, plugs, kettles, thermostats, ovens, fridges, and washers. The point is Mirai. Cloudflare’s first-quarter 2024 DDoS report still had Mirai variants behind about four in 100 HTTP attacks and two in 100 network-layer attacks, years after the original botnet was dismantled. Default passwords are how those botnets are born.
En etage, ikke en ø
California banned weak defaults in a 2018 law that took effect in 2020. Manufacturers do not like building a special insecure version for one country, so a hard rule in a big market tends to raise the floor everywhere. The EU Cyber Resilience Act is scheduled to bite across the bloc by 2027. The United States has a voluntary Cyber Trust Mark. Australia’s Cyber Security Bill 2024 looks a lot like PSTI. The UK’s NCSC has said it is “highly likely” the rules will later cover business kit, not just the junk in the living room.
Samme uge PSTI trådte i kraft, Citizen Lab viste, hvad der sker, når krypteringen på tastaturet selv er junk. AEGIS Alliance dækkede over, at pinyin- app lækage af næsten en milliard brugernes tastetrykFor mere, se Tech News og Internationale nyheder. Officiel vejledning bor på Uk nationalt cybersikkerhedscenter.
