UK government wants to ban the use of default passwords on consumer electronics

In context: It is not uncommon to see consumers use the default password for their devices, leaving them vulnerable to potential cyberattacks. To remedy this situation, the UK government passed a bill that will ban tech companies from using default passwords on their devices, among other requirements.

The UK government Telecommunications infrastructure and product safety bill (PSTI) is divided into two parts. As the name implies, the first part comprises product safety measures to protect consumers and businesses from cyberattacks. The second part includes telecommunications infrastructure guidelines created to speed up the installation, use, and upgrade of such equipment.

The first part of the bill presents three requirements to achieve its goal: banning default passwords, requiring products to have a vulnerability disclosure policy, and transparency about how long products will receive essential security updates.

The list of devices covered by security requirements includes smartphones, connected consumer electronics and home appliances, security-relevant connected alarm products and systems, IoT hubs, smart home assistants, and home automation products. Interestingly, the list does not include computers. Once accepted, the government will provide at least 12 months for manufacturers, importers and distributors to adapt to the new legislation.

The telecommunications infrastructure measures are aimed at expediting the implementation of new 5G and broadband networks with gigabit capacity. These rules will encourage the use of alternative dispute resolution instead of resorting to legal procedures, allow operators to share and upgrade buried infrastructure components, and streamline the renewal process once agreements have expired.

The bill has yet to receive royal approval, the last step before becoming royal law. So far, we have not heard of any other region applying similar legislation, but it would not be surprising to see some follow suit. Google and Microsoft have already come up with some of their own measures to increase user safety. Google, for example, unfulfilled accounts to use 2-Step Verification and improved password security in Chrome 88, while Microsoft additional a passwordless option for your accounts.