Forgot the password? Your device is bricked.

I think it's a good idea. They should also ban WEP while they're at it since it provides almost no security.
 
SuperSubZero said:
I haven't seen the "correct horse battery stapler" comic in several years.

...and it's freakin right.
Click to expand...
this one?
th?id=OIP.jpg
 
M76 said:
It's there in the direct quote:


It doesn't say you can't reset to the original password, but chances are that if you don't know your own password you won't know the original unique password either, unless you kept it documented somewhere.
Click to expand...

It's printed on the label on the device along with the serial number, model number, etc. You don't have to remember anything, and resetting it doesn't brick it. Completely misleading/mistaken thread title.
 
GoodBoy said:
It's printed on the label on the device along with the serial number, model number, etc. You don't have to remember anything, and resetting it doesn't brick it. Completely misleading/mistaken thread title.
Click to expand...
I made the mistake of assuming you don't want to have the password on the device for security. I forgot you can change the password so people with physical address can't access the admin page. So it is not bricked assuming all manufacturers put the password on the device itself.
 
Zarathustra[H] said:
This.

I support this.

Furthermore, I'd like to ban any claim of encryption where the encryption key resides on any central server or service.

Encryption keys should need to be manually installed on each and every device that need them. Inconvenient, yes, but the only way you can be sure there is no man-in-the-middle.
Click to expand...

Apple already does this and every dick and his dog still bitches and moans about right to repair. Expect the most secure device in the world but still expect to be able to repair it yourself.
 
People get a filing box and stick your device default password in there along with your birth certificates, property titles, and other shit. Its not rocket science.
 
I do not want to get political with this so I pose a rhetorical question, how is this not a political move? Dont answer. This is a really hard topic to discuss without crossing the rules line imo.

Ill just say that is another freedom lost if this is true.
 
Is someone really going to break into your house to steal your coffee maker/refrigerator/toaster password if it's printed somewhere directly on the unit?
 
IcePickFreak said:
Is someone really going to break into your house to steal your coffee maker/refrigerator/toaster password if it's printed somewhere directly on the unit?
Click to expand...
No, but you can't have it on the device in a hotel lobby, or office building. Even at home you perhaps want to keep your kids out of the filters in your router.
 
Zarathustra[H] said:
This.

I support this.

Furthermore, I'd like to ban any claim of encryption where the encryption key resides on any central server or service.

Encryption keys should need to be manually installed on each and every device that need them. Inconvenient, yes, but the only way you can be sure there is no man-in-the-middle.
Click to expand...

Wow someone doesn't want ssl any more.
 
NeoNemesis said:
The flip side to this is that by NOT doing this, you inevitably create massive bot nets around compromised IoT devices.

The simple solution is to stick / etch the unique password onto the device itself.



Correct me if I'm wrong, from this I don't think it's saying you can't reset the password, just that you can't reset it to some universal default like 123456.

In my opinion, this is a MASSIVE step in the right directly.
Click to expand...
This is very bad. So this is like if your smartphone doesn't work to the point that it's bricked at the password level. It happens if for some reason it hangs while you were inserting a new password. Then you cannot erase it to factory level and configure it again.
This is a bit like what Apple does on its iphones so it is very difficult to resell apart from doing it through Apple channel.
 
Grimlaking said:
Wow someone doesn't want ssl any more.
Click to expand...

I'm not talking about SSL. I'm talking about encryption of stored data. In general I am opposed to everything and anything cloud, but if cloud has to exist, it should be set up so the user, and only the user possesses the encryption key.

I don't see any way of doing this without having the user manually install the key on each device to be used. Any automation of this process requires that your key be put in the hands of someone else.
 
Have you checked the new law in EU regarding your bank account ? It is just crazy. If you ever want to buy or pay for something, you can only do it with your card (no check apart for some rare transactions) and yo need to validate that with an App on your phone and your figerprint or facial recognition and a password which needs to be changed every 3 months. Applicable on the 1st April (not an April's fool). Just crazy and not secured at all. It is just that if someone hacks you, it will be so good, that you won't have good proofs to get the money back and so the bank won't lose anything and police won't look into it, will consider yourself responsible for your loss. But in the mean time paying with real money and checks are becoming illegal (especially in France and Sweden)... so no more choice.
 
aokman said:
Apple already does this and every dick and his dog still bitches and moans about right to repair. Expect the most secure device in the world but still expect to be able to repair it yourself.
Click to expand...

Right to repair has nothing to do with this. Cell phones are already generally secure (the point of the proposal/law), but with physical access can be broken in to. This is about set and forget type devices like IoT connected refrigerators, wifi routers, edge devices. Right to repair is not impacted at all by this.

IcePickFreak said:
Is someone really going to break into your house to steal your coffee maker/refrigerator/toaster password if it's printed somewhere directly on the unit?
Click to expand...
M76 said:
No, but you can't have it on the device in a hotel lobby, or office building. Even at home you perhaps want to keep your kids out of the filters in your router.
Click to expand...

Those are not reasons to not hold hardware manufacturers to best practices regarding the security of their devices. In the above situation they can remove those passwords from the devices' labels.

It's still a good idea that is long overdue.
 
Jandor said:
This is very bad. So this is like if your smartphone doesn't work to the point that it's bricked at the password level. It happens if for some reason it hangs while you were inserting a new password. Then you cannot erase it to factory level and configure it again.
This is a bit like what Apple does on its iphones so it is very difficult to resell apart from doing it through Apple channel.
Click to expand...


Not at all.

No one is saying that the factory reset option should go away.

Just that when you factory reset you reset it to a unique password for that one device, not the same password for all devices. That unique password can be laser etched into the device, so that you never lose it.

It is also not a security issue to have it laser etched, as the device would have to be encrypted, and wipes the key upon factory reset, so all data is inaccessible.

This is just common sense. Any time you use the same default password across your entire product lineup bad things can and will happen.
 
Zarathustra[H] said:
Not at all.

No one is saying that the factory reset option should go away.

Just that when you factory reset you reset it to a unique password for that one device, not the same password for all devices. That unique password can be laser etched into the device, so that you never lose it.

It is also not a security issue to have it laser etched, as the device would have to be encrypted, and wipes the key upon factory reset, so all data is inaccessible.

This is just common sense. Any time you use the same default password across your entire product lineup bad things can and will happen.
Click to expand...
Ah ok. So this is already the case on many devices, like the Orange Boxes. Not a big deal. On the contrary it's good. Many persons leave the default password.
 
Lakados said:
With hardware forced timeouts for wrong attempts, say 15 min after 3 failed attempts to prevent brute force attacks.
Click to expand...

The problem with a hardware forced timeouts is that would be tantamount to a denial of service/access to the device. A hacker could deny the owner the ability of accessing the device. Sure, save the in internet from an IoT botfarm but deny the owner of the device the ability to access and control said device. It's a double edged sword.
I would agree with a mandatory default password change after initial startup and configuration of the device. Seems to be the easiest and most logical method of stopping root password issues.
 
Psychonic said:
The problem with a hardware forced timeouts is that would be tantamount to a denial of service/access to the device. A hacker could deny the owner the ability of accessing the device. Sure, save the in internet from an IoT botfarm but deny the owner of the device the ability to access and control said device. It's a double edged sword.
Click to expand...

Umm, no. If the devices are made with a focus on security, remote management option will be disabled by default. And if it is enabled and a hacker keeps trying and locking the administration of the device, unplug it from the internet for 15 minutes.

Saving the internet from a botfarm is far better that not.
 
GoodBoy said:
Umm, no. If the devices are made with a focus on security, remote management option will be disabled by default. And if it is enabled and a hacker keeps trying and locking the administration of the device, unplug it from the internet for 15 minutes.

Saving the internet from a botfarm is far better that not.
Click to expand...

Agreed. If someone cant use their toaster for 15 mins is a small price to pay to prevent botnets from dropping entire online services and providers (which would result in the user not being able to log into their toaster anyways).
 
Jandor said:
Have you checked the new law in EU regarding your bank account ? It is just crazy. If you ever want to buy or pay for something, you can only do it with your card (no check apart for some rare transactions) and yo need to validate that with an App on your phone and your figerprint or facial recognition and a password which needs to be changed every 3 months. Applicable on the 1st April (not an April's fool). Just crazy and not secured at all. It is just that if someone hacks you, it will be so good, that you won't have good proofs to get the money back and so the bank won't lose anything and police won't look into it, will consider yourself responsible for your loss. But in the mean time paying with real money and checks are becoming illegal (especially in France and Sweden)... so no more choice.
Click to expand...

Just checked, and the only recent thing regarding account security is: https://www.ccpc.ie/consumers/2019/...e-how-you-bank-and-shop-online-are-you-ready/

Guess what: you're spreading a load of bull manure. For example, the only change for me is that I will require 2 step authentication (my bank is using a non-internet-connected device) to log in instead of merely a password.
 
Last edited:
GoodBoy said:
They already do this on some wifi routers. The password is printed right on the label. BFD.

It's about time, and they need to pass this in the US also.
Click to expand...
I think my router and/or cable modem does this. And yeah its better than having admin/<nul> as the default login/password that I'm sure quite a few people never change
 
GoodBoy said:
Right to repair has nothing to do with this. Cell phones are already generally secure (the point of the proposal/law), but with physical access can be broken in to. This is about set and forget type devices like IoT connected refrigerators, wifi routers, edge devices. Right to repair is not impacted at all by this.




Those are not reasons to not hold hardware manufacturers to best practices regarding the security of their devices. In the above situation they can remove those passwords from the devices' labels.

It's still a good idea that is long overdue.
Click to expand...

It has everything do with it, you cant do data recovery / swap out SSD’s when they are
GoodBoy said:
Right to repair has nothing to do with this. Cell phones are already generally secure (the point of the proposal/law), but with physical access can be broken in to. This is about set and forget type devices like IoT connected refrigerators, wifi routers, edge devices. Right to repair is not impacted at all by this.




Those are not reasons to not hold hardware manufacturers to best practices regarding the security of their devices. In the above situation they can remove those passwords from the devices' labels.

It's still a good idea that is long overdue.
Click to expand...

Yes it does, everything from iPhone data recovery demanding access to manufacturer tools right down to the T2 hardware encryption chip that ties all Mac’s SSD’s to the board.
 
aokman said:
Yes it does, everything from iPhone data recovery demanding access to manufacturer tools right down to the T2 hardware encryption chip that ties all Mac’s SSD’s to the board.
Click to expand...

Is this your first time reading about the idea of encryption?
 
aokman said:
Hardware encryption not shitty software encryption.
Click to expand...

My bad. I thought you were anti hardware encryption because the only example you could think of that you didn't like was one that was hardware encryption. That must be some new logical technique.
 
M76 said:
Iot device manufacturers must be thrilled by a new UK legislation that requires the use of unique default passwords on all connected devices. And more importantly bans the password reset feature.

This means if you forget the password and don't have the original documentation with your unique password you can throw out the device because it is basically bricked.

Let's be honest you don't often need the password for most devices so it is more than likely to get misplaced or forgotten after a few months or years. Chalk another one up for planned obsolescence, this time mandated by the state.



Source
Click to expand...
Isn't that essentially how routers are now? I know my Netgear router's default looks unique, and it's probably 6-8 years old.
 
You must log in or register to reply here.
Back
Top