Post #4210546

2026-07-21 17:08 UTC

@fazalmajid@social.vivaldi.net Wow, regulation that specific is great, I wish it were common here in the US. The manufacturer of the charger that was targeted is based in Germany and by all accounts are at least moderately common in parts of mainland Europe. I wonder if they have any in the UK and if those are better protected (ironic) or also vulnerable (and illegal).

Replies (1)

@fazalmajid@social.vivaldi.net 2026-07-21 18:50

@ryanboswell@sfba.social As Schneier points out, California was first: https://techcrunch.com/2018/10/05/california-passes-law-that-bans-default-passwords-in-connected-devices/ Also, Congress passed the Internet of Things Cybersecurity Improvement Act of 2020 in 2020: https://www.govinfo.gov/content/pkg/COMPS-15863/pdf/COMPS-15863.pdf in response to which NIST published SP 800-213 and the NISTIR 8259 series: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-213.pdf https://www.nist.gov/itl/applied-cybersecurity/nist-cybersecurity-iot-program/nistir-8259-series The Biden Administration created the "Cyber Trust Mark", but it's optional labelling, not mandatory, and it is still being set up: https://www.fcc.gov/CyberTrustMark Normally devices would have to pass UKCA certification, and the manufacturer would have to attest compliance under penalty of perjury, but what practical enforcement there is, I have no idea. Certification testing was a big business in the UK before Brexit, but many manufacturers just skipped UKCA as the UK was too small a market compared to the EU and CE.

Open ##4210547