UK lays down fresh legislation banning crummy default device passwords

The UK’s Product Security and Telecommunications Infrastructure (PSTI) Act now mandates baseline security for consumer smart devices, prohibiting easily discoverable default passwords, requiring a public point of contact for reporting vulnerabilities, and disclosure of minimum security update periods. Enforced by the Office for Product Safety and Standards with penalties up to £10 million or 4% of global revenue, the law is broadly welcomed as a foundational step; however, experts note it covers only a subset of ETSI recommendations and question how rigorously it will be enforced, with the NCSC issuing complementary guidance on strong passwords.