New U.K. Law Bans Default Passwords on Smart Devices Starting April 2024

The U.K. National Cyber Security Centre is urging smart-device manufacturers to comply with the Product Security and Telecommunications Infrastructure (PSTI) Act — effective April 29, 2024 — which bans guessable default passwords, requires a security contact, and mandates disclosure of update durations to help prevent IoT devices from being conscripted into DDoS botnets like Mirai; the report also notes ongoing Mirai-variant DDoS activity and references an unrelated $196M FCC fine for carriers illegally sharing customers' real-time location data.