The ban on universal default passwords
The PSTI Act prohibits connectable products from having a universal default password shared across all devices of the same model. Manufacturers must ensure that each device either has a unique default password or requires the user to create a custom password before the product becomes functional.
What it means
The primary intent is to eliminate "class breaks," where an attacker can use a single known credential (e.g., "admin/admin") to compromise millions of devices globally via automated botnets. By removing universal passwords, the attack surface is shifted from a single point of failure to individual device targets.
This requirement applies to any connectable or internet-connectable product placed on the UK market. This includes administrative interfaces, web consoles, and API endpoints that require authentication.
The scope covers both the software configuration shipped from the factory and the physical labeling provided with the hardware. It is not enough for a device to "recommend" a password change; the system must prevent access until a unique or user-defined credential is in place.
How to meet it
- Implement a unique, randomly generated password for every individual unit during the manufacturing process.
- Print this unique password on a physical label attached to the device or include it within the product's specific packaging.
- Design the initial setup (Out-of-Box Experience) to force the user to create and set their own strong password before they can access administrative features.
- Disable all factory-set accounts used for internal testing, debugging, or quality assurance prior to shipping.
- Ensure that any unique passwords generated are cryptographically strong and not derived from predictable patterns such as the device serial number.
Evidence an auditor asks for
- Technical design specifications detailing the password generation logic or the forced-password-change workflow.
- Samples of physical product labels showing unique per-device credentials.
- A demonstration or screen recording of the first-boot process proving that administrative access is blocked until a password is set.
- Manufacturing records or scripts demonstrating how unique passwords are injected into devices during production.
Common pitfalls
- Using "pseudo-unique" passwords generated by simple algorithms (e.g., appending the MAC address to a static string), which allows attackers to reverse-engineer the pattern.
- Retaining hidden "backdoor" accounts for support or maintenance that use a shared, static password across the product line.
- Providing an option in the setup menu that allows users to skip the forced password change and proceed with a default state.