Slashdot Mirror
California Passes Wi-Fi Guidance Law
MrNonchalant writes, "California's legislature has passed a law requiring Wi-Fi device manufacturers to include warnings about security. From the article: 'From 1 October 2007, manufacturers must place warning labels on all equipment capable of receiving Wi-Fi signals, according to the new state law. These can take the form of box stickers, special notification in setup software, notification during the router setup, or through automatic securing of the connection. One warning sticker must be positioned so that it must be removed by a consumer before the product can be used.'"
A law like this is only as good as the warnings. If the warnings wind up being heavy on the legal boilerplate or tech jargon, not many of the people who really need them will be helped. But if they are written with the law's intended target in mind -- clueless Mom and Pop (or Ted Stevens) -- and use simple explanations and instructions for securing the WiFi connection, the law could be a good thing. That's said, I'm kind of pessimistic . . .
This idea that people should not share wireless (even when their ISP allows it) is just one more step in wrecking the freedom of the internet.
For the cost of all these stickers (physical materials, labor, employee time spent in proper implementation meetings, enforcement), will consumers be one jot safer?
Well intentioned as this might be, it's probably worse than doing nothing at all. If you don't know what wi-fi does you shouldn't be buying it, and a five page manual (even with a cautionary sticker) is hardly going to cover the fundamentals of wireless encryption and firewalling a user needs to approach the security of a wired connection.
I never vote for anyone. I always vote against.
-- W.C. Fields
Of course, these stickers will still be ignored just like EULA's, software manuals, etc.
"Instructions on how to pour piss from a boot shall be written upon the heel of said boot."
Here's your sign.
Telling people how to do it is not going to solve the problem. When I headed up the IT department for my old company I established a program where people could fedex in their routers and we would secure them and fedex them back... at no cost to them (I successfully argued that the cost of next day air was less than the cost of a potential breach). One person out of a company of 300 took advantage of it. As much as I hate big government/big brother there are times when you have to overcome apathy but legislation. It sucks but it's true... and there is a simple solution to this problem. Almost every piece of commercial software you buy today includes a key that is, for practical purposes, unique. The technology to create, assign and distribute these keys exists and can be done at a price point low enough to pass on to the consumer without them caring (e.g. $5 a router, most of which pays for support and not the actual technology to do it). The legislation should not mandate that users are told *how* to secure the router. It should mandate that the routers are *shipped* secured, with a pseudo-random key pre-program and stuck on the outside of the router with a label. Just like the keys you get if you buy Windows. The problem is the support costs... but good documentation can take care of must of that, along with a little $ tacked onto the cost of the router.
Isn't it funny how productive one can be when they're no longer worried that some corporation is poisoning them to make a quick buck?
Correllation != causation.
And another thing. The cost of warning stickers is inevitably reflected in the product's price. Therefore, the actual effect of this law is to force the consumer to purchase warning stickers that may or may not be necessary, useful, or effective.
FATMOUSE + YOU = FATMOUSE
Canadian ISP Sympatico actually distributes 802.11g routers to its customers who request them. Those routers run a customized firmware that steps the user through some basic settings. (Ie. what is your account name... what is your password...) It also mandatorily activates WEP during this process, so once you're done and the router goes fully live, you either must be using a wired connection or using the WEP key the router randomly assigns you. You can web in to the router's admin screens and disable WEP afterwards if you really desire to do so.
The intent of course is to protect against undesired casual use. Stop the punk next door from using 99% of your bandwidth doing bittorrent transfers day in and day out. I commend Sympatico for this effort. Sure, if someone REALLY wants in, they can get in. But there's no reason to make it any easier than you, the customer, intend it to be within the limits of the available technology.
"Oh no... he found the
As noted in a previous article http://www.darkreading.com/document.asp?doc_id=102 624 This is not being done to educate; it is done to control.
There are two groups this shafts:
1) The ignorant "sharer" who does not understand security and gets penalized by the government after "warnings" are done away with by the penal system
2) The intentional sharer who believes in free Interent access for all.
Why this needs to be legislated? Who knows... Sad state of affairs when the government tells people who is allowed to come over for supper...
Both political parties do stupid things. When the democrats do stupid things, it is often things like this.
The stupid things republicans do are typically a little different.
Avoid Missing Ball for High Score
Personally I think we just did the entire English-speaking world a favor... I highly doubt companies will only put on the sticker and include directions on how to secure wireless routers destined for California, they'll just slap them on everything.
Next maybe we'll clean up the video game rating system... trust me, you'd MUCH rather have us do that instead of the US Congress ;)
Beauty is just a light switch away.
I think part of my post got interpreted as some kind of socialist wishful thinking, the 'isn't is part of their responsiblity...
in fact the point I'm going towards is that the companies are going after the ignorant consumers, not the saavy ones. These products are in best buys and walmarts, not just techie computer stores / websites. For example, I have had a few linksys routers. They all come with some crappy 'wizard' software that tries to make everything work for me, but they do a terrible job and don't ultimately make my experience more secure.
If they're already droppping, say, somewhere between 20 and 100 thousand bucks on a fancy autorun installer / wizard application (i've build large scale distro cd-roms so I can vouch for that as a pretty solid entry level price) that has a bunch of talking heads, why not actually make it useful and have it configure things properly.
The us govt has gone so far as to mandate corporate responsibility beyond the 'throw them to the wolves buyer beware' free market 'if my product is too tough people will buy something else' mentality through things like the americans with disabilites act and other consumer warranty styled laws that require manufacturers to go beyond just the minimum.
Why again is this different? Why can't we expect our corporate citizens to take the same degree of responsibility towards educating their customers as you're suggesting be requisite of the customers themselves?
Further, as a shareholder of some of these companies, I would want to think that an extra 10 - 20k now during the development might save my investment in the company hundreds of thousands in unnecessary customer support time or other troubleshooting, and or possible litigation.
Just my several cents.
Mozy, free online backup service
--
In the long run this will benefit the tech industry. It is much more difficult to sue a manufacturer for a defect in the equipment or how the equipment functions if there is adequate warning. As long as the mythical "reasonable person" would see the warning and read it before using the equipment, nimwits whose unsecured wifi networks get hacked will not be able to sue.
Anticipating responses:
Read the EFF's Fair Use FAQ
It's about time there are warnings on wireless devices, many consumers set up wireless networks with weak or no security at all, and they dont realize the legal trouble they can get into these days (with the riaa, mpaa, etc).
I fear the Y2038 bug