3,000 Public Surveillance Cameras - 1 Website

Recall our poll on the default password directory report. 21% of IPVM readers say they always use default passwords in production.

I have no opinion on the erosion of the stature of any position, it's not something that deeply affects me one way or the other.

In regards to first-init password management, my concern is with devices that force you to supply unique credentials before you can effectively use them. There are many cases (IMHO) where you might be bringing a device online, but not at the point where you want to go making ANY changes to the default config.

My opinion is that manufacturers should concentrate on building reliable devices with the neccessary set of features and configuration options for their target market, but should leave the customization or personalization of those features and options to the customer's ultimate decision. Especially in the case of security devices, where the customer is presumably purchasing the device FOR enhanced security, its not the manufacturers duty to inflict their opinions on the installation of the product. How far should we take this argument? Should they also enforce strong passwords? Should they enforce regular password changes?

In my experience, this can backfire on the pro side vs. the consumer side. When a consumer installs a camera, they are probably very likely to use a semi-strong password that is unique to them. It might be the name of their dog or child, or a word+number combo they use elsewhere, or something else that is at least mildly unique. Most corporations on the other hand when forced to choose corporate default passwords use fairly weak and guessable passwords, and use them across multiple things. In this case, if you're forcing a tech to change the password, the chance is very high (IMO) that their choice becomes something like Password or Passw0rd, they are going to be inclined to make it a very simple and memorable string because there is a good chance multiple techs are going to be involved with the system, and they'd generally all want to agree on an easy to remember string.

Also, there is much less reason to worry about unique password security during the install/setup of the system. It's when it is turned over to the customer that it makes the most sense to lock things down, but this forced password change at init causes you to make the password decision at the wrong time.