Document ID: chunk:federal_register_of_legislation:F2025L00276:clause:1_2
Version: federal_register_of_legislation:F2025L00276
Segment Type: clause
Provision Reference: sch 1 cl 2
Character Range: 10302–11713

2  Requirements in relation to passwords
 (1) Passwords for use with a relevant connectable product in relation to any of the following must comply with the requirements in subclauses (2) and (3):
 (a) hardware of the product when the product is not in the factory default state;
 (b) software which is pre‑installed on the product at the point at which the product is supplied to a consumer when the product is not in the factory default state;
 (c) software which is not pre‑installed on the product at the point at which the product is supplied to a consumer and which must be installed on the product for all the manufacturer's intended purposes of the product that use:
 (i) hardware; or
 (ii) software that is pre‑installed at the point at which the product is supplied to a consumer; or
 (iii) software that is installable.
 (2) Passwords must be:
 (a) unique per product (subject to subclause (3)); or
 (b) defined by the user of the product.
 (3) Passwords which are unique per product must not be:
 (a) based on incremental counters; or
 (b) based on or derived from publicly available information; or
 (c) based on or derived from unique product identifiers, such as serial numbers, unless this is done using an encryption method, or keyed hashing algorithm, that is accepted as part of good industry practice; or
 (d) otherwise guessable in a manner unacceptable as part of good industry practice.