California Governor Jerry Brown has signed an Internet of Things law covering cybersecurity. California is the first state with a law like this.

Starting on January 1st, 2020, any manufacturer of a device that connects “directly or indirectly” to the internet must equip it with “reasonable” security features, designed to prevent unauthorized access, modification, or information disclosure. If it can be accessed outside a local area network with a password, it needs to either come with a unique password for each device, or force users to set their own password the first time they connect. That means no more generic default credentials for a hacker to guess.

If only it affected all IoT devices, instead of ones created two years into the future.

Shiru Cafe’s customers are all college students (as a requirement) and instead of cash students pay with personal data.

To get the free coffee, university students must give away their names, phone numbers, email addresses and majors, or in Brown’s lingo, concentrations. Students also provide dates of birth and professional interests, entering all of the information in an online form. By doing so, the students also open themselves up to receiving information from corporate sponsors…

I know it sounds horrifying, but think of it this way. First, it’s voluntary. If you don’t want to give them your information, you can go to another shop and pay with cash (free market capitalism right there). Second, students will realize how valuable their data is, and maybe rethink giving it away for free in the future to the likes of Google and Facebook. It’s fine if you do, but understanding the tradeoff is important.