411–420 of 463 posts
Earlier quoted context omitted.
Make your own CA, install on each computer, install certificates, voila.
Telling your clients to install your certificate in their computer/browser store is not very practical. And they will need to do that regularly.
Earlier quoted context omitted.
I have tried to do just that but ran into all kinds of difficulties: 1. Overhead: I have 5 devices that I own 3 of my wife and a smart TV. Setting all this us takes a lot of time, even if it worked fine. 2. What about visitors to my home, that I want to give access? They need the cert as well together with lengthy instructions on how to install it. 3. How do I even install certs on an iPhone? 4. Firefox uses it's own…
15$ a year for a domain, throw traffic through local [split?] dns and traefik with the lets encrypt dns challenge and call it a day? i have over 25 internal domains & services with 25 certs auto renewing and no one can tell - it just works and is easier the self signing certs and loading them into whatever rando service or device your trying to secure
Earlier quoted context omitted.
I wonder if a scheme could be invented where your router could be responsible for issuing certs to local devices. Forgetting about the impossibilities of industry adoption, would such a scheme be possible? E.g. your router/DHCP controller/AD box gives an IoT device a DHCP ip and maybe a DNS address, and additionally it will provision a cert+key to that device by some standard protocol (keeping this secure might be im…
One problem is that it's easy to inject malicious DHCP on to any network you have access to, and you can then route all traffic to yourself (by telling clients that you are the gateway.) This kind of attack is partially mitigated because of TLS - redirecting all traffic to yourself isn't particularly useful if it's all encrypted. But if you could issue a cert along with the DHCP it'd be game over for everyone on the…
Earlier quoted context omitted.
3. use cross signing with name constraints to not have this problem https://tools.ietf.org/html/rfc5280#section-4.2.1.10
Issuing CA cert with Name Constraints is good, but end user should recognize the certificate is constrained to their domains or not.
Earlier quoted context omitted.
Firefox has its own store, and you can add certs: https://support.mozilla.org/en-US/kb/setting-certificate-aut... Chrome uses the OS store (for now: https://www.chromium.org/Home/chromium-security/root-ca-poli... ) which you can also add certs to.
I can't do that with my Chromecast, though, which my point. There are devices that depend on HTTPS to function, but are designed such that the user who owns the device cannot add their own certificates to their trust store.
Earlier quoted context omitted.
> All the end user device needs is a connection to the internet once per 90 days. The vast majority of networks have sufficient network connectivity for this. I'm no expert on long-tail use cases, but I'd imagine that most networks either have internet connectivity or they don't. I can't think of many situations where you'd only have internet once every 90 days. Of course one could argue that 90 days long is enough s…
I can't think of many situations where you'd only have internet once every 90 days. Having worked in broadcast news, I can think of hundreds. News doesn't happen in the newsroom. It happens in the field. And very often in places without internet access. Sometimes for weeks or months at a time. (Think siege at Waco, plane crashes, hurricanes, etc.)
There’s not much point in doing broadcast news of you can’t file, and you can only file if you have an IP connection (we do have some non ip satelite but without IP you wouldn’t be able to do much in the way of production - no production system, no email, no phone)
Covering natural diaaaters is why we have bgans and generators and MREs and water cleaning kits. Internet access is as essential as any other high risk safety equipment, and there’s no point deploying if you can’t file back.
Earlier quoted context omitted.
One problem is that it's easy to inject malicious DHCP on to any network you have access to, and you can then route all traffic to yourself (by telling clients that you are the gateway.) This kind of attack is partially mitigated because of TLS - redirecting all traffic to yourself isn't particularly useful if it's all encrypted. But if you could issue a cert along with the DHCP it'd be game over for everyone on the…
If you’re the network operator you can mitm network traffic if curse. If you aren’t how are you running a dhcp server when the switch will block the packets?
Earlier quoted context omitted.
I considered that, but I think at the moment there's no concept of IP address for web certificates, it's all based on domain names as far as I know. It doesn't mean it's not doable of course, but I could understand if it make people uneasy since it means that the same domain and the same certificate would behave differently depending on what it resolves to. It may be an interesting solution to consider though. That w…
You absolutely can get a certificate for an IP address. Clients should verify them based on the common name, and a subject alternative name has various field types including IP address. A quick Google search shows various certificate authorities who will issue certificates for IP addresses.
https://stackoverflow.com/questions/2043617/is-it-possible-t...
Earlier quoted context omitted.
It's funny how pushing stringent privacy and security defaults in one domain degrades the privacy and security experience in another domain. My jaded takeaway from the last 5 or so years is that the internet companies (understandably) don't care about non-internet experiences. I empathize with how annoying that reality is because internet technology certainly works locally if you configure everything correctly.. just…
Picking specifically on the claim that IPv6 doesn't degrade user privacy. In an IPv4 + NAT overload residential network, google can see 10 different accounts logging in from a single IP address. In an IPv6 + privacy-extention-addressing residential network, google can see the unique IPv6 used for each address, and concludes that since five of these 10 accounts are coming from the same IPv6 address, and the other five…