6 ms·

The best solution is for them to be accessed through a publicly registered hostname e.g. https://router0123.netgear.com https://router0123.netgear.com (that wou

by nsgi 10y ago

The best solution is for them to be accessed through a publicly registered hostname e.g. https://router0123.netgear.com https://router0123.netgear.com (that would only resolve locally). They could provision certificates for themselves using the Let's Encrypt DNS challenge.

Piskvorrr 10y ago
Now you're vulnerable to DNS hijacking.
- nsgi 10y ago
  HTTPS prevents that.
  - caf 10y ago
    No, because the implication here is that the private key for these router0123.netgear.com type hostnames will be known to the consumer devices that are serving the pages, so they will be essentially public.
    - tialaramex 10y ago
      I think the idea is each device has its own FQDN, and gets its own certificates. Thus, breaking open your router only gets you "your" private key, they'd all be different. Buying one on eBay might be risky, but if you buy sketchy network hardware on eBay you're at risk in so many ways already... You can't do this with Let's Encrypt out of the box (unless you make small numbers bespoke devices) because of their Rate Limits. But several commercial public CAs like Comodo would probably be interested in cutting a deal with a big electronics manufacturer or a trade group.
      - nsgi 10y ago
        Correct. The rate limits for the parent domain wouldn't apply if it was added to the public suffix list. The IP restriction wouldn't apply because every router would be requesting from a different IP.
        caf 10y ago
        This doesn't make a whole lot of sense as a viable deployment strategy. The routers would necessarily need to ask for the domain name in question to be pointed at their internet-facing, public IP (if indeed they even have one!), because that's all that Lets Encrypt could possibly verify, but the administration interface is usually on a private RFC1918 address. And what secure protocol are you going to use for the router to request that domain name update? And how is first time setup supposed to work anyway? You need to connect to the administration interface to give it your ISP credentials before it can connect to the internet and obtain its Lets Encrypt certificate. If you forget about Lets Encrypt and instead point hundreds of thousands of router-<serial>.vendor.com addresses at 192.168.0.1, with a pre-made certificate, you then only have the problems of baking an individual private key into each router at the factory and boxing customised documentation (like maybe a sticker on the router itself) telling the user what the unique domain name is they need to setup their device. Oh, and the problem of what to do when the user wants to change the local address used by their router.
  - Piskvorrr 10y ago
    Nope. HTTPS only prevents you from falling for it - but you still can't get there.
kuschku 10y ago
So, now we have a single certificate on all routers? What happens if I take apart a router? Or would every router get its own certificate? But then netgear would have to become its own CA. And in either case DNS hijacking is a massive issue.
- icebraining 10y ago
  Or would every router get its own certificate? But then netgear would have to become its own CA. Why? They could just partner with an existing CA, like Cloudflare does with Comodo. And how would DNS hijacking be an issue? The attacker wouldn't be able to produce a valid cert anyway (the router would come with a custom burned-in key that it would use to authenticate itself to the CA and get the cert).
  - kuschku 10y ago
    > the router would come with a custom burned-in key that it would use to authenticate itself to the CA and get the cert I take apart the router, and get a valid certificate. Now I hijack DNS, and get you to connect to me. HTTPS within LAN for this purpose is useless.
    - icebraining 10y ago
      I take apart the router, and get a valid certificate You only get a valid certificate for your router's address. But if you can take apart the router, you don't need to hijack the DNS, you can simply control its traffic. But if you're a guest in my home and I see you take apart my router, you'll have to answer a few questions. Same in an office or coffeshop. Having LAN access doesn't mean you have complete physical control of the router. So the HTTPS is not useless.
      - kuschku 10y ago
        You only get a valid certificate for your router's address. Considering basically every router has the same address, I now have a valid certificate for basically every router.

by nsgi 10y ago

Piskvorrr 10y ago

Now you're vulnerable to DNS hijacking.

nsgi 10y ago
HTTPS prevents that.
- caf 10y ago
  No, because the implication here is that the private key for these router0123.netgear.com type hostnames will be known to the consumer devices that are serving the pages, so they will be essentially public.
  - tialaramex 10y ago
    I think the idea is each device has its own FQDN, and gets its own certificates. Thus, breaking open your router only gets you "your" private key, they'd all be different. Buying one on eBay might be risky, but if you buy sketchy network hardware on eBay you're at risk in so many ways already... You can't do this with Let's Encrypt out of the box (unless you make small numbers bespoke devices) because of their Rate Limits. But several commercial public CAs like Comodo would probably be interested in cutting a deal with a big electronics manufacturer or a trade group.
    - nsgi 10y ago
      Correct. The rate limits for the parent domain wouldn't apply if it was added to the public suffix list. The IP restriction wouldn't apply because every router would be requesting from a different IP.
      - caf 10y ago
        This doesn't make a whole lot of sense as a viable deployment strategy. The routers would necessarily need to ask for the domain name in question to be pointed at their internet-facing, public IP (if indeed they even have one!), because that's all that Lets Encrypt could possibly verify, but the administration interface is usually on a private RFC1918 address. And what secure protocol are you going to use for the router to request that domain name update? And how is first time setup supposed to work anyway? You need to connect to the administration interface to give it your ISP credentials before it can connect to the internet and obtain its Lets Encrypt certificate. If you forget about Lets Encrypt and instead point hundreds of thousands of router-<serial>.vendor.com addresses at 192.168.0.1, with a pre-made certificate, you then only have the problems of baking an individual private key into each router at the factory and boxing customised documentation (like maybe a sticker on the router itself) telling the user what the unique domain name is they need to setup their device. Oh, and the problem of what to do when the user wants to change the local address used by their router.
- Piskvorrr 10y ago
  Nope. HTTPS only prevents you from falling for it - but you still can't get there.

kuschku 10y ago

So, now we have a single certificate on all routers? What happens if I take apart a router? Or would every router get its own certificate? But then netgear would have to become its own CA. And in either case DNS hijacking is a massive issue.

icebraining 10y ago
Or would every router get its own certificate? But then netgear would have to become its own CA. Why? They could just partner with an existing CA, like Cloudflare does with Comodo. And how would DNS hijacking be an issue? The attacker wouldn't be able to produce a valid cert anyway (the router would come with a custom burned-in key that it would use to authenticate itself to the CA and get the cert).
- kuschku 10y ago
  > the router would come with a custom burned-in key that it would use to authenticate itself to the CA and get the cert I take apart the router, and get a valid certificate. Now I hijack DNS, and get you to connect to me. HTTPS within LAN for this purpose is useless.
  - icebraining 10y ago
    I take apart the router, and get a valid certificate You only get a valid certificate for your router's address. But if you can take apart the router, you don't need to hijack the DNS, you can simply control its traffic. But if you're a guest in my home and I see you take apart my router, you'll have to answer a few questions. Same in an office or coffeshop. Having LAN access doesn't mean you have complete physical control of the router. So the HTTPS is not useless.
    - kuschku 10y ago
      You only get a valid certificate for your router's address. Considering basically every router has the same address, I now have a valid certificate for basically every router.