3 ms·
Closing an easy attack vector by using HTTPS seems a safe bet here, with no particular drawbacks. Are there chip-level power concerns that could make their IoT
by floatingatoll 10y ago
Closing an easy attack vector by using HTTPS seems a safe bet here, with no particular drawbacks. Are there chip-level power concerns that could make their IoT thing unable to do SSL, but able to validate firmware signatures?
- toast0 10y agoHTTPS for firmware download is a maintenance nightmare. In a couple of months, TLS 1.3 is going to be finalized, and then calls for everyone to drop support for TLS 1.2 will begin. But they can't drop TLS 1.2 support, without breaking firmware updates for all the unopened boxes out there. They probably should have signed the json listing of firmware images though, in addition to just the firmware images.
- yxhuvud 10y agoI guess what they could do to avert that is to have versioned (by subdomain) upgrade sites where each version is as secure as the associated device.
- true_religion 10y agoPeople even support TLS 1.0 for Enterprise clients. I feel like you'll support your legacy protocols for at least 20 years.
- deleted 10y ago[deleted]