5 ms·

I hope lans are exluded? I'm scared that I will get security warnings everywhere in my lan. - when I log in to my webcams it says the connection is not secure

I hope lans are exluded? I'm scared that I will get security warnings everywhere in my lan. - when I log in to my webcams it says the connection is not secure - when I log in on my nas it says the connection is not secure - when I log in on my router it says the connection is not secure - when I log in on the web interface of mythtv it says the connection is not secure - when I log in on my self hosted gitea instance it says the connection is not secure - when I log in to my self hosted nextcloud it says the connection is not secure - when I log in to the configuration page of my toaster it says the connection is not secure All these things are on my lan, and on most things there is no way to install a tls cert on them, nor would I want to do that. Firefox already nags me that the connection is not secure when i enter a username and a password in any of those sites.

dx034 9y ago
I'd hope LAN is included because while you use some services at home, most people will primarily use LAN services in public Wifis. It would be sensible to have HTTPS used there. They'd have to come up with a new idea of login pages (currently most systems MITM http requests) but otherwise it would make sense if you get a warning when you access pages on your hotel/in-flight Wifi without encryption.
- y0ghur7_xxx 9y ago
  > most people will primarily use LAN services in public Wifis [citation needed] - I would say most people will primarily use LAN services in private home/corporate networks. But I don't have a citation either. It's different use cases. Maybe one needs the warning, the other one not. But putting the warning on everything and overload the user with them is not the right solution. Using a self signed CA is a pity, because installing it on every phone, tablet, laptop, tv, pc, ... is cumbersome in a home network, and making all hosts public and depending on an external CA for local resources to not get scary warnings can not be the right solution either.
  - dx034 9y ago
    > [citation needed] - I would say most people will primarily use LAN services in private home/corporate networks. But I don't have a citation either. Sorry I don't have a citation here. But looking at my coworkers and family, none of them uses services in their home LAN. Most won't even know how to access the router. On the other hand it's very common to use Wifi in public transport (at least here in London for the tube), airports, trains and hotels. Few people consider security when using these hotspots, making sure that SSL is enabled for all pages would be an improvement.
    - y0ghur7_xxx 9y ago
      > On the other hand it's very common to use Wifi in public transport (at least here in London for the tube), airports, trains and hotels. Few people consider security when using these hotspots, making sure that SSL is enabled for all pages would be an improvement. But do you use LAN services on that network? I think you will use that public hotspot to check facebook, hn, search something on google and stuff like that, not connect to some service in the local network of the hotspot.
      - nandhp 9y ago
        Many captive portals operate as a LAN service, where you may be expected to type a password. If the public Wifi has a roaming agreement, that password may even be for your ISP or mobile phone provider.
        y0ghur7_xxx 9y ago
        Yes I agree. But I see that as an exception. The Captive Portal is ONE thing that needs to be secured and be accessible inside the LAN of a public wifi hotspot. I see that as a special case, and public HS providers can work around that (using a domain for the CP they own and got a cert for). But imho that does not mean that browsers should throw security warnings at users for everything else inside their home lan. At least until we have a solution that works for everyone. And - depending on an external service for your internal home stuff, or - installing a self signed CA on every device you own is not a solution. Until we have something we can replace the status quo with, we should not deprecate it.
- hartator 9y ago
  Can we do SSL locally though?
tajen 9y ago
...but those services, served over HTTP, are not secured and can be spied upon by your insecure Chinese webcam or by the 3% of routers that have a malware, isn't that correct? So the browser should display so, it's up to you to ignore the warning.
- y0ghur7_xxx 9y ago
  Well it's my lan, and I can decide what I trust and what not. For example in my home network I have different vlans: one for things i reasonably trust, and one for the chinese webcams and iot lightbulbs. If my router has malware, even if i talk to it over https I'm screwed anyway, I don't think that is something I can fix with https.
  - lmm 9y ago
    > Well it's my lan, and I can decide what I trust and what not. The browser will still let you choose. It's just changing the default. > For example in my home network I have different vlans: one for things i reasonably trust, and one for the chinese webcams and iot lightbulbs. Congratulations, you are the 0.0001%. > If my router has malware, even if i talk to it over https I'm screwed anyway, I don't think that is something I can fix with https. Right, but if your lightbulb has malware and your router doesn't yet, then using HTTPS while talking to the router is pretty important.
    - y0ghur7_xxx 9y ago
      > if your lightbulb has malware and your router doesn't yet, then using HTTPS while talking to the router is pretty important. I agree. So what's the solution you propose? - Using a self signed CA that you have to install on all your devices? - Using a trusted by default CA, that makes your internal-only devices depend on an external service (the CA)? Or something else? I'm not saying that encrypting the traffic in a LAN is useless. I'm saying that https and the current CA system is not the solution.
      - lmm 9y ago
bjpbakker 9y ago
LANs should be included. It's just as bad as using most websites without TLS. Maybe this helps forcing companies of IOT-like devices finally take security a bit more serious.
- AlexandrB 9y ago
  > LANs should be included. It's just as bad as using most websites without TLS. Why? What's the threat model, that your employer/colleagues can see your traffic?
  - daxorid 9y ago
    That any jerkoff with the right work shirt and demeanor can convince your coworkers that they need to service equipment at your demarc - and a lan turtle ends up connected to a trunk-enabled port on your switch that nobody notices for a year. We are rapidly moving away from perimeter solutions and toward zero trust networking models. Yes, you should encrypt and authenticate inside your LAN.
- tonyarkles 9y ago
  I would really love to see some kind of LAN TLS solution that doesn't rely on requiring you to have your own CA. I've thought a fair bit about the problem, but haven't come up with any solutions that I like. Browsers, rightfully so, don't accept self-signed certificates. Active Directory and Group Policies can push out a trusted self-signed root CA certificate and generate certs that endpoints can use, but that's a pain in the ass and usually requires central IT to manage. Please someone come up with something I haven't thought of yet that doesn't break the internet but gets useful certs onto my LAN!
  - y0ghur7_xxx 9y ago
    ssh is something that most users see as a secure protocol, and that uses tofu. maybe we could use the same auth mechanism inside a lan for http?
StavrosK 9y ago
Why not just give them a domain name? I gave them a subdomain of my personal domain and Caddy handles TLS for all of them automatically.
frik 9y ago
Some browser vendors have an agenda. But why now? Amazon.com worked fine with HTTPS from 1995 to 2006 - only the login page used HTTPS. Now a small group tries to break the web and enforce HTTPS, but why? Is it to de-anonymize the web users?

dx034 9y ago

I'd hope LAN is included because while you use some services at home, most people will primarily use LAN services in public Wifis. It would be sensible to have HTTPS used there. They'd have to come up with a new idea of login pages (currently most systems MITM http requests) but otherwise it would make sense if you get a warning when you access pages on your hotel/in-flight Wifi without encryption.

y0ghur7_xxx 9y ago
> most people will primarily use LAN services in public Wifis [citation needed] - I would say most people will primarily use LAN services in private home/corporate networks. But I don't have a citation either. It's different use cases. Maybe one needs the warning, the other one not. But putting the warning on everything and overload the user with them is not the right solution. Using a self signed CA is a pity, because installing it on every phone, tablet, laptop, tv, pc, ... is cumbersome in a home network, and making all hosts public and depending on an external CA for local resources to not get scary warnings can not be the right solution either.
- dx034 9y ago
  > [citation needed] - I would say most people will primarily use LAN services in private home/corporate networks. But I don't have a citation either. Sorry I don't have a citation here. But looking at my coworkers and family, none of them uses services in their home LAN. Most won't even know how to access the router. On the other hand it's very common to use Wifi in public transport (at least here in London for the tube), airports, trains and hotels. Few people consider security when using these hotspots, making sure that SSL is enabled for all pages would be an improvement.
  - y0ghur7_xxx 9y ago
    > On the other hand it's very common to use Wifi in public transport (at least here in London for the tube), airports, trains and hotels. Few people consider security when using these hotspots, making sure that SSL is enabled for all pages would be an improvement. But do you use LAN services on that network? I think you will use that public hotspot to check facebook, hn, search something on google and stuff like that, not connect to some service in the local network of the hotspot.
    - nandhp 9y ago
      Many captive portals operate as a LAN service, where you may be expected to type a password. If the public Wifi has a roaming agreement, that password may even be for your ISP or mobile phone provider.
      - y0ghur7_xxx 9y ago
        Yes I agree. But I see that as an exception. The Captive Portal is ONE thing that needs to be secured and be accessible inside the LAN of a public wifi hotspot. I see that as a special case, and public HS providers can work around that (using a domain for the CP they own and got a cert for). But imho that does not mean that browsers should throw security warnings at users for everything else inside their home lan. At least until we have a solution that works for everyone. And - depending on an external service for your internal home stuff, or - installing a self signed CA on every device you own is not a solution. Until we have something we can replace the status quo with, we should not deprecate it.
hartator 9y ago
Can we do SSL locally though?

tajen 9y ago

...but those services, served over HTTP, are not secured and can be spied upon by your insecure Chinese webcam or by the 3% of routers that have a malware, isn't that correct? So the browser should display so, it's up to you to ignore the warning.

y0ghur7_xxx 9y ago
Well it's my lan, and I can decide what I trust and what not. For example in my home network I have different vlans: one for things i reasonably trust, and one for the chinese webcams and iot lightbulbs. If my router has malware, even if i talk to it over https I'm screwed anyway, I don't think that is something I can fix with https.
- lmm 9y ago
  > Well it's my lan, and I can decide what I trust and what not. The browser will still let you choose. It's just changing the default. > For example in my home network I have different vlans: one for things i reasonably trust, and one for the chinese webcams and iot lightbulbs. Congratulations, you are the 0.0001%. > If my router has malware, even if i talk to it over https I'm screwed anyway, I don't think that is something I can fix with https. Right, but if your lightbulb has malware and your router doesn't yet, then using HTTPS while talking to the router is pretty important.
  - y0ghur7_xxx 9y ago
    > if your lightbulb has malware and your router doesn't yet, then using HTTPS while talking to the router is pretty important. I agree. So what's the solution you propose? - Using a self signed CA that you have to install on all your devices? - Using a trusted by default CA, that makes your internal-only devices depend on an external service (the CA)? Or something else? I'm not saying that encrypting the traffic in a LAN is useless. I'm saying that https and the current CA system is not the solution.
    - lmm 9y ago

bjpbakker 9y ago

LANs should be included. It's just as bad as using most websites without TLS. Maybe this helps forcing companies of IOT-like devices finally take security a bit more serious.

AlexandrB 9y ago
> LANs should be included. It's just as bad as using most websites without TLS. Why? What's the threat model, that your employer/colleagues can see your traffic?
- daxorid 9y ago
  That any jerkoff with the right work shirt and demeanor can convince your coworkers that they need to service equipment at your demarc - and a lan turtle ends up connected to a trunk-enabled port on your switch that nobody notices for a year. We are rapidly moving away from perimeter solutions and toward zero trust networking models. Yes, you should encrypt and authenticate inside your LAN.
tonyarkles 9y ago
I would really love to see some kind of LAN TLS solution that doesn't rely on requiring you to have your own CA. I've thought a fair bit about the problem, but haven't come up with any solutions that I like. Browsers, rightfully so, don't accept self-signed certificates. Active Directory and Group Policies can push out a trusted self-signed root CA certificate and generate certs that endpoints can use, but that's a pain in the ass and usually requires central IT to manage. Please someone come up with something I haven't thought of yet that doesn't break the internet but gets useful certs onto my LAN!
- y0ghur7_xxx 9y ago
  ssh is something that most users see as a secure protocol, and that uses tofu. maybe we could use the same auth mechanism inside a lan for http?

StavrosK 9y ago

Why not just give them a domain name? I gave them a subdomain of my personal domain and Caddy handles TLS for all of them automatically.

frik 9y ago

Some browser vendors have an agenda. But why now? Amazon.com worked fine with HTTPS from 1995 to 2006 - only the login page used HTTPS. Now a small group tries to break the web and enforce HTTPS, but why? Is it to de-anonymize the web users?