5 ms·
LANs should be included. It's just as bad as using most websites without TLS. Maybe this helps forcing companies of IOT-like devices finally take security a bi
by bjpbakker 9y ago
LANs should be included. It's just as bad as using most websites without TLS.
Maybe this helps forcing companies of IOT-like devices finally take security a bit more serious.
- AlexandrB 9y ago> LANs should be included. It's just as bad as using most websites without TLS. Why? What's the threat model, that your employer/colleagues can see your traffic?
- daxorid 9y agoThat any jerkoff with the right work shirt and demeanor can convince your coworkers that they need to service equipment at your demarc - and a lan turtle ends up connected to a trunk-enabled port on your switch that nobody notices for a year. We are rapidly moving away from perimeter solutions and toward zero trust networking models. Yes, you should encrypt and authenticate inside your LAN.
- tonyarkles 9y agoI would really love to see some kind of LAN TLS solution that doesn't rely on requiring you to have your own CA. I've thought a fair bit about the problem, but haven't come up with any solutions that I like. Browsers, rightfully so, don't accept self-signed certificates. Active Directory and Group Policies can push out a trusted self-signed root CA certificate and generate certs that endpoints can use, but that's a pain in the ass and usually requires central IT to manage. Please someone come up with something I haven't thought of yet that doesn't break the internet but gets useful certs onto my LAN!
- y0ghur7_xxx 9y agossh is something that most users see as a secure protocol, and that uses tofu. maybe we could use the same auth mechanism inside a lan for http?