3 ms·

Well it's my lan, and I can decide what I trust and what not. For example in my home network I have different vlans: one for things i reasonably trust, and one

Well it's my lan, and I can decide what I trust and what not. For example in my home network I have different vlans: one for things i reasonably trust, and one for the chinese webcams and iot lightbulbs. If my router has malware, even if i talk to it over https I'm screwed anyway, I don't think that is something I can fix with https.

lmm 9y ago
> Well it's my lan, and I can decide what I trust and what not. The browser will still let you choose. It's just changing the default. > For example in my home network I have different vlans: one for things i reasonably trust, and one for the chinese webcams and iot lightbulbs. Congratulations, you are the 0.0001%. > If my router has malware, even if i talk to it over https I'm screwed anyway, I don't think that is something I can fix with https. Right, but if your lightbulb has malware and your router doesn't yet, then using HTTPS while talking to the router is pretty important.
- y0ghur7_xxx 9y ago
  > if your lightbulb has malware and your router doesn't yet, then using HTTPS while talking to the router is pretty important. I agree. So what's the solution you propose? - Using a self signed CA that you have to install on all your devices? - Using a trusted by default CA, that makes your internal-only devices depend on an external service (the CA)? Or something else? I'm not saying that encrypting the traffic in a LAN is useless. I'm saying that https and the current CA system is not the solution.
  - lmm 9y ago
    > - Using a trusted by default CA, that makes your internal-only devices depend on an external service (the CA)? This one. Realistically all those devices are depending on external services already.
    - AlexandrB 9y ago
      > This one. Realistically all those devices are depending on external services already. This is codifying (IMHO) bad practices and a really brittle architecture. Why would you want this? One of the reasons IoT security is a mess is that devices need to talk to internet endpoints instead of staying inside the NATted, firewalled LAN.
      - lmm 9y ago
        I think the NATed, firewalled LAN is an untenable concept: it blurs the line between private and public, a line that security requires making make clear and sharp. If it's connected to a network, it's exposed enough that we should treat it as connected to a public network (which greatly simplifies our threat model); if it's not secure enough for that, it needs to be built as local-only hardware.
jon-wood 9y ago
Way off on a tangent here, but can you point me in the direction of some documentation for VLANing specific devices, giving them access to the internet for whatever they need to do, the ability to access them over the LAN by trusted devices, but not giving them the ability to call into the secure LAN?
- y0ghur7_xxx 9y ago
  That's exactly what I did, but I can't point you to a howto or something like that. I just bought a vlan capable switch and a pfsense router and set everything up.
- mysterydip 9y ago
  Say you have a VLAN-capable switch and a spare PC with a couple NICs to use as a router. I use the Sophos XG Home Edition for example but other router setups (like the mentioned pfsense) should be similar. Say ports 1-4 on the switch are your trusted devices, 5-8 are your untrusted, and 9-10 are the LAN side of the router. There are other ways to do it but this is probably simplest and easiest to mentally map. Set ports 1-4 and 9 as access ports for VLAN 100. Set ports 5-8 and 10 as access ports for VLAN 200. Now you have two virtual networks hooked into one physical, partitioned by the router. You then set up eth0 (port 9) as trusted LAN and eth1 (port 10) as untrusted LAN in the router, and give each an IP range (Separate subnets at a minimum). Now all trusted can talk to each other and all untrusted can talk to each other, but nothing together yet. You then set routes and rules (port filtering, SNAT, DNAT, etc) for port access from either network to the other to finely control what ports are available to what. You do the same thing with eth2 which would be the connection from the router to the modem for internet access. Not a full tutorial but hopefully that points you in the right direction.

lmm 9y ago

> Well it's my lan, and I can decide what I trust and what not. The browser will still let you choose. It's just changing the default. > For example in my home network I have different vlans: one for things i reasonably trust, and one for the chinese webcams and iot lightbulbs. Congratulations, you are the 0.0001%. > If my router has malware, even if i talk to it over https I'm screwed anyway, I don't think that is something I can fix with https. Right, but if your lightbulb has malware and your router doesn't yet, then using HTTPS while talking to the router is pretty important.

y0ghur7_xxx 9y ago
> if your lightbulb has malware and your router doesn't yet, then using HTTPS while talking to the router is pretty important. I agree. So what's the solution you propose? - Using a self signed CA that you have to install on all your devices? - Using a trusted by default CA, that makes your internal-only devices depend on an external service (the CA)? Or something else? I'm not saying that encrypting the traffic in a LAN is useless. I'm saying that https and the current CA system is not the solution.
- lmm 9y ago
  > - Using a trusted by default CA, that makes your internal-only devices depend on an external service (the CA)? This one. Realistically all those devices are depending on external services already.
  - AlexandrB 9y ago
    > This one. Realistically all those devices are depending on external services already. This is codifying (IMHO) bad practices and a really brittle architecture. Why would you want this? One of the reasons IoT security is a mess is that devices need to talk to internet endpoints instead of staying inside the NATted, firewalled LAN.
    - lmm 9y ago
      I think the NATed, firewalled LAN is an untenable concept: it blurs the line between private and public, a line that security requires making make clear and sharp. If it's connected to a network, it's exposed enough that we should treat it as connected to a public network (which greatly simplifies our threat model); if it's not secure enough for that, it needs to be built as local-only hardware.

jon-wood 9y ago

Way off on a tangent here, but can you point me in the direction of some documentation for VLANing specific devices, giving them access to the internet for whatever they need to do, the ability to access them over the LAN by trusted devices, but not giving them the ability to call into the secure LAN?

y0ghur7_xxx 9y ago
That's exactly what I did, but I can't point you to a howto or something like that. I just bought a vlan capable switch and a pfsense router and set everything up.
mysterydip 9y ago
Say you have a VLAN-capable switch and a spare PC with a couple NICs to use as a router. I use the Sophos XG Home Edition for example but other router setups (like the mentioned pfsense) should be similar. Say ports 1-4 on the switch are your trusted devices, 5-8 are your untrusted, and 9-10 are the LAN side of the router. There are other ways to do it but this is probably simplest and easiest to mentally map. Set ports 1-4 and 9 as access ports for VLAN 100. Set ports 5-8 and 10 as access ports for VLAN 200. Now you have two virtual networks hooked into one physical, partitioned by the router. You then set up eth0 (port 9) as trusted LAN and eth1 (port 10) as untrusted LAN in the router, and give each an IP range (Separate subnets at a minimum). Now all trusted can talk to each other and all untrusted can talk to each other, but nothing together yet. You then set routes and rules (port filtering, SNAT, DNAT, etc) for port access from either network to the other to finely control what ports are available to what. You do the same thing with eth2 which would be the connection from the router to the modem for internet access. Not a full tutorial but hopefully that points you in the right direction.