4 ms·

Unfortunately, it doesn't say how it'll be secured. With everything in your house, using normal https is still a problem.

ohazi 9y ago
> using normal https is still a problem Care to elaborate?
- fmntf 9y ago
  I'm not sure what the original commenter meant; however TLS is useful only when talking with your own server. What about other connections? NTP, DNS etc are all unencrypted (read: unsigned). Google "DNS client CVE" for instance. Or what about SSH? It may not be accessible from the Internet, but still exploitable from an infected host in the LAN. Someone has to keep all that software updated. In those conditions, I would never connect a RaspberryPI or similar to my door / gate / car / ...
  - komali2 9y ago
    How is SSH exploited from an infected host within the LAN?
    - fmntf 9y ago
      If you connected an IoT device in the same network of an infected PC, the infected PC can talk to the IoT device directly if you do not block traffic somehow (eg. a firewall). Are there open ports with buggy services? Probably not today, what about in ten years?
    - deadbunny 9y ago
      I assume they mean you can only ssh from your local network, the IoT device gets pwnd, it's on the same network as the rest of your computers, someone can use the IoT device as an entry point into your network. Easily solved with separate networks or vlans etc...
  - IncRnd 9y ago
    > however TLS is useful only when talking with your own server. Are you saying that for the most trusted servers TLS is needed, but less trusted servers can be spoken to with less security?
    - fmntf 9y ago
      No no no. I am stating that, while TLS is good, your device will use other unprotected connections too (both on LAN and WAN) unless something else is done. until bugs or weaknesses are found, see SSL v1/2/3 deprecation, heartbleed, etc
- tonyarkles 9y ago
  I have no idea if this is what the OP is referring to, but it's pretty much impossible to use HTTPS on your home network without managing your own Root CA and somehow managing to get certificates signed by that Root CA into your devices. You've got a fighting chance in a corporate network where you can deploy and manage the Root CA via Active Directory/Group Policy, but managing it at home with consumer-grade devices... not gonna be a good day.
  - deadbunny 9y ago
    Domains are cheap and Lets Encrypt should be dishing out wildcards by the end of the month[1]. Maybe not the perfect solution for most users though. Personally I've been running my own domain + wildcard for a few years, it'll be nice to remove the cost of the wildcard from the setup. 1. https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html https://letsencrypt.org/2017/07/06/wildcard-certificates-com...
    - tonyarkles 9y ago
      That will be awesome! I'm assuming they're still going to need to get refreshed on a regular basis, but this is a great step in the right direction!
deadbunny 9y ago
https://www.w3.org/TR/wot-security/ https://www.w3.org/TR/wot-security/

ohazi 9y ago

> using normal https is still a problem Care to elaborate?

fmntf 9y ago
I'm not sure what the original commenter meant; however TLS is useful only when talking with your own server. What about other connections? NTP, DNS etc are all unencrypted (read: unsigned). Google "DNS client CVE" for instance. Or what about SSH? It may not be accessible from the Internet, but still exploitable from an infected host in the LAN. Someone has to keep all that software updated. In those conditions, I would never connect a RaspberryPI or similar to my door / gate / car / ...
- komali2 9y ago
  How is SSH exploited from an infected host within the LAN?
  - fmntf 9y ago
    If you connected an IoT device in the same network of an infected PC, the infected PC can talk to the IoT device directly if you do not block traffic somehow (eg. a firewall). Are there open ports with buggy services? Probably not today, what about in ten years?
  - deadbunny 9y ago
    I assume they mean you can only ssh from your local network, the IoT device gets pwnd, it's on the same network as the rest of your computers, someone can use the IoT device as an entry point into your network. Easily solved with separate networks or vlans etc...
- IncRnd 9y ago
  > however TLS is useful only when talking with your own server. Are you saying that for the most trusted servers TLS is needed, but less trusted servers can be spoken to with less security?
  - fmntf 9y ago
    No no no. I am stating that, while TLS is good, your device will use other unprotected connections too (both on LAN and WAN) unless something else is done. until bugs or weaknesses are found, see SSL v1/2/3 deprecation, heartbleed, etc
tonyarkles 9y ago
I have no idea if this is what the OP is referring to, but it's pretty much impossible to use HTTPS on your home network without managing your own Root CA and somehow managing to get certificates signed by that Root CA into your devices. You've got a fighting chance in a corporate network where you can deploy and manage the Root CA via Active Directory/Group Policy, but managing it at home with consumer-grade devices... not gonna be a good day.
- deadbunny 9y ago
  Domains are cheap and Lets Encrypt should be dishing out wildcards by the end of the month[1]. Maybe not the perfect solution for most users though. Personally I've been running my own domain + wildcard for a few years, it'll be nice to remove the cost of the wildcard from the setup. 1. https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html https://letsencrypt.org/2017/07/06/wildcard-certificates-com...
  - tonyarkles 9y ago
    That will be awesome! I'm assuming they're still going to need to get refreshed on a regular basis, but this is a great step in the right direction!

deadbunny 9y ago

https://www.w3.org/TR/wot-security/ https://www.w3.org/TR/wot-security/