3 ms·

> never connects to a remote server, which she can connect to from her browser, which just works, never shows an annoying HTTPS warning, never requires enabling

> never connects to a remote server, which she can connect to from her browser, which just works, never shows an annoying HTTPS warning, never requires enabling custom CAs, and provides all functionality of the browser, without being marked as "not secure". Right, do you have a proposal for how to accomplish this? If you don't want to require an internet connection, I think trusting a self-signed cert is the best way to go, otherwise owning a domain name + letsencrypt is good if you're ok connecting to the internet.

kuschku 9y ago
I don't think you'll be able to explain your grandma how to trust a self signed certificate. The alternative would be HTTP, but that's "not secure" anymore. There are situations where trust on first use or out of bands verification are the only option. This is one of them.
- xg15 9y ago
  What I think could really do good is some browser-supported protocol specifically made for identifying devices on a LAN. E.g., imagine some UPnP-style broadcast where a device announces a public key, human-readable name and some type/capability information. Browsers listen for broadcasts and show users a notification once they discover an unseen device. Once confirmed, they can identify the device by its public key and also use it to establish encrypted connections. You could also define out-of-band methods to share the key, e.g. via an on-device wifi hotspot, NFC, a USB plug or a QR code printed on the device. Mozilla's Web-of-Things spec seems to show at least a willingness to work on this. Though right now they seem to re-solve exactly all the already solved problems and tackle none of the unsolved. ...or you could simply treat HTTP in local networks as a secure origin and be done with it.
  - collinmanderson 9y ago
    I agree, though instead of "public key" I would just say "self-signed cert". > ...or you could simply treat HTTP in local networks as a secure origin and be done with it. I think this is a lot harder than it sounds. What's a "local network". Is a coffee shop or public wifi a local network? How does the browser know? How do you know a rogue IoT device isn't doing ip spoofing?
- collinmanderson 9y ago
  Right, yeah, browsers are not guaranteeing any security on the local network. If self-signed is not an option, then I think an internet connection and domain name are required. (Which seems to me is totally fine. That's the whole point of IoT)

kuschku 9y ago

I don't think you'll be able to explain your grandma how to trust a self signed certificate. The alternative would be HTTP, but that's "not secure" anymore. There are situations where trust on first use or out of bands verification are the only option. This is one of them.

xg15 9y ago
What I think could really do good is some browser-supported protocol specifically made for identifying devices on a LAN. E.g., imagine some UPnP-style broadcast where a device announces a public key, human-readable name and some type/capability information. Browsers listen for broadcasts and show users a notification once they discover an unseen device. Once confirmed, they can identify the device by its public key and also use it to establish encrypted connections. You could also define out-of-band methods to share the key, e.g. via an on-device wifi hotspot, NFC, a USB plug or a QR code printed on the device. Mozilla's Web-of-Things spec seems to show at least a willingness to work on this. Though right now they seem to re-solve exactly all the already solved problems and tackle none of the unsolved. ...or you could simply treat HTTP in local networks as a secure origin and be done with it.
- collinmanderson 9y ago
  I agree, though instead of "public key" I would just say "self-signed cert". > ...or you could simply treat HTTP in local networks as a secure origin and be done with it. I think this is a lot harder than it sounds. What's a "local network". Is a coffee shop or public wifi a local network? How does the browser know? How do you know a rogue IoT device isn't doing ip spoofing?
collinmanderson 9y ago
Right, yeah, browsers are not guaranteeing any security on the local network. If self-signed is not an option, then I think an internet connection and domain name are required. (Which seems to me is totally fine. That's the whole point of IoT)