3 ms·

I can't help but wonder if we couldn't have used the CA system as a way to provide security for open wifi hotspots. I know the CA system isn't perfect, but wit

• dtech 8y ago
  That won't work, setting aside how to get the coffee shops to do CA magement, how can a client know that momnpopshop.localcoffee.com is a valid cert for that access point, but momnpopshop.mallory.com isn't? Opportunistic encryption without authentication is a major step up, and probably good enough for this scenario.
  • tomatocracy 8y ago
    You could at least have Trust On First Use and rely on clients save the domain name<->SSID association. It stops someone from implementing a MITM on the network later on and is a significant improvement in security. Having said that, there's no need for a CA as such to make that work.
    • jopsen 8y ago
      Or publish SSID <-> public key association to a certificate transparency log. Or something like it... Probably, SSIDs would need to be globally unique, or somehow couples with a GPS coordinate..
  • jopsen 8y ago
    Couldn't home routers come with a certificate from the manufacturer? I guess manufacturers could even issues certificates for globally unique SSIDs by allowing costumers to register a sub-domain with them. my-net.my-router.com Yeah, dealing with CAs is probably overkill for local coffee shops and home networks.
    • mavhc 8y ago
      Cisco Wireless Lan Controller came with a certificate so the access points knew they were connecting to a real Cisco device. It had an expiry date of 10 years. Which occurred for us a few months ago, and then after a power failure nothing would connect, fun times. Turned out you had to upgrade to the latest firmware, then disable the security check