4 ms·
That won't work, setting aside how to get the coffee shops to do CA magement, how can a client know that momnpopshop.localcoffee.com is a valid cert for that ac
by dtech 8y ago
That won't work, setting aside how to get the coffee shops to do CA magement, how can a client know that momnpopshop.localcoffee.com is a valid cert for that access point, but momnpopshop.mallory.com isn't?
Opportunistic encryption without authentication is a major step up, and probably good enough for this scenario.
- tomatocracy 8y agoYou could at least have Trust On First Use and rely on clients save the domain name<->SSID association. It stops someone from implementing a MITM on the network later on and is a significant improvement in security. Having said that, there's no need for a CA as such to make that work.
- jopsen 8y agoOr publish SSID <-> public key association to a certificate transparency log. Or something like it... Probably, SSIDs would need to be globally unique, or somehow couples with a GPS coordinate..
- jopsen 8y agoCouldn't home routers come with a certificate from the manufacturer? I guess manufacturers could even issues certificates for globally unique SSIDs by allowing costumers to register a sub-domain with them. my-net.my-router.com Yeah, dealing with CAs is probably overkill for local coffee shops and home networks.
- mavhc 8y agoCisco Wireless Lan Controller came with a certificate so the access points knew they were connecting to a real Cisco device. It had an expiry date of 10 years. Which occurred for us a few months ago, and then after a power failure nothing would connect, fun times. Turned out you had to upgrade to the latest firmware, then disable the security check