3 ms·
What do you mean "without providing any kind of meaningful security benefit"? It prevents a bored kid who dumps the private key from one router from being able
by CiPHPerCoder 7y ago
What do you mean "without providing any kind of meaningful security benefit"?
It prevents a bored kid who dumps the private key from one router from being able to reliably impersonate thousands of consumers' routers, the world over.
That's a meaningful security benefit.
- lima 7y agoThe attacker would just dump the individual router's key instead and use the remote signer as a signing oracle to impersonate devices.
- CiPHPerCoder 7y agoThe owner/operator of the router could do that to their own device, yes. The idea is that each router would get a certificate signed with a distinct subdomain unique to that router. So you still can't impersonate other devices. It wouldn't be a generic domain or wildcard certificate. The remote signer would furthermore suspend suspicious connections (i.e. from multiple public IP addresses).