5 ms·
Do self-signed certs not work? Yes, you have to tell your browser to permanently accept them the first time you connect, but after that, they work.
by secabeen 6y ago
Do self-signed certs not work? Yes, you have to tell your browser to permanently accept them the first time you connect, but after that, they work.
- stefan_ 6y agoWhy as a vendor would you use a self-signed certificate that causes the browser to scream at the customer when you could just not use TLS, plain old HTTP.
- PersonalOps 6y agoBecause the alternative is to embed a TLS private key that would allow you to MITM every other one of those devices. Someone extracted it? Looks like you have to either (a) bury your head in the sand or (b) rollout an expensive recall to change certs on those devices. Why use slightly compromised HTTPS versus plaintext HTTP? Same reason they have those super cheap locks on diaries from the 90s: it's a deterrent. Makes it a little harder to do a bad thing.
- stefan_ 6y agoYou have already answered why no one in their right mind would embed a shared certificate across all devices. I don't think you are being realistic with yourself when you believe people use self-signed certificates; they don't. You are missing what happens instead. There is just simply no web management interface on the device anymore. You need to download the vendors app to configure and use the device. Maybe, if the vendor cares, they use their own CA to secure a local connection to the device. Much more likely, the app and device exclusively talk to their cloud and use that as a middleman to exchange information.
- andrewnicolalde 6y agoBut it also makes it a little harder for the user to do what they want too because they have to click through a (correctly) scary-looking security warning.
- tialaramex 6y agoSome features require Secure Context. Browsers just don't enable those features in a context that isn't secure (HTTP is only considered "secure" on the loopback network to your own machine). If it's a Javascript API it returns an error, if it's an HTML or HTTP feature it doesn't work. "Here's a nickel kid, get yourself a secure context". Both Chrome / Chromium and Firefox have explicitly set policy that new features (as opposed to tidier ways to do things that already exist like DOM improvements) will require Secure Context, and there's already a weak assumption that even some tidying up will go into secure context when the rationale for not doing so is shaky (e.g. some of the web crypto features that needn't technically require Secure Context do anyway).
- stefan_ 6y agoI mean yes, browsers have amply demonstrated they don't care about secure local device communication at all. Mostly from ignorance and disinterest. It's their loss, just means everyone has to install an app or that smart lightbulb only talks to the vendor cloud.
- j1elo 6y agoFor some reason, iOS Safari won't do like all the other browsers, show a warning and then let you access. No, it outright rejects self-signed certs. You have to go through the trouble of installing the root CA into the phone, which is not practical.
- loeg 6y agoChrome seems to intentionally forget you accepted self-signed certificates after some period of time.
- jcims 6y agoI feel like Chrome has generally become much more amnesic as of the past few months. Lost more signing in to various services, which isn't a bad thing, I'm just not sure what (if anything) changed.