3 ms·
I personally believe that browsers will eventually be forced to turn off CA verification (by default) of local network traffic (reserved IP spaces and the .loca
by floatingatoll 6y ago
I personally believe that browsers will eventually be forced to turn off CA verification (by default) of local network traffic (reserved IP spaces and the .local TLD) in non-enterprise browsers.
Enterprise browsers will no doubt continue to perform CA verification by default, and I expect a preference will be offered to let home users (rare) and enterprise profile management (common) override this to enable/disable as needed for whatever custom localnet definition they require.
No other solution can work here, as by definition anything in localnet can neither be verified by an external entity nor issued in any trustable or permissible manner that is resilient enough for home users to configure, navigate, and manage on their own.
This is a predictable outcome of HTTPS Everywhere, and all major browsers have chosen to not yet deliver this for simple https://whatever.local https://whatever.local requests, as tested in each of them today. While technically local network traffic might need as urgently need to necessarily be HTTPS to keep users safe in a home scenario, browsers further narrow the list of HTTP-offered features each year, and with the advent of HTTP/2 and HTTP/3 requiring mandatory TLS, the ancient status quo that's being delivered no longer meets the needs of modern networked homes.
I encourage the major browsers to step up and define their direction forward in coordination with each other, so that further wreckage is not introduced into the home networking ecosystem. The lack of progress here is indirectly harming users by teaching them that "http:// http:// is fine if something says it is"; as is well understood, the judgement of whether to wire-encrypt or not cannot (by default) be entrusted to end users following instructions.
If there are existing discussions underway by any of the major browsers, I'd love an opportunity to learn more about them from links or stories shared in this discussion.
- nbadg 6y agoAn alternate solution to the same problem would be to streamline running your own local certificate authority. For example: if the local router was its own certificate authority (that spoke ACME), and OSes and/or browsers were configured to check with the local gateway for their cert authority. You could add the Name Constraints exception and restrict it to local-only (reserved) TLDs.
- floatingatoll 6y agoI don’t consider this approach to be possible to operate usefully at scale with completely non-technical users, as they aren’t interested in operating a minor bureaucracy for their thermostat to work. I am capable of operating my own CA out of my home in a matter of minutes in order to solve this problem, yet even I consider it a waste of my time to do so. In-home transport encryption should not demand a burden from the user. To quote Brazil: “Listen, this whole system of yours could be on fire and I couldn't even turn on the kitchen tap without filling out a twenty-seven B stroke six.”
- EvanAnderson 6y agoIt's a more plausible scenario, to me, that browsers will become more strict w/ CA verification. Non-technical users will be permitted easy access to resources secured by third-party-signed certificates. They'll be forced to plumb into the confusing depths of their browser / OS to make changes that would allow access to resources protected with untrusted certificates (assuming they're even allowed to make such changes, which I think will also eventually be taken away). Nobody in the industry wants anything locally-hosted by end users to work well. Locally-hosted means not "cloud"-hosted. That means no sweet, sweet recurring subscription revenue stream or centrally-stored user data to "monetize".
- toast0 6y ago> Nobody in the industry wants anything locally-hosted by end users to work well. Locally-hosted means not "cloud"-hosted. That means no sweet, sweet recurring subscription revenue stream or centrally-stored user data to "monetize". This doesn't work for things like routers and modems that need to be configured before you can even access the cloud.
- EvanAnderson 6y agoThere have been "cloud" router products already. Cisco / Linksys had some, if memory serves. Have the router pull DHCP from the ISP, call home to the mother ship, then have the user configure it with an "app" on their phone. The vast majority of router buyers don't want to configure anything anyway.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]