4 ms·

I feel woefully out of step here. If you can create a CA that browsers respect, have you really improved on cleartext transmission? And isn't the CA is now a ne

• mmalone 6y ago
  Sure the CA is a new attack vector. That doesn't make it inherently insecure or the same as cleartext transmission. Is running an internal OAuth OIDC identity provider to issue signed identity tokens the same as using cleartext passwords?
• sethhochberg 6y ago
  You're definitely shifting your attack surface towards the CA, but in doing so you've (probably) given yourself a lot of additional control over the weakest link in your system. With cleartext, vulnerabilities tend to range from simple things like "find the switch, plug in, sniff traffic over the wire" to slightly more complex, but still viable things like "sniff wifi traffic now, worry about cracking WPA-2 later". Your typical TLS certificate is going to be more robust than your typical consumer / prosumer LAN security, and you typically have better tools (SSH certificates, 2FA, encryption at rest, etc, etc) for locking down a machine running a CA than network gear you either don't control or bought from a consumer-focused vendor. Its a typical example of defense-in-depth. Hopefully your network is trustworthy, but if for whatever reason it becomes insecure/vulnerable you now have genuine encryption between client and server at application layer.
• deleted 6y ago
  [deleted]
• xg15 6y ago
  I may be wrong, but I think you still have to manually install your CA cert as a custom root CA on any device that you want to use inside your network. You can't use this tutorial to make a new CA that is automatically trusted.
  • mmalone 6y ago
    That is correct.