4 ms·
A problem is that the easier you make it to sneak in other trusted root CAs, the more you open attack surfaces which malicious parties can exploit. As a device
by wildmanx 5y ago
A problem is that the easier you make it to sneak in other trusted root CAs, the more you open attack surfaces which malicious parties can exploit.
As a device manufacturer that uses certificate pinning, do you really want to trust whatever cheap crap router people have at home to provide a trusted root CA? Let's say that one gets hacked (which happens too often..), you are now also wide open. Sure, it's the owners responsibility, and with certificate pinning that's not configurable, you are depriving responsible owners of the possibility to decrypt their own traffic, but we at least need to acknowledge that there is a balance to strike here, and it's not obvious what the perfect solution would be.
Maybe an opt-out of certificate pinning that is so "hard" to reach that it's really only for power users that know what they are doing. (And with "hard" I mean more than some window popping up that says "Are you sure you want to do this? You'll void all warranty blah blah" -- people have already been conditioned to just click away certificate warnings in their browser; the same people would just click anything to just go on with their lives..)
- EvanAnderson 5y agoA physical switch on the device would be a good solution. Physical access is mostly "game over" anyway.
- wildmanx 5y agoIt needs to be something that requires certain skill. Maybe a dip switch inside the enclosure. Average Joe won't dare and it's too much work anyway. At least if you just try random things to get your IoT device to work if something is off. I'd love to have that.
- dec0dedab0de 5y agoIt could just be a text file that you have to modify with vi over ssh. Even if the SSH server is only available if configured through the scary pop up in the gui, maybe even require a public key be uploaded for authentication. Not too difficult, yet technical enough that no one is going to do it without thinking.
- EvanAnderson 5y agoThe point of a physical switch would be to restrict access to someone with physical access-- ideally the owner.
- wildmanx 5y agoAlso guarantees that you may need to break some seal that then can be proof for tampering, warranty-wise. (Which otoh some users may not like.)
- userbinator 5y agoThere is no "balance", this is purely a question of ownership. If I can't inspect or modify the traffic, it's not mine, I'm just "renting" perpetually.