3 ms·
I can. My ex can't. My parents can't. My ex's parents either can. Strangely enough, normal people can't. And that's the issue.
by Arcanum-XIII 3y ago
I can. My ex can't. My parents can't. My ex's parents either can. Strangely enough, normal people can't.
And that's the issue.
- janosdebugs 3y agoAnd what services do these people need to access/run on the local network that can't possibly be encrypted? The average person shouldn't be doing any of these things.
- Volundr 3y agoMy home router for example always throws up a big scary https warning. I'd also very much prefer it if more smart devices were local network only rather than relying on a vendors website being up in perpetuity. I'm actually not against browsers pushing HTTPS, I'm all for it. But it is a fair criticism that there are real downsides that there currently isn't a good user friendly solution for.
- aaomidi 3y agoUse Caddy as your webserver, use the DNS01 challenge, and you're done? Don't expose your local stuff over the internet without encryption. The ISP doesn't need to see that.
- deleted 3y ago[deleted]
- kalleboo 3y agoHow is your home internet router going to retrieve a certificate from Let's Encrypt before you have logged in and configured it to connect to the internet?
- aaomidi 3y agoYour preloaded root chain? I mean you can also trust on first use if you really want to.
- kalleboo 3y agoMy point is this. I'm a consumer. I buy a new router. I need to log into its web interface to enter the PPPoE credentials from my ISP before it can go online. I plug it in, and browse to 192.168.0.1. Chrome says in big letters "PAGE IS NOT SECURE YOU ARE BEING HACKED DON'T VISIT THIS PAGE". This situation means the router can't go online to generate a trusted certificate, and it's left with either HTTP or a self-signed certificate, both of which Chrome will present as inherently dangerous. The solution that router manufacturers seem to be going with are "you must own an Apple or Google OS device, pray that we still have our app on the store in your country and support your router, and accept our onerous privacy terms" > you can also trust on first use if you really want to That's a totally acceptable solution! But one that Chrome does not seem interested in making look safe to users. They could do it for known-local IP ranges and hit 99% of the use cases (10., 192.168. etc)
- janosdebugs 3y agoCurious: is this how routers are handled where you live? In Austria and the neighboring countries you typically get a device from the provider preconfigured, even if you don't want one.
- kalleboo 3y agoYeah. You're only guaranteed to get a free router if you also sign up for VoIP service which requires it and even then it will probably be wired-only and need a card to upgrade it to WiFi.
- janosdebugs 3y agoOhwow, that's less than ideal. I wish I could convince my provider to let me use my own router so I can get rid of the double NAT, but I'm probably 1 in 10000.
- janosdebugs 3y agoThese days most non-IT people I know log in to their wifi network with the credentials printed on the sticker on the bottom. They wouldn't touch the web interface if their life depended on it.
- chii 3y agowhich just exposes the wifi as an unsecured network, leading to far worse outcomes!
- janosdebugs 3y agoWhich is why having secure connections enforced for the typical use case is doubly important. We can't wish a more secure solution into existence, this is how internet providers handle it in a great many places. Make TLS enforcement a very well hidden setting to turn it off/bypass, but don't let the average user anywhere near this.