5 ms·

I just use home.com for all my home automation stuff, it's a lot easier to explain to houseguests than home.home.arpa would be.

qwertox 2y ago
The issue with this is that you can't create certificates this way. Assume you own example.com, then you can issue a free certificate for *.example.com and use that certificate for all your home services. Using HTTPS in the intranet does have its benefits and eases coding when services require SSL. If you host vaultwarden.example.com in your intranet, then you don't have to publish the subdomain on a public nameserver; it's enough that your intranet DNS resolver can respond with the local A or AAA record for vaultwarden.example.com and it's covered by the wildcard certificate.
- codetrotter 2y ago
  > you can't create certificates this way Sure I can. It's my network, so I decide what root CAs are trusted. Be your own CA, and tell your computers to trust your own CA cert. For example: https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi-yubikey/ https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi... or https://github.com/jsha/minica https://github.com/jsha/minica
  - lytedev 2y ago
    Per GP, this will be VERY difficult to explain to houseguests.
    - codetrotter 2y ago
      Why? Specifically, what I mean is, if you have house guests that care enough about your LAN that they actually want to access any of the services you have running on it – it shouldn't be difficult to explain to them why and how to trust your CA. The main difficulty IME is getting any of your guests to care about your LAN services in the first place.
      - 0x457 2y ago
        I'm sorry, but if you ask me to install your private CA on any of my devices... I would politely tell you to stop. As for house guests, I really like what OnHub did - you could allow anyone to network to control certain IoT devices. When someone was house sitting for me, they could have control thermostat, lights, etc from their phone without any apps or "add household member" shenanigans.
        thot_experiment 2y ago
        That's what I do, I just hijack home.com to do it and don't care about SSL on my intranet.
        codetrotter 2y ago
        > allow anyone to network to control certain IoT devices Yeah that makes sense :) My own house is not really IoTified yet. I have a single "smart" plug that I can turn on or off with an app that the night table lamp on one side of the bed is plugged into. But I could see the appeal of having the IoT setup accessible to guests for people that have more IoT stuff in their house.
  - cortesoft 2y ago
    And how are you going to distribute these certificates to your houseguests?
    - codetrotter 2y ago
      I run a plain http server on the LAN that hosts a copy of the public part of the CA cert. Download it from there and add it to your trusted CAs.
      - chgs 2y ago
        Please tell me your friends aren’t stupid enough to install random ca roots
      - rezonant 2y ago
        Friends don't ask friends to install their custom root CA. If someone asked you to install theirs, would you? After all, once they've installed your root CA, you'll now be able to trivially intercept all of their encrypted HTTPS communications while they use your network. I wouldn't trust my mother with that power.
        megous 2y ago
        I blame lacking implementation of https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10 https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10 by TLS clients.
        chgs 2y ago
        Doesn’t even have to be the ones baked into the cert - I should be able to import a root to authenticate a list of domains that I specify.
  - shawnz 2y ago
    When you're a guest at a friend's house, for example, you would have no problem installing their root CA in exchange for the privilege of using their network? Wouldn't you find that to be a little bit antisocial or overbearing?
    - codetrotter 2y ago
      I don’t need to install their root CA unless I specifically want to access any LAN services. Most people are not interested in that and so don’t need to add any new CA. Most people borrow the WiFi so they can check their WhatsApp, Instagram, TikTok etc. None of which requires adding any new CA.
      - megous 2y ago
        > I don’t need to install their root CA unless I specifically want to access any LAN services. s/unless/even if/
        codetrotter 2y ago
        No, I meant what I said. Well, I guess you could deal with the TLS warnings instead. But I prefer to install the CA cert so that the TLS connections are seen as valid.
  - _flux 2y ago
    Is it possible to limit the CA to only cover certain domain, e.g. *.yourown.home.arpa? Or is it the case that if you install a CA of your friend, it grants them the possibility of MitMing most any service (with non-pinned cert), at least when enabled by network topology? I've been using a local CA for a long time, but I have not found a way to limit it that way, so security-wise it is less than optimal.
    - noinsight 2y ago
      > Is it possible to limit the CA to only cover certain domain Sure, via the Name Constraints extension. Supposedly client support is spotty, but I have no experience in practice. Anything relatively modern could support it.
      - _flux 2y ago
        Thank you! I'll try that with my next CA, which I think is actually expired but it seems not all apps care about that :). If "relatively modern" covers browsers and email clients, that's pretty good already. edit: here's the reference: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.... and here's a practical example: https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-constraints.html https://systemoverlord.com/2020/06/14/private-ca-with-x-509-...
- thot_experiment 2y ago
  I can just link people from home.com to a page with an ssl cert if it became necessary for some reason. I'm curious what benefits you're thinking using HTTPS on my intranet would have (other than circumventing increasingly overzealous browser vendor API lockdowns) (on that note, is there a chromium/firefox build available that disables all that garbage so I can test in peace without having to reverse proxy my dev server?)
  - rezonant 2y ago
    Preventing other users on your network from snooping the administrative credentials to your LAN services for one (easy to do on WiFi, even if you use WPA). Also, if one of your devices switches off your WiFi and onto cellular, and you are using basic authentication, you are not only sending your credentials to whoever owns home.com, but also doing so in plain text. If you did that on some public wifi, that could get picked up by someone snooping. Sure, they wouldn't know where your services are, but why put a crack in your security when you don't need to? > I can just link people from home.com to a page with an ssl cert if it became necessary for some reason The only way that would work is if you use a root certificate authority and have them install it as trusted in their device, which is asking them to compromise their security, because that authority will be trusted for all TLS validation on any domain.
    - thot_experiment 2y ago
      > Preventing other users on your network from snooping the administrative credentials well, the only credential is that they're on my network! though fwiw i think even if there were credentials people on my LAN snooping my creds is not part of my threat model i care about at all, same with sending them to whoever owns home.com > why put a crack in your security because security has a cost that you shouldn't pay unless it makes sense to > The only way that would work is if you use a root certificate authority no, i can just link to a domain i can get Let's Encrypt certs for
paulddraper 2y ago
But you have to explain the insecure connections?
- thot_experiment 2y ago
  Why would they care? There's no reason to serve my home automation stuff over https.
  - paulddraper 2y ago
    Nor is there a reason to use a commercial domain. But here we are.
    - thot_experiment 2y ago
      Huh? home.com is a really simple easy to remember domain, that's a good reason isn't it?
      - pwg 2y ago
        And "home.com" is owned by someone, and registered through GoDaddy: Domain Name: HOME.COM Registry Domain ID: 1668509_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.brandsight.com Registrar URL: http://gcd.com Updated Date: 2022-04-09T03:55:51Z Creation Date: 1993-12-16T05:00:00Z Registry Expiry Date: 2031-12-15T05:00:00Z Registrar: GoDaddy Corporate Domains, LLC Registrar IANA ID: 3786 Registrar Abuse Contact Email: abuse@gcd.com Registrar Abuse Contact Phone: +1.5189669187 Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Name Server: NS2-02.AZURE-DNS.NET Name Server: NS3-02.AZURE-DNS.ORG Name Server: NS4-02.AZURE-DNS.INFO DNSSEC: unsigned
        thot_experiment 2y ago
        Not on my LAN it isn't! Why would I care who owns the domain?

qwertox 2y ago

The issue with this is that you can't create certificates this way. Assume you own example.com, then you can issue a free certificate for *.example.com and use that certificate for all your home services. Using HTTPS in the intranet does have its benefits and eases coding when services require SSL. If you host vaultwarden.example.com in your intranet, then you don't have to publish the subdomain on a public nameserver; it's enough that your intranet DNS resolver can respond with the local A or AAA record for vaultwarden.example.com and it's covered by the wildcard certificate.

codetrotter 2y ago
> you can't create certificates this way Sure I can. It's my network, so I decide what root CAs are trusted. Be your own CA, and tell your computers to trust your own CA cert. For example: https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi-yubikey/ https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi... or https://github.com/jsha/minica https://github.com/jsha/minica
- lytedev 2y ago
  Per GP, this will be VERY difficult to explain to houseguests.
  - codetrotter 2y ago
    Why? Specifically, what I mean is, if you have house guests that care enough about your LAN that they actually want to access any of the services you have running on it – it shouldn't be difficult to explain to them why and how to trust your CA. The main difficulty IME is getting any of your guests to care about your LAN services in the first place.
    - 0x457 2y ago
      I'm sorry, but if you ask me to install your private CA on any of my devices... I would politely tell you to stop. As for house guests, I really like what OnHub did - you could allow anyone to network to control certain IoT devices. When someone was house sitting for me, they could have control thermostat, lights, etc from their phone without any apps or "add household member" shenanigans.
      - thot_experiment 2y ago
        That's what I do, I just hijack home.com to do it and don't care about SSL on my intranet.
      - codetrotter 2y ago
        > allow anyone to network to control certain IoT devices Yeah that makes sense :) My own house is not really IoTified yet. I have a single "smart" plug that I can turn on or off with an app that the night table lamp on one side of the bed is plugged into. But I could see the appeal of having the IoT setup accessible to guests for people that have more IoT stuff in their house.
- cortesoft 2y ago
  And how are you going to distribute these certificates to your houseguests?
  - codetrotter 2y ago
    I run a plain http server on the LAN that hosts a copy of the public part of the CA cert. Download it from there and add it to your trusted CAs.
    - chgs 2y ago
      Please tell me your friends aren’t stupid enough to install random ca roots
    - rezonant 2y ago
      Friends don't ask friends to install their custom root CA. If someone asked you to install theirs, would you? After all, once they've installed your root CA, you'll now be able to trivially intercept all of their encrypted HTTPS communications while they use your network. I wouldn't trust my mother with that power.
      - megous 2y ago
        I blame lacking implementation of https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10 https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10 by TLS clients.
        chgs 2y ago
        Doesn’t even have to be the ones baked into the cert - I should be able to import a root to authenticate a list of domains that I specify.
- shawnz 2y ago
  When you're a guest at a friend's house, for example, you would have no problem installing their root CA in exchange for the privilege of using their network? Wouldn't you find that to be a little bit antisocial or overbearing?
  - codetrotter 2y ago
    I don’t need to install their root CA unless I specifically want to access any LAN services. Most people are not interested in that and so don’t need to add any new CA. Most people borrow the WiFi so they can check their WhatsApp, Instagram, TikTok etc. None of which requires adding any new CA.
    - megous 2y ago
      > I don’t need to install their root CA unless I specifically want to access any LAN services. s/unless/even if/
      - codetrotter 2y ago
        No, I meant what I said. Well, I guess you could deal with the TLS warnings instead. But I prefer to install the CA cert so that the TLS connections are seen as valid.
- _flux 2y ago
  Is it possible to limit the CA to only cover certain domain, e.g. *.yourown.home.arpa? Or is it the case that if you install a CA of your friend, it grants them the possibility of MitMing most any service (with non-pinned cert), at least when enabled by network topology? I've been using a local CA for a long time, but I have not found a way to limit it that way, so security-wise it is less than optimal.
  - noinsight 2y ago
    > Is it possible to limit the CA to only cover certain domain Sure, via the Name Constraints extension. Supposedly client support is spotty, but I have no experience in practice. Anything relatively modern could support it.
    - _flux 2y ago
      Thank you! I'll try that with my next CA, which I think is actually expired but it seems not all apps care about that :). If "relatively modern" covers browsers and email clients, that's pretty good already. edit: here's the reference: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.... and here's a practical example: https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-constraints.html https://systemoverlord.com/2020/06/14/private-ca-with-x-509-...
thot_experiment 2y ago
I can just link people from home.com to a page with an ssl cert if it became necessary for some reason. I'm curious what benefits you're thinking using HTTPS on my intranet would have (other than circumventing increasingly overzealous browser vendor API lockdowns) (on that note, is there a chromium/firefox build available that disables all that garbage so I can test in peace without having to reverse proxy my dev server?)
- rezonant 2y ago
  Preventing other users on your network from snooping the administrative credentials to your LAN services for one (easy to do on WiFi, even if you use WPA). Also, if one of your devices switches off your WiFi and onto cellular, and you are using basic authentication, you are not only sending your credentials to whoever owns home.com, but also doing so in plain text. If you did that on some public wifi, that could get picked up by someone snooping. Sure, they wouldn't know where your services are, but why put a crack in your security when you don't need to? > I can just link people from home.com to a page with an ssl cert if it became necessary for some reason The only way that would work is if you use a root certificate authority and have them install it as trusted in their device, which is asking them to compromise their security, because that authority will be trusted for all TLS validation on any domain.
  - thot_experiment 2y ago
    > Preventing other users on your network from snooping the administrative credentials well, the only credential is that they're on my network! though fwiw i think even if there were credentials people on my LAN snooping my creds is not part of my threat model i care about at all, same with sending them to whoever owns home.com > why put a crack in your security because security has a cost that you shouldn't pay unless it makes sense to > The only way that would work is if you use a root certificate authority no, i can just link to a domain i can get Let's Encrypt certs for

paulddraper 2y ago

But you have to explain the insecure connections?

thot_experiment 2y ago
Why would they care? There's no reason to serve my home automation stuff over https.
- paulddraper 2y ago
  Nor is there a reason to use a commercial domain. But here we are.
  - thot_experiment 2y ago
    Huh? home.com is a really simple easy to remember domain, that's a good reason isn't it?
    - pwg 2y ago
      And "home.com" is owned by someone, and registered through GoDaddy: Domain Name: HOME.COM Registry Domain ID: 1668509_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.brandsight.com Registrar URL: http://gcd.com Updated Date: 2022-04-09T03:55:51Z Creation Date: 1993-12-16T05:00:00Z Registry Expiry Date: 2031-12-15T05:00:00Z Registrar: GoDaddy Corporate Domains, LLC Registrar IANA ID: 3786 Registrar Abuse Contact Email: abuse@gcd.com Registrar Abuse Contact Phone: +1.5189669187 Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Name Server: NS2-02.AZURE-DNS.NET Name Server: NS3-02.AZURE-DNS.ORG Name Server: NS4-02.AZURE-DNS.INFO DNSSEC: unsigned
      - thot_experiment 2y ago
        Not on my LAN it isn't! Why would I care who owns the domain?