4 ms·
i still dont understand why 192.168.20.1 should show as insecure. or abc.local that points to 192.168.0.22. why should i need a certficate for that and what "se
by 2Gkashmiri 2y ago
i still dont understand why 192.168.20.1 should show as insecure. or abc.local that points to 192.168.0.22. why should i need a certficate for that and what "security" is there to begin with? if a threat actor is in my lan, what hope do i have of https?
- batch12 2y agoTwo security concepts come to mind: defense in depth and assume breach. A hacked device on your lan doesnt have to equal complete compromise of your betwork. Giving up at the perimeter is one option, sure. Another is to design a network to be as resilient as possible to attack and compromise by layering defensive controls and assuming some can be bypassed. Then develop detective/preventative controls to respond when they are. Edit: specifically, encrypting http traffic will help reduce the risk of the threat actor acquiring new credentials (since we don't reuse those) and using them to pivot to other resources.
- klabb3 2y agoLet’s see.. I assume the warning serves two purposes: 1. You may be talking to someone other than you think. This only makes sense with registered domain names. 2. Your data can be eavesdropped or modified by someone in the middle. This would be quite rare within a LAN. Encryption itself might make sense sometimes but standard TLS is a really poor fit because there is no proper CA for the domain names. The main issue though is people don’t want IP addresses, they want names. If a special domain (like .home or .local) will only ever query local DNS servers returning local IP addrs, it would be roughly as safe as using IP addresses directly(?). In either case, when the user intentionally wants to speak over LAN (either IP or known home domain) the warning is unhelpful. For instance, configuring a router.
- 2Gkashmiri 2y agowhat about 12.0.0.1 cases?
- shawabawa3 2y ago> Your data can be eavesdropped or modified by someone in the middle. This would be quite rare within a LAN Literally every single public wifi network, which is a significant percentage of all internet traffic (including basically everyone working from a wework for example), is vulnerable to eavesdropping/mitm
- klabb3 2y agoThat’s true and should have been phrased differently. But names and addresses within a public LAN rarely have meaning to the customers, I guess. Btw, can an adversary on such a lan typically spoof source IPs and eavesdrop on packets between other nodes? I realize I know very little about WiFi.
- happyopossum 2y ago> Btw, can an adversary on such a lan typically spoof source IPs and eavesdrop on packets between other nodes? Yes, or no. It's possible, and with the right lan equipment trivially easy to prevent this, however you can't tell from the outside if the network is set up this way or not so you have to assume it isn't.
- klabb3 2y agoThanks for the info. I remember that 10-15y ago there were these snoopers you could install (perhaps a Firefox extension - I remember it was very easy) to steal session cookies from Facebook users in the same public WiFi’s. After that SSL by default – previously deemed “too expensive” for Facebook – was deployed rapidly, never to be mentioned again. So it sounds like WiFi too has improved then.
- happyopossum 2y agoYou can't always assume that 192.168.20.0/24 is your lan. Could be the local coffee shop, could be your neighbor's kid with a pineapple.