5 ms·
Browsers don't design for internal use though. They insist on HTTPS for various things that are intranet only, such as some browser APIs, PWAs, etc
by rlpb 2y ago
Browsers don't design for internal use though. They insist on HTTPS for various things that are intranet only, such as some browser APIs, PWAs, etc
- akerl_ 2y agoAs is already described by the comment thread we're replying in, "internal use" and "HTTPS" are very compatible. Corporations can run an internal CA, sign whatever internal certs they want, and trust that CA on their devices.
- rlpb 2y agoIndeed they are compatible. However HTTPS is often unnecessary, particularly in a smaller organisation, but browsers mandate significant unnecessary complexity there. In that sense, brwosers are not suited to this use in those scenarios.
- therealpygon 2y agoAnd it is even more trivial in a small organization to install a Trusted Root for internally signed certificates on their handful of machines. Laziness isn’t a browser issue.
- rlpb 2y agoHow is that supposed to work for an IoT device that wants to work out of the box using one of these HTTPS-only browser APIs?
- metanonsense 2y agoI am not saying I‘d do this, but in theory you could deploy a single reverse proxy in front of your HTTP-only devices and restrict traffic accordingly.
- tedivm 2y agoI really don't see many scenarios where HTTPS isn't needed for at least some internal services.
- donnachangstein 2y agoThen, I'm afraid, you work in a bubble. A static page that hosts documentation on an internal network does not need encryption. The added overhead of certificate maintenance (and investigating when it does and will break) is simply not worth the added cost. Of course the workaround most shops do nowadays is just hide the HTTP servers behind a load balancer doing SSL termination with a wildcard cert. An added layer of complexity (and now single point of failure) just to appease the WebPKI crybabies.
- brendoelfrendo 2y agoSure it does! You may not need confidentiality, but what about integrity?
- donnachangstein 2y agoIt's a very myopic take. Someone that has seized control of your core network such that they were capable of modifying traffic, is not going to waste precious time or access modifying the flags of ls on your man page server. They will focus on more valuable things. Just because something is possible in theory doesn't make it likely or worth the time invested. You can put 8 locks on the door to your house but most people suffice with just one. Someone could remove a piece of mail from your unlocked rural mailbox, modify it and put it back. Do you trust the mail carrier as much as the security of your internal network? But it's not really a concern worth investing resources into for most.
- growse 2y ago> Someone that has seized control of your core network such that they were capable of modifying traffic, is not going to waste precious time or access modifying the flags of ls on your man page server. They will focus on more valuable things. Ah, the "both me and my attackers agree on what's important" fallacy. What if they modify the man page response to include drive-by malware?
- freeopinion 2y agoIf only browsers could understand something besides HTTPS. Somebody should invent something called HTTP that is like HTTPS without certificates.
- SoftTalker 2y agoModern browsers default to trying https first.
- recursive 2y agoCool. And when they invent it, it should have browser parity with respect to which API features and capabilities are available, so that we don't need to use HTTPS just so things like `getUserMedia` work. https://www.digicert.com/blog/https-only-features-in-browsers https://www.digicert.com/blog/https-only-features-in-browser...
- noselasd 2y agoThere’s enough APIs limited to secure contexts that many internal apps become unfeasible.
- franga2000 2y agoYou use the term "internal use" and "corporations" like they're interchangable, but that's definitely not the case. Lots of small businesses, other organizations or even individuals want to have some internal services and having to "set up" a CA and add the certs to all client devices just to access some app on the local network is absurd!
- acedTrex 2y agoSounds like there is a market for a browser that is intranet only and doesnt do various checks
- jillyboel 2y agoGood luck getting that distributed everywhere including the iOS app store and random samsung TVs that stopped receiving updates a decade ago. Not to mention the massive undertaking that even just maintaining a multi-platform chromium fork is.
- JimBlackwood 2y agoWhy would you want this? Then on production, you'll run into issues you did not encounter on staging because you skipped various checks.
- JimBlackwood 2y agoI don't think it's absurd and personally it feels easier to setup an internal CA than some of the alternatives. In the hackiest of setups, it's a few commands to generate a CA and issue a wildcard certificate for everything. Then a single line in the bootstrap script or documentation for new devices to trust the CA and you're done. Going a few steps further, setting up something like Hashicorp Vault is not hard and regardless of org size; you need to do secret distribution somehow.
- disiplus 2y agoWe have this, it's not trivial for some small team, and you have to deal with stuff like conda env coming with it's own set of certs so you have to take care of that. It's better then the alternative of fighting with browsers but still it's not without extra complexity
- jillyboel 2y agoGetting my parents to add a CA to their android, iphone, windows laptop and macbook just so they can use my self hosted nextcloud sounds like an absolute nightmare. The nightmare only intensifies for small businesses that allow their users to bring their own devices (yes, yes, sacrilege but that is how small businesses operate). Not everything is a massive enterprise with an army of IT support personnel.
- richardwhiuk 2y agoWhy are your parents on a corporations internal network?
- jillyboel 2y agoWhat corporation are you talking about? Have you never heard of someone self hosting software for their family and friends? You know, an intranet.
- smw 2y agoJust buy a domain and use dns verification to get real certs for whatever internal addresses you want to serve? Caddy will trivially go get certs for you with one line of config Or cheat and use tailscale to do the whole thing.
- DiggyJohnson 2y agoSelf hosting doesn’t usually apply connecting on a private network usually.
- mysteria 2y agoI actually do this for my homelab setup. Everyone basically gets the local CA installed for internal services as well as a client cert for RADIUS EAP-TLS and VPN authentication. Different devices are automatically routed to the correct VLAN and the initial onboarding doesn't take that long if you're used to the setup. Guests are issued a MSCHAP username and password for simplicity's sake. For internal web services I could use just Let's Encrypt but I need to deploy the client certs anyways for network access and I might as well just use my internal cert for everything.
- stefan_ 2y agoDo I add the root CA of my router manufacturer so I can visit its web interface on my internal network without having half the page functionality broken because of overbearing browser manufacturers who operate the "web PKI" as a cartel? This nowadays includes things such as basic file downloads.
- deleted 1y ago[deleted]
- ClumsyPilot 2y ago> Corporations can run an internal CA Having just implemented an internal CA, I can assure you, most corporations can’t just run an internal CA. Some struggle to update containers and tie their shoe laces.
- lxgr 1y agoYeah, but essentially every home user can only do so after jumping through extremely onerous hoops (many of which also decrease their security when browsing the public web). I’ve done it in the past, and it was so painful, I just bit the bullet and started accessing everything under public hostnames so that I can get auto-issued Letsencrypt certificates.