4 ms·

why bother with tls, stick it on a separate vlan, lock down all the traffic

by lousken 7mo ago

justin_oaks 7mo ago
Some of this might have been "because I want to see if I can". Another reason is "It bothers me to keep seeing this browser tell me my connection is insecure". As for putting it on a separate VLAN and securing traffic with firewall rules, that may be as much or more trouble than setting up the automated certificate renewal. At least with the automated certificates there may not be any further maintenance required. With firewall rules, you'll need to open up the firewall each time you want a new device to access the printer.
- lousken 7mo ago
  Sure but how long will that last? It says in the article that RSA2048 is required, however 3072 should be the minimum these days, I am not sure how long will letsencrypt even allow creating 2048bit certs.
- whalesalad 7mo ago
  This is only for the web UI, no? The actual print comms are not over https. This is a management tool only that I’d imagine you access once or twice per year?
dns_snek 7mo ago
Because that only protects you from a small subset of possible threats that end-to-end encryption protects you from like DNS hijacking and any MITM-type scenario. Sticking it on a VLAN only controls access, not data secrecy.
- VladVladikoff 7mo ago
  Broadcasting internal IPs on public DNS records is also a suboptimal approach that leaks information to the public. Local devices should be routed over layer 2.
  - iso1631 7mo ago
    DNS challenge doesn't broadcast internal IPs. Certificate transparency does show up hostnames or wildcards though.
hrmtst93837 7mo ago
[flagged]
- lousken 7mo ago
  tls is not boring at all, especially with devices that are always 10 years behind in terms of security, it's not like you can enforce any kind of reasonable ciphersuites even in modern printers also 9/10 printing protocols are insecure anyway scans - sure, mailserver needs to be allowed vendor support - same mailserver vm - at least a reason to kill it also why would i ever allow auto updates, it's better not to without understanding what garbage manufacturer released this time

why bother with tls, stick it on a separate vlan, lock down all the traffic

by lousken 7mo ago

why bother with tls, stick it on a separate vlan, lock down all the traffic

Some of this might have been "because I want to see if I can". Another reason is "It bothers me to keep seeing this browser tell me my connection is insecure". As for putting it on a separate VLAN and securing traffic with firewall rules, that may be as much or more trouble than setting up the automated certificate renewal. At least with the automated certificates there may not be any further maintenance required. With firewall rules, you'll need to open up the firewall each time you want a new device to access the printer.

lousken 7mo ago
Sure but how long will that last? It says in the article that RSA2048 is required, however 3072 should be the minimum these days, I am not sure how long will letsencrypt even allow creating 2048bit certs.
whalesalad 7mo ago
This is only for the web UI, no? The actual print comms are not over https. This is a management tool only that I’d imagine you access once or twice per year?

dns_snek 7mo ago

Because that only protects you from a small subset of possible threats that end-to-end encryption protects you from like DNS hijacking and any MITM-type scenario. Sticking it on a VLAN only controls access, not data secrecy.

VladVladikoff 7mo ago
Broadcasting internal IPs on public DNS records is also a suboptimal approach that leaks information to the public. Local devices should be routed over layer 2.
- iso1631 7mo ago
  DNS challenge doesn't broadcast internal IPs. Certificate transparency does show up hostnames or wildcards though.

hrmtst93837 7mo ago

[flagged]

lousken 7mo ago
tls is not boring at all, especially with devices that are always 10 years behind in terms of security, it's not like you can enforce any kind of reasonable ciphersuites even in modern printers also 9/10 printing protocols are insecure anyway scans - sure, mailserver needs to be allowed vendor support - same mailserver vm - at least a reason to kill it also why would i ever allow auto updates, it's better not to without understanding what garbage manufacturer released this time