5 ms·

most printers/routers/copiers offer HTTPS from what I've seen. Sometimes it's on by default, usually not. They just use self-generated, self-signed certificates

by finnn 11y ago

most printers/routers/copiers offer HTTPS from what I've seen. Sometimes it's on by default, usually not. They just use self-generated, self-signed certificates. There are problems with that, but CPU power isnt one of them.

greglindahl 11y ago
My experience with large numbers of smart powerstrips is that they support ssh and https, but it's not reliable. Their telnet and http is reliable. I don't know why this is the case, but there you have it.
- nine_k 11y ago
  Smart powerstrips are still a minority of connected devices. Printers, routers, etc — anything that can afford a $5 ARM or MIPS core — have plenty enough power to allow TLS access. Getting a certificate for each of them to provide a Web interface is another story. In corporate environment the IT department will probably install their own certificates, automatically trusted by corporate browsers. Home-oriented devices will probably use massively-copied certificates instead of unique ones. It's not as secure as a per-device unique certificate, but definitely more secure than no encryption at all.
  - finnn 11y ago
    But it mandates that you click through an SSL warning, which no user should ever have to do unless they are actually testing SSL-related stuff. Otherwise, it's just teaching everyone bad practices.
    - nine_k 11y ago
      If self-signed certs are accepted silently and shown as "not secure", the way plain HTTP is accepted and shown (per https://news.ycombinator.com/item?id=9472037 https://news.ycombinator.com/item?id=9472037 proposal), the user won't need to click through anything. Self-signed HTTPS is in no way less secure than unencrypted HTTPS.
  - greglindahl 11y ago
    These powerstrips are expensive enough to have a $5 ARM or MIPS core driving their software. And yes, I'm aware that they are a tiny minority of connected devices - I just wanted to point out that there's a class of devices that have problems with encryption.
protomyth 11y ago
Well, the Ricoh Aficios I checked don't. None of the environmental monitors support https (http or telnet only). So, my question is what is going to be the best practice to deal with these?

by finnn 11y ago

greglindahl 11y ago

My experience with large numbers of smart powerstrips is that they support ssh and https, but it's not reliable. Their telnet and http is reliable. I don't know why this is the case, but there you have it.

nine_k 11y ago
Smart powerstrips are still a minority of connected devices. Printers, routers, etc — anything that can afford a $5 ARM or MIPS core — have plenty enough power to allow TLS access. Getting a certificate for each of them to provide a Web interface is another story. In corporate environment the IT department will probably install their own certificates, automatically trusted by corporate browsers. Home-oriented devices will probably use massively-copied certificates instead of unique ones. It's not as secure as a per-device unique certificate, but definitely more secure than no encryption at all.
- finnn 11y ago
  But it mandates that you click through an SSL warning, which no user should ever have to do unless they are actually testing SSL-related stuff. Otherwise, it's just teaching everyone bad practices.
  - nine_k 11y ago
    If self-signed certs are accepted silently and shown as "not secure", the way plain HTTP is accepted and shown (per https://news.ycombinator.com/item?id=9472037 https://news.ycombinator.com/item?id=9472037 proposal), the user won't need to click through anything. Self-signed HTTPS is in no way less secure than unencrypted HTTPS.
- greglindahl 11y ago
  These powerstrips are expensive enough to have a $5 ARM or MIPS core driving their software. And yes, I'm aware that they are a tiny minority of connected devices - I just wanted to point out that there's a class of devices that have problems with encryption.

protomyth 11y ago

Well, the Ricoh Aficios I checked don't. None of the environmental monitors support https (http or telnet only). So, my question is what is going to be the best practice to deal with these?