Hacker News Reader

Comment by userbinator | Hacker News Reader

...as is the ability to inspect the traffic in your network to and from the devices you own. I think that is an even scarier situation, considering what others have discovered about "smart" devices precisely because their traffic was not encrypted. E.g. https://news.ycombinator.com/item?id=6759426

Personally, I'm for HTTPS connections to things like government websites (which is what this article seems to be mostly about), but against "HTTPS everything" in the way it's going to be implemented.

View on HN

If you want to avoid telemetry, you need to use open source devices. Prohibiting HTTPS for everything non-government is not a way to go.

> but against "HTTPS everything"

You being against HTTPS everything, is the same as being in support of MITM attacks somewhere. I am curious when is that the allowable case?

I own my computing devices and I should be able to control the traffic they create. Encryption must not prevent me from doing that.

Since you own the computing device and the connection, it's theoretically possible to read the session encryption keys from its memory.

This may be really hard in practice though.

And you still can MITM the traffic, you just have to install your MITM's cert on your device you want to MITM.

This only kind of works. Apps can embed their whole certificate chain and ignore the system one. I don't disagree we should have HTTPS everywhere, but for reverse engineering it does make things harder.

Just install your own root certificate on the devices you own and do MITM analysis with it.

Encryption does not prevent you from doing that, just everyone else.

Of course, with non-free software and walled gardens, that might involve some amount of reverse engineering, injecting a CA certificate in a trust store so you can run a MitM proxy, or do something to bypass key pins, but that's never really stopped anyone from finding out what an application is sending on the wire.

You acknowledge that there is a certain amount of traffic that ought to be encrypted, so you really need a solution for all applications either way.

Effectively, I feel like it does prevent you from doing that due to the reverse engineering necessity. The time multiplier between engineering vs reverse engineering is too large.

Who's going to spend the time hacking through {random Chinese smart lightswitch clone #8392727} that's sold in small volume?

There's going to need to be a legal "right to decrypt traffic" on black boxes, if we're serious about this.

And that's where we run into problems. How do we make it so that You can decrypt the traffic from your devices, but random hackers, your ISP, the NSA, etc can't? It's the same arguments against special decryption keys for the Government - a backdoor for one entity can be exploited by other entities.

How do we make it so that You can decrypt the traffic from your devices, but random hackers, your ISP, the NSA, etc can't?

The suggestion made at https://news.ycombinator.com/item?id=13303650 of terminating TLS at the border addresses this --- traffic on the public Internet is encrypted, but is decrypted in the private local network. In some ways it is similar to a VPN. I run a filtering/adblocking proxy that works in the same way.

Any pointers on what the encapsulation for that would look like? It seems like one good option, but I'd say it's only feasible if it doesn't require work on the part of the manufacturer.

My other thought was just mandating a method of loading CA certs onto all IoT devices using an open standard connector. If the owner so chooses.

In fact injecting a CA into an embedded light-switch is borderline impossible. At least is much harder than installing a user CA on your phone.

> I own my computing devices and I should be able to control the traffic they create.

And then, you are advocating for MITM them, instead of plainly controlling what traffic they create.

If you really want to control them, you should be advocating for open source and the end of DRM.

I do advocate for open-source, but that is often not a practical solution. MITM is more powerful.

You can pretty easily. Just use a proxy that does TLS interception. Not a big deal these days.

Forcing the use of encryption puts a constraint on the minimum level of processor power and memory needed for HTTPS capable IoT devices. Doing a TLS handshake with 2048-bit keys can be problematic with current low end processors. Simple devices with no security concerns can be given a web interface with cheaper hardware so long as browsers still work with plain HTTP.

Even the ESP8266, which you can buy for a couple of bucks in bulk, can do TLS. Is there really a need to support lower-end chips?

If your device connects to a third party, and you can't change this behavior, do you really own that device?

Idea: https terminating home routers with open standard will be solution for IoT devices, may be something like UPnP?

Reply on news.ycombinator.com