Comment by y0ghur7_xxx | Hacker News Reader

Comment by y0ghur7_xxx | Hacker News Reader

I hope lans are exluded? I'm scared that I will get security warnings everywhere in my lan.

- when I log in to my webcams it says the connection is not secure

- when I log in on my nas it says the connection is not secure

- when I log in on my router it says the connection is not secure

- when I log in on the web interface of mythtv it says the connection is not secure

- when I log in on my self hosted gitea instance it says the connection is not secure

- when I log in to my self hosted nextcloud it says the connection is not secure

- when I log in to the configuration page of my toaster it says the connection is not secure

All these things are on my lan, and on most things there is no way to install a tls cert on them, nor would I want to do that.

Firefox already nags me that the connection is not secure when i enter a username and a password in any of those sites.

I'd hope LAN is included because while you use some services at home, most people will primarily use LAN services in public Wifis. It would be sensible to have HTTPS used there. They'd have to come up with a new idea of login pages (currently most systems MITM http requests) but otherwise it would make sense if you get a warning when you access pages on your hotel/in-flight Wifi without encryption.

> most people will primarily use LAN services in public Wifis

[citation needed] - I would say most people will primarily use LAN services in private home/corporate networks. But I don't have a citation either.

It's different use cases. Maybe one needs the warning, the other one not. But putting the warning on everything and overload the user with them is not the right solution.

Using a self signed CA is a pity, because installing it on every phone, tablet, laptop, tv, pc, ... is cumbersome in a home network, and making all hosts public and depending on an external CA for local resources to not get scary warnings can not be the right solution either.

> [citation needed] - I would say most people will primarily use LAN services in private home/corporate networks. But I don't have a citation either.

Sorry I don't have a citation here. But looking at my coworkers and family, none of them uses services in their home LAN. Most won't even know how to access the router.

On the other hand it's very common to use Wifi in public transport (at least here in London for the tube), airports, trains and hotels. Few people consider security when using these hotspots, making sure that SSL is enabled for all pages would be an improvement.

> On the other hand it's very common to use Wifi in public transport (at least here in London for the tube), airports, trains and hotels. Few people consider security when using these hotspots, making sure that SSL is enabled for all pages would be an improvement.

But do you use LAN services on that network? I think you will use that public hotspot to check facebook, hn, search something on google and stuff like that, not connect to some service in the local network of the hotspot.

Many captive portals operate as a LAN service, where you may be expected to type a password. If the public Wifi has a roaming agreement, that password may even be for your ISP or mobile phone provider.

Yes I agree. But I see that as an exception. The Captive Portal is ONE thing that needs to be secured and be accessible inside the LAN of a public wifi hotspot. I see that as a special case, and public HS providers can work around that (using a domain for the CP they own and got a cert for). But imho that does not mean that browsers should throw security warnings at users for everything else inside their home lan. At least until we have a solution that works for everyone. And

- depending on an external service for your internal home stuff, or

- installing a self signed CA on every device you own

is not a solution.

Until we have something we can replace the status quo with, we should not deprecate it.

> none of them uses services in their home LAN

They don't have printers? They don't connect to a NAT router before their cable modem? They never tether their computer to their phone? Their DVR doesn't have an app to control it? None of them have their receiver connected to their iTunes library?

All these things are preset in the many tech-savvy houses in my area ... and every single one of them (with the exception of the printer) is missing from less tech-oriented houses here. The printers are also usually locally connected when needed in many of my acquaintances' houses.

There's a clear divide that I see daily between households that understand their tech, and households that simply use whatever was set up for them. That divide seems to be growing wider, lately, too ...

While quite a few users will use services on their home lan, contrary to the parent posters statement, I believe the majority of users don't use those services via a web browser.

For instance (to draw from your examples): 1) Most people either install the printer drivers from the manufacture's web site, or let Windows/OSX auto-discover and auto configure the printer with out a web browser. 2) Most users just use the wifi information provided by the cable/DSL provider when they installed the modem, use the WPS button, or install the app that came with their router rather than use a web browser to configure it. 3) Most users will not tether their computer to their phone. 4) Most don't install a DVR app on their phone. If they did, their phone probably communicates with their DVR via some intermediate cloud service. 5) If their receiver auto-connects to their itunes library, it probably won't complain about that itunes not having a public certificate either.

Seems like something that should tie onto the public/private network distinction that Windows makes, though I can't remember ever seeing it in other OSes.

Can we do SSL locally though?

LANs should be included. It's just as bad as using most websites without TLS.

Maybe this helps forcing companies of IOT-like devices finally take security a bit more serious.

> LANs should be included. It's just as bad as using most websites without TLS.

Why? What's the threat model, that your employer/colleagues can see your traffic?

That any jerkoff with the right work shirt and demeanor can convince your coworkers that they need to service equipment at your demarc - and a lan turtle ends up connected to a trunk-enabled port on your switch that nobody notices for a year.

We are rapidly moving away from perimeter solutions and toward zero trust networking models. Yes, you should encrypt and authenticate inside your LAN.

I would really love to see some kind of LAN TLS solution that doesn't rely on requiring you to have your own CA. I've thought a fair bit about the problem, but haven't come up with any solutions that I like.

Browsers, rightfully so, don't accept self-signed certificates. Active Directory and Group Policies can push out a trusted self-signed root CA certificate and generate certs that endpoints can use, but that's a pain in the ass and usually requires central IT to manage.

Please someone come up with something I haven't thought of yet that doesn't break the internet but gets useful certs onto my LAN!

ssh is something that most users see as a secure protocol, and that uses tofu. maybe we could use the same auth mechanism inside a lan for http?

Why not just give them a domain name? I gave them a subdomain of my personal domain and Caddy handles TLS for all of them automatically.

...but those services, served over HTTP, are not secured and can be spied upon by your insecure Chinese webcam or by the 3% of routers that have a malware, isn't that correct? So the browser should display so, it's up to you to ignore the warning.

Well it's my lan, and I can decide what I trust and what not. For example in my home network I have different vlans: one for things i reasonably trust, and one for the chinese webcams and iot lightbulbs. If my router has malware, even if i talk to it over https I'm screwed anyway, I don't think that is something I can fix with https.

> Well it's my lan, and I can decide what I trust and what not.

The browser will still let you choose. It's just changing the default.

> For example in my home network I have different vlans: one for things i reasonably trust, and one for the chinese webcams and iot lightbulbs.

Congratulations, you are the 0.0001%.

> If my router has malware, even if i talk to it over https I'm screwed anyway, I don't think that is something I can fix with https.

Right, but if your lightbulb has malware and your router doesn't yet, then using HTTPS while talking to the router is pretty important.

> if your lightbulb has malware and your router doesn't yet, then using HTTPS while talking to the router is pretty important.

I agree. So what's the solution you propose?

- Using a self signed CA that you have to install on all your devices?

- Using a trusted by default CA, that makes your internal-only devices depend on an external service (the CA)?

Or something else?

I'm not saying that encrypting the traffic in a LAN is useless. I'm saying that https and the current CA system is not the solution.

> - Using a trusted by default CA, that makes your internal-only devices depend on an external service (the CA)?

This one. Realistically all those devices are depending on external services already.

> This one. Realistically all those devices are depending on external services already.

This is codifying (IMHO) bad practices and a really brittle architecture. Why would you want this? One of the reasons IoT security is a mess is that devices need to talk to internet endpoints instead of staying inside the NATted, firewalled LAN.

I think the NATed, firewalled LAN is an untenable concept: it blurs the line between private and public, a line that security requires making make clear and sharp. If it's connected to a network, it's exposed enough that we should treat it as connected to a public network (which greatly simplifies our threat model); if it's not secure enough for that, it needs to be built as local-only hardware.

Way off on a tangent here, but can you point me in the direction of some documentation for VLANing specific devices, giving them access to the internet for whatever they need to do, the ability to access them over the LAN by trusted devices, but not giving them the ability to call into the secure LAN?

That's exactly what I did, but I can't point you to a howto or something like that. I just bought a vlan capable switch and a pfsense router and set everything up.

Say you have a VLAN-capable switch and a spare PC with a couple NICs to use as a router. I use the Sophos XG Home Edition for example but other router setups (like the mentioned pfsense) should be similar.

Say ports 1-4 on the switch are your trusted devices, 5-8 are your untrusted, and 9-10 are the LAN side of the router. There are other ways to do it but this is probably simplest and easiest to mentally map. Set ports 1-4 and 9 as access ports for VLAN 100. Set ports 5-8 and 10 as access ports for VLAN 200. Now you have two virtual networks hooked into one physical, partitioned by the router.

You then set up eth0 (port 9) as trusted LAN and eth1 (port 10) as untrusted LAN in the router, and give each an IP range (Separate subnets at a minimum). Now all trusted can talk to each other and all untrusted can talk to each other, but nothing together yet.

You then set routes and rules (port filtering, SNAT, DNAT, etc) for port access from either network to the other to finely control what ports are available to what. You do the same thing with eth2 which would be the connection from the router to the modem for internet access.

Not a full tutorial but hopefully that points you in the right direction.

Some browser vendors have an agenda. But why now? Amazon.com worked fine with HTTPS from 1995 to 2006 - only the login page used HTTPS.

Now a small group tries to break the web and enforce HTTPS, but why? Is it to de-anonymize the web users?

Reply on news.ycombinator.com