...but those services, served over HTTP, are not secured and can be spied upon by your insecure Chinese webcam or by the 3% of routers that have a malware, isn't that correct? So the browser should display so, it's up to you to ignore the warning.
The browser will still let you choose. It's just changing the default.
> For example in my home network I have different vlans: one for things i reasonably trust, and one for the chinese webcams and iot lightbulbs.
Congratulations, you are the 0.0001%.
> If my router has malware, even if i talk to it over https I'm screwed anyway, I don't think that is something I can fix with https.
Right, but if your lightbulb has malware and your router doesn't yet, then using HTTPS while talking to the router is pretty important.
I agree. So what's the solution you propose?
- Using a self signed CA that you have to install on all your devices?
- Using a trusted by default CA, that makes your internal-only devices depend on an external service (the CA)?
Or something else?
I'm not saying that encrypting the traffic in a LAN is useless. I'm saying that https and the current CA system is not the solution.
This one. Realistically all those devices are depending on external services already.
This is codifying (IMHO) bad practices and a really brittle architecture. Why would you want this? One of the reasons IoT security is a mess is that devices need to talk to internet endpoints instead of staying inside the NATted, firewalled LAN.
Say ports 1-4 on the switch are your trusted devices, 5-8 are your untrusted, and 9-10 are the LAN side of the router. There are other ways to do it but this is probably simplest and easiest to mentally map. Set ports 1-4 and 9 as access ports for VLAN 100. Set ports 5-8 and 10 as access ports for VLAN 200. Now you have two virtual networks hooked into one physical, partitioned by the router.
You then set up eth0 (port 9) as trusted LAN and eth1 (port 10) as untrusted LAN in the router, and give each an IP range (Separate subnets at a minimum). Now all trusted can talk to each other and all untrusted can talk to each other, but nothing together yet.
You then set routes and rules (port filtering, SNAT, DNAT, etc) for port access from either network to the other to finely control what ports are available to what. You do the same thing with eth2 which would be the connection from the router to the modem for internet access.
Not a full tutorial but hopefully that points you in the right direction.