Hacker News Reader

I can't take any article about IoT security seriously if it doesn't mention the inability to secure the internet connection with SSL. We're practically forced to use HTTP on some devices instead of HTTPS, because you can't issue an SSL cert to a local IP address.

View on HN

The correct answer here is an attestation server and an 802.1AR device certificate; this should be used to attest to a remote server returned via DHCP or at a well known address (this sounds evil but a well known address and specific VLAN is the most widely deployed untrusted environment solution that actually works) which uses a long lived certificate for which the fingerprint is TOFU’d by the device. The device can use this attestation and mutual challenge to obtain a certificate (if it needs one) from an authority that other entities trust (which is necessarily not the 802.1AR CA).

"In order to protect users from the scourge of secure LAN traffic, end users should instead blindly add root ca's to their machine. It's also very important every IoT device has constant internet access to keep refreshing its certs, then the end user can finally feel secure." -google/mozilla/apple

Reply on news.ycombinator.com