Re:Chrome 68 will mark all HTTP sites as “not secure”
by collinmanderson on Saturday February 10, 2018 @10:15PM
(#16350988)
I agree, though instead of "public key" I would just say "self-signed cert".
> ...or you could simply treat HTTP in local networks as a secure origin and be done with it.
I think this is a lot harder than it sounds. What's a "local network". Is a coffee shop or public wifi a local network? How does the browser know? How do you know a rogue IoT device isn't doing ip spoofing?
E.g., imagine some UPnP-style broadcast where a device announces a public key, human-readable name and some type/capability information. Browsers listen for broadcasts and show users a notification once they discover an unseen device. Once confirmed, they can identify the device by its public key and also use it to establish encrypted connections.
You could also define out-of-band methods to share the key, e.g. via an on-device wifi hotspot, NFC, a USB plug or a QR code printed on the device.
Mozilla's Web-of-Things spec seems to show at least a willingness to work on this. Though right now they seem to re-solve exactly all the already solved problems and tackle none of the unsolved.
...or you could simply treat HTTP in local networks as a secure origin and be done with it.