Launching in 2015: A Certificate Authority to Encrypt the Entire Web

Re:Launching in 2015: A Certificate Authority to Encrypt the... by icebraining on Tuesday November 18, 2014 @11:56AM (#8624810)

Technically, there's no reason why a fridge couldn't have a signed cert tied to some dynamic DNS (e.g. <fridge-serial-number>.<manufacturer>.<tld>).

[ Parent | on HN ]

Re:Launching in 2015: A Certificate Authority to Encrypt the... by danielweber on Tuesday November 18, 2014 @12:51PM (#8625150)

True, but on many small networks, you aren't addressing the embedded device by a FQDN.

All these appliances should let you change the cert on them, but you still need that initial connection, and at smaller organizations (or households) the certs will never ever be changed.

I used to work on embedded security projects so I care about this; I also realize that's a small portion of the market. I'm okay with making the people connecting to their new printer jump through a hoop in order to reduce the chances of someone hijacking www.paypal.comm but you still have to allow some way in.

[ Parent | on HN ]

Re:Launching in 2015: A Certificate Authority to Encrypt the... by icebraining on Tuesday November 18, 2014 @03:42PM (#8626207)

True, but on many small networks, you aren't addressing the embedded device by a FQDN.

Why not?

[ Parent | on HN ]

Re:Launching in 2015: A Certificate Authority to Encrypt the... by JetSpiegel on Tuesday November 18, 2014 @05:11PM (#8626711)

Why should my fridge have a FQD name? What purpose does that serve?

Why install a firewall in each device if you can install one on the router that works for everything?

[ Parent | on HN ]

Re:Launching in 2015: A Certificate Authority to Encrypt the... by icebraining on Tuesday November 18, 2014 @05:39PM (#8626858)

Why should my fridge have a FQD name? What purpose does that serve?

To allow you to create a signed certificate to authenticate it?

Why install a firewall in each device if you can install one on the router that works for everything?

Having an FQDN doesn't mean you need to install a firewall on your device. You can still use the router's, and even prevent any inbound connections from the WAN to the device.

[ Parent | on HN ]

Re:Launching in 2015: A Certificate Authority to Encrypt the... by cmdrfred on Tuesday November 18, 2014 @04:50PM (#8626581)

NAT traversal?

[ Parent | on HN ]

Re:Launching in 2015: A Certificate Authority to Encrypt the... by icebraining on Tuesday November 18, 2014 @05:41PM (#8626864)

FQDN doesn't have to mean publicly accessible. I have a personal subdomain that points to an internal IP. It's kinda weird to do with IPv4, but it works fine, and with IPv6 it'll be natural, since each device will probably have a globally unique address anyway, even if it can't be accessed outside of your LAN.

[ Parent | on HN ]

Re:Launching in 2015: A Certificate Authority to Encrypt the... by jerf on Tuesday November 18, 2014 @12:21PM (#8624957)

But note that only works if the manufacturer can choose the name without an issue from the customer. For things like network appliances in larger companies that aren't going to want [generic number]manufacturer.com but want [my name].corp.[my company].com, you're stuck.

[ Parent | on HN ]

Re:Launching in 2015: A Certificate Authority to Encrypt the... by icebraining on Tuesday November 18, 2014 @12:32PM (#8625028)

Allow the cert to be configurable, then the company can use its internal CA to give certs to all its appliances.

[ Parent | on HN ]

Re:Launching in 2015: A Certificate Authority to Encrypt the... by jerf on Tuesday November 18, 2014 @12:38PM (#8625068)

Yes, that's the status quo, and has been for a while. The point is that's currently the best you can do. For boxes without external exposure, this work won't change anything, but a standardized protocol for dealing with boxes with external exposure would still help some use cases.

[ Parent | on HN ]