On 6/13/19 11:46 AM, Ted Lemon wrote:
On Jun 13, 2019, at 2:40 PM, Michael Thomas <m...@fresheez.com
<mailto:m...@fresheez.com>> wrote:
Are we talking about the same thing? I'm not sure what naming has to
do with dealing with crappy/default passwords on router web interfaces?
If your router has a name, it can get a cert. If it doesn’t have a
name, it can’t. That cert then becomes a basis for establishing trust.
I'm not sure what a router cert has to do with webauthn, other than
enabling TLS as Michael pointed out. But even self-signed cert where you
ignore the scary warning would work too.
In the case of devices on the home network establishing trust with the
router, you have to bootstrap that somehow. In that case, the
easiest thing to do is as I suggested:
1. you have access to the router’s network
2. nobody else has established trust yet
This isn’t ideal, but it creates a pathway for further trust
establishment: once you have one device that has a trusted key, then
that device can authorize additional devices, which can authorize
additional devices. A device that comes onto the network after
initial trust establishment can’t get trust without being approved.
Yes, that's what I mentioned too. So I think we're in agreement.
The meta-question is whether there is something to be done here, and if
this wg is the right place to do it. I know there was a security part of
the charter... it sure would be nice to set an example for all of this
IoT mischief on how to do a proper web login interface.
Mike
_______________________________________________
homenet mailing list
homenet@ietf.org
https://www.ietf.org/mailman/listinfo/homenet
