On 20/11/20 14:22, Fernando Frediani wrote:
I don't see having HTTPS by default in LuCI as something good or even
necessary ? It's actually an unnecessary complication that could always
be optional.
One of the main reasons is that in many and probably most cases of a new
deployed OpenWrt router there is still no Internet connection available.
Also it doesn't seem to be that people need it since access by default
is only done via the LAN interfaces.
Not using SSL means anyone in the LAN can snoop the password to access
the router.
While this is a non-issue for most home wired networks, it is for wifi
and most people will use wifi on their router.
WPA2 is not going anywhere for a long while still and it is susceptible
to deauth attacks. After the attacker has captured enough handshakes
after the deauth they will know the wifi password. It just takes a while
but there are plenty of automated tools to do that 24/7 like Pawnagotchi
(a raspberry zero running a dedicated application) or wifi pineapples or
whatever.
Using SSL for web interface means the system is at least
compartimentalized so in case someone breaks into the wifi/LAN they
won't also take over the router as well.
If someone for some reason wishes
for example to expose the LuCI web interface to the internet than fine
to have it running on HTTPS and that can be enabled by those who wish to
operate in such way. As this example there are certainly others that
justify to have a HTTPS but I don't they they are most.
The same way I see as interesting to have an automated way to generate
SSL Certificates (ex: via Let's Encrypt), but again, that should be
optional to only those who wish to use HTTPS for their specific needs.
Fernando
On 20/11/2020 06:44, Karl Palsson wrote:
"Paul Spooren" <m...@aparcar.org> wrote:
Hi,
The current list of release goals for 20.xx states[0] that LuCI
should use HTTPS per default. This works by creating on-device
a self-signed certificate. Self-signed certificates result in
warnings and may cause more harm than good, multiple discussion
are found in the mail archive.
As no clean solution seems in reach while 20.xx seems close,
I'd like to suggest to postponse HTTPS LuCI (`luci-ssl` vs
`luci`) per default.
This isn't a vote but a request for developer/user opinions.
Very much in favour of leaving this off, self-signed isn't viable
by default
Sincerely,
Karl Palsson
_______________________________________________
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
_______________________________________________
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
_______________________________________________
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
