Hacker News Reader

Comment by craftyguy | Hacker News Reader

do many routers not support https for their config pages? if so, that's terrible on their part, get a new router. If they do, then accept the cert in your browser and move on.

View on HN

That's exactly the problem. Devices in the local network can not partake in the public CA infrastructure. So they run self-signed certificates, which is probably a small security win over plain HTTP, but then customers are faced with a scary "someone is stealing your data" page before ever seeing the configuration page. That's a no go, so most stay on HTTP, but as we can tell from this announcement, time is running out for that. Leaving them with zero good options.

If this trend continues it means you will no longer be able to configure these devices with a webbrowser but forced to use the manufacturers "cloud solution" or install an app where both ends of the TLS connection can be controlled and you're not bound to public CAs.

I think you are jumping to conclusions for no good reason here, I think it's absolutely unlikely to happen that browsers remove http support. Worst case they'll add a clickthrough screen similar to the invalid ssl interstitials of today. Surely you can deal with an extra click through when logging in to your wifi router if you can't be bothered to install an ssl cert for it?

I can deal, but we're looking for the Dropbox solution here. This is only going to become worse with all the IoT hype, and if it's not solved, it will just mean all these devices will go through the manufacturer, all the time.

I bought a Uniquiti AMPLIFI home router. It’s great for signal, but can only be administered through their app (all traffic through their cloud, etc). This really sucks and they don’t really care as it’s probably easier to dev and they get all that sweet usage data.

It’s not a good trend, but this is a plus for most consumers who don’t care about local network security.

Amplifi should be manageable through UNMS by the end of the year or so. I cant seem to find the chart, but here is an image from the forums: https://usercontent-community.amplifi.com/461f0130-9835-459b...

That will be good. I almost bought their enterprise stuff because their signal is so good.

The Ubiquity routers use a self signed certificate, which Chrome already marks as insecure. There's ways to change it to use Let's Encrypt though.

Adding this cert to your trusted certs file marks it as secure, even if self-signed. This is better than usual.

Most consumer routers use self signed certificates which will be marked as insecure by the browser.

All modern browsers allow you to import certs into their trust store.

But the UIs for that is actively discouraging people from doing so.

Besides, I believe, the majority of people using router config page wouldn't even know for sure what 'importing certs into their browsers trust store' means or why it should be done and where those certs are etc. There's a ton of consumer-unfriendly terms and concepts, plus, as the parent noted, the UIs are usually discouraging.

Reply on news.ycombinator.com