Hacker News Reader

Time to rant: why can’t I have a URL, in whatever format (special type of IPv6 address would work, although the available bits are a bit crunched), where the URL includes a public key? Then people could use HTTPS to communicate with local devices for which there is no practical way to provision certificates?

View on HN

Public keys should be rotated which would expire links. I think just having trust on first use would bridge most of the gap for local devices.

.. Now if we could get local socket support for talking to your own device and avoid arbitrary port reservation on localhost, that would make me happy.

> Public keys should be rotated which would expire links.

Sometimes public keys should be rotated, and this would indeed expire links. And sometimes they shouldn’t be (a key pair in a TPM-like device in an embedded system would make a lot of sense).

> I think just having trust on first use would bridge most of the gap for local devices.

This has the exact same key rotation problem. And you can get quite close to TOFU with an HTTP page that links to a a hypothetical HTTPS+key link.

Reply on news.ycombinator.com