Re: [homenet] Ted's security talk at IETF99: DNCP Security

[Ted Lemon <[e-mail]>]

On Jul 31, 2017, at 1:41 PM, Michael Richardson <[e-mail]> wrote:
> That partly gets rid of the security exception on each access to the
> web interface: provided the web browser loads the new trust anchor.

I don't know how to make that work without a fake domain tree.   Can't we just use ACME+letsencrypt.org <http://letsencrypt.org/>?

> This is where all the other pairing mechanisms come into play.
> You mentioned having a laundry list of them.

Sure.   The question is, what value does the PKI cert add here?   I agree that having a cert that validates is good for the web UI, but I don't see how it helps in establishing trust.

I would be tempted to do something like what Christian is doing with DNSSD privacy: print a QR code on the box, take pictures of all the QR codes with your smartphone, and then use your smartphone app to bootstrap trust using those QR codes.   You could do something similar by just flashing the front panel LEDs really fast when the "pair" button is pressed, and have the smartphone decode that, as is being done with exfiltration malware now.   I suspect there's code we could download... :)