Re: [lamps] The Status of OCSP and its future

[Phillip Hallam-Baker <[e-mail]>]

On Fri, Oct 25, 2019 at 10:30 AM Dr. Pala <[e-mail]> wrote:

> This is a good point - very practical approach. A sample use-case is our
> industry (Cable). In particular, in our industry, we leverage PKIs to
> secure the communication in our networks: each Cable Modem and DVRs come
> with one or more certificates from our infrastructure. This covers all
> modems from all vendors from all operators.
>
> Our Network, though, are going through radical changes that are aimed at
> providing the 10Gig platform we just released the standard for. In
> particular, the new architectures will see an increasing number of
> "entities" that require authentication.
>
Knowing that it is all hilariously insecure, I have deployed roughly
$20,000 worth of smarthome type equipment in my house so as to experience
it myself.

At this point, it is very clear to me that this stuff is really not suited
for anyone who is not an enthusiast. IoT is a hobby and it is going to
remain so unless we see some major improvements in manageability.

I currently have about 100 devices of which 50 have IP addresses. So
multiply by a billion or so households and that is a heck of a lot more
devices than we have been thinking about to date.


If we are going to get a handle on this, we have to change the
architecture. I don't think there was ever a business or such with 50
devices that would put itself on the internet without some sort of
co-ordination service on site. And to get to 100 there would be redundancy
and such.
Yes, peer to peer looks cool until you get to the point where n^2 is a big
number and then it is a headache. Peer to peer means that I have to
maintain each of my printers on every machine in the house. Just does not
scale.

The Cable Modem and DVR are the natural devices for such co-ordinating
services to reside.