Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

My experience with large numbers of smart powerstrips is that they support ssh and https, but it's not reliable. Their telnet and http is reliable. I don't know why this is the case, but there you have it.


Smart powerstrips are still a minority of connected devices.

Printers, routers, etc — anything that can afford a $5 ARM or MIPS core — have plenty enough power to allow TLS access.

Getting a certificate for each of them to provide a Web interface is another story.

In corporate environment the IT department will probably install their own certificates, automatically trusted by corporate browsers. Home-oriented devices will probably use massively-copied certificates instead of unique ones. It's not as secure as a per-device unique certificate, but definitely more secure than no encryption at all.


But it mandates that you click through an SSL warning, which no user should ever have to do unless they are actually testing SSL-related stuff. Otherwise, it's just teaching everyone bad practices.


If self-signed certs are accepted silently and shown as "not secure", the way plain HTTP is accepted and shown (per https://news.ycombinator.com/item?id=9472037 proposal), the user won't need to click through anything.

Self-signed HTTPS is in no way less secure than unencrypted HTTPS.


These powerstrips are expensive enough to have a $5 ARM or MIPS core driving their software. And yes, I'm aware that they are a tiny minority of connected devices - I just wanted to point out that there's a class of devices that have problems with encryption.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: