Subject: [Iotops] Secure browsing local web resources

From: Nick Allott <[email-masked]>
Date: Fri, 19 Nov 2021 14:47:19 -0000

Thanks for the opportunity to present last week. Pleased it generated some
discussion! [1]. The slides [2] I note neglected to include the reference
to the CA/Brower forum[3] guidelines (7.1.4.2.1) which help understand the
problem.

Accessing local web base resources locally and securely, we think is an
important problem to address. The IETF community is better placed than
most/all to qualify and refine this requirement and help develop and
evaluate the potential solutions.

These are the active questions we have, which it would be useful to get
confirmed (or refuted)

1. There is a problem: there is a clearly defined issue.
a) Bootstrapping a TLS connection between a browser and a local web
resource (IOT or not) on local internet (reserved IP address/Private Use)
is hard to do
b) Given (a) sniffing administrative passwords for local resource (e.g.
IOT), an otherwise intercepting traffic is relatively easy to do and
therefore a serious internal threat

2. It's a pervasive problem: the problem currently manifests itself on
many/most consumer routers and many/most IOT devices that connect via Wifi
and/or cabled IP.

3. There is no known best practice for practically and securely
authenticating local web clients against, local IP based IOT devices

We would be delighted in ether outcome: either agreement in the statements
above, or a clear refutation of any of the issues.

We hope to publicise the internal document outlining a potential solution
space next week. We are just cleaning the docs and making ready for
comment. I will follow up with the links asap, which assuming there is
agreement an issue exists - may help plant some seeds on how it can be
addressed

But in the interim, there are further comments/discussion that help
calibrate the problem, that would be great.

Also reminder, public facing paper on the problem [4]

[1] https://jabber.ietf.org/jabber/logs/iotops/2021-11-12.html
[2]
https://datatracker.ietf.org/doc/slides-112-iotops-suib-browsing-local-web
-resources-in-a-secure-usable-manner-iot-device-configuration-as-a-special
-case/
[3] https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.8.0.pdf
[4]
https://manysecured.net/wp-content/uploads/2021/03/MS-Secure-Intranet-Brow
ser-WG.pdf

Nick Allott
nquiringminds

---

From: Esko Dijk <[email-masked]>
Date: Mon, 22 Nov 2021 10:30:41 +0000

Hi Nick,

Agree with the problem as stated in your email and slides. (The latter explore some interesting solutions.)
A solution in IETF scope may be some class of "IoT" server certificate that is trusted only in link-local scope, also by browsers. (Trusted enough to allow the user to view the page.)
This could be an IDevID-type certificate. 

For enhanced security the browser could even be instructed in some way (QR code? 4-letter code?) to temporarily trust all IDevID certificates from vendor X for the duration of the browser tab being open.

regards
Esko

IoTconsultancy.nl  |  Email/Teams: [email-masked] 

-----Original Message-----
From: Iotops <[email-masked]> On Behalf Of Nick Allott
Sent: Friday, November 19, 2021 15:47
To: [email-masked]
Subject: [Iotops] Secure browsing local web resources

Nick Allott
nquiringminds

-- 
Iotops mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/iotops

---

From: Ash Wilson <[email-masked]>
Date: Mon, 22 Nov 2021 09:12:42 -0500

We had a brief discussion at IETF 110 in the DANISH BoF (which has evolved
into the DANCE WG) about how DNS-SD/mDNS might work to tie link-local
identities to DANE DNS records. This would give you the ability to have a
universal server identifier/public key in DNS which the IoT TLS server
could claim and prove to a client device. The downside here is that DANE is
not currently browser-supported, though it is supported in various TLS
libraries.

On Mon, Nov 22, 2021 at 5:31 AM Esko Dijk <[email-masked]>
wrote:

> A solution in IETF scope may be some class of "IoT" server certificate
> that is trusted only in link-local scope, also by browsers. (Trusted enough
> to allow the user to view the page.)
> For enhanced security the browser could even be instructed in some way (QR
> code? 4-letter code?) to temporarily trust all IDevID certificates from
> vendor X for the duration of the browser tab being open.
>
> regards
> Esko
>
> <https://datatracker.ietf.org/doc/slides-112-iotops-suib-browsing-local-web-resources-in-a-secure-usable-manner-iot-device-configuration-as-a-special-case/>
> <https://manysecured.net/wp-content/uploads/2021/03/MS-Secure-Intranet-Browser-WG.pdf>
>
> Nick Allott
> nquiringminds
>
> --
> Iotops mailing list
> [email-masked]

-- 

*Ash Wilson * | Technical Director
*e:* [email-masked]

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.