Basic security

[pito111]

Hello,

some basic security (HTTPS and at least basic auth) could be nice. I plan to look into it when I'll have some time. Let's see if I'm able to do it.

Do you have something like that in mind already? Do you have an idea what would be the best approach? (http server configuration would be my first guess for quick and easy solution)

Best,

Stefan

[revk]

It is tricky with a local network and trade off of convenience and security. HTTPS will not work with local IPs.

I am hoping to get matter (and so HomeKit. That will solve security nicely.

I could go some way with a cookie and login as well, on the web interface.

[revk]

This is not quite like apache :-) Yes, basic auth would be possible, I am quite sure. As for https server, that needs some investigation too - as the memory footprint can be an issue on these small devices.

Matter works with iPhone (HomeKit) and Android for (secure) home automation, so longer term that is the best option really. I have a basic proof of concept at this point, but need to do quite a bit more work on it before I can release that update.

[pito111]

OK, got it. I'll try to check it out and see if I am able to do it reasonably easy in the mean time while waiting for Matter. Thank you for you points.

Anyway, I appreciate the work you did and are doing. The "cloud only" trend for everything is quite crazy and not to my liking to say the least (I guess I am not alone :) ). Even more so when official local API was previously available like in case of Daikin.

[revk]

Indeed, and the unauthenticated local API was main reason I started with simple unauthenticated controls for now.

[njh]

I am opposed to installing self-signed certificates, when used in web browsers - it trains people that it is ok and normal to press the "Proceed to XXX (unsafe)" button in Chrome. Without really understanding why it is ok in rare circumstances.

I think HTTPS certs on local devices are an unsolved problem.

One of the better solutions I have seen for embedded devices, is for them to come with a unique vendor-issued hostname and certificate. But it requires some kind of reverse proxy, in order to automatically issue certificates using the ACME protocol. Which has its own security problems. And then doesn't solve the problem of using a local IP address.

[pito111]

I disagree that it is unsolved problem.

You can import the self-signed certificate(s) to your OS/browsers. You can also create your own CA (easy-rsa, openssl, EJBCA, cert-manager, ...) and import that CA to your environment. That is common practice in organizations. Also self-signed certificates are common for smaller projects/environments that do not want to handle CA overhead (such as home environments, small networks with 1 admin etc.) or you, for some reason, feel like you do not want to trust public CAs for your private network/project.

I consider the "training" argument to be moot at this point, because for many people it is already happening anyway one way or another (e.g. connecting to home router or any other locally connected device with web interface). Also, if you are aware of the fact, that you are connecting to local network (you should be based on IP and/or hostname), than I do not see any issue there.

I do not see an argument where option to have HTTPS with at least generated self-signed certificate (or self-provided one) is worse than to be forced to use plain HTTP.

Anyway this is mostly an academic discussion so take it or leave it. You do you and let me do me.