Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> I don't fear MITM on a local only HTTPS server

> I trust my services and devices

That is exactly the point. You trust your local, possibly dumb aka unmanaged switch. It's a little piece of silicone with no funny business going on.

Now if you plug a trusted device A as well as an untrusted device B in, the untrusted device won't see any traffic meant for device A:

https://wiki.wireshark.org/CaptureSetup/Ethernet#switched-et...

Point being: as long as you trust all network devices from a trusted machine to another, on a switched Ethernet network, no other device will see any of that traffic at all, on a fundamental, low OSI level. It's not even about HTTP/S at that point yet. All this is untrue for WiFi, where you will want HTTPS indeed.

I'm not advocating against HTTPS at all. I use it as much as possible. But it might actually not be necessary, locally under the right circumstances.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: