I am involved in an IoT project with single pager web UI. Unfortunately, as it was discovered in a hard way, TLS stack is not viable on the selected platform. The alternatives I've found for securing the XMLHTTPRequest traffic relay on integrity and authenticity of the bootstrap/login page. Is it safe to assume that in local networks attackers will not be able to intercept a request for login page from a browser to a device and send a hijacked login page instead with malicious JavaScript?
1
-
4TLS stack not available? Sounds like that platform is worse than useless - its a liability. – rook May 8 '17 at 17:22
-
2Which platform doesn't support TLS? – Neil McGuigan May 8 '17 at 17:51
-
ESP8266 - although it has TLS but it is not practically usable for the needs of the projects due to much higher lags and quick RAM fragmentation – hutorny May 8 '17 at 18:05
-
1You would still have the wifi password protecting the communication in a local situation. most device-based lan pages (ip cams, routers, etc) are served without https, though that's beginning to change... – dandavis May 8 '17 at 19:27
-
Yes, that's a good point. – hutorny May 8 '17 at 19:38
5
Is it safe to assume that in local networks attackers will not be able to intercept a request for login page from a browser to a device and send a hijacked login page instead with malicious JavaScript?
No, you cannot assume that unless the connection itself is reliably protected (e.g. an inaccessible UTP cable or already authenticated WiFi connection).
