1

I am involved in an IoT project with single pager web UI. Unfortunately, as it was discovered in a hard way, TLS stack is not viable on the selected platform. The alternatives I've found for securing the XMLHTTPRequest traffic relay on integrity and authenticity of the bootstrap/login page. Is it safe to assume that in local networks attackers will not be able to intercept a request for login page from a browser to a device and send a hijacked login page instead with malicious JavaScript?

  • 4
    TLS stack not available? Sounds like that platform is worse than useless - its a liability. – rook May 8 '17 at 17:22
  • 2
    Which platform doesn't support TLS? – Neil McGuigan May 8 '17 at 17:51
  • ESP8266 - although it has TLS but it is not practically usable for the needs of the projects due to much higher lags and quick RAM fragmentation – hutorny May 8 '17 at 18:05
  • 1
    You would still have the wifi password protecting the communication in a local situation. most device-based lan pages (ip cams, routers, etc) are served without https, though that's beginning to change... – dandavis May 8 '17 at 19:27
  • Yes, that's a good point. – hutorny May 8 '17 at 19:38
5

Is it safe to assume that in local networks attackers will not be able to intercept a request for login page from a browser to a device and send a hijacked login page instead with malicious JavaScript?

No, you cannot assume that unless the connection itself is reliably protected (e.g. an inaccessible UTP cable or already authenticated WiFi connection).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.