I want to build something, but I haven't seen it before. Maybe you have?
I'd like to build a HTML5 app, served to modern browsers and phones from a microcomputer (e.g. BBB). The microcomputer would be an open Access Point (not necessarily connected to the internet)
Clients could connect to the AP and see the app. Think of a clickwrap EULA on a wifi AP, but it did useful and nice things for you. An app.
The App needs secure communication. If I use HTTPS, then I'd need an SSL cert. For what domain name? And one for each microcomputer? I couldn't share them or they'd be "compromised" and revoked? That doesn't seem to work or scale. Users are trained to not accept self-signed certs. It's horrible UX to work against and undo that training.
Really, I just need what SSH has:
- Setup a new server with SSH, it makes it's own keys.
- ssh to a new server and get a new fingerprint: "This is new, accept?"
- ssh to a known server with a different fingerprint: "Something is wrong!"
I just want it to be as good as ssh. I don't need centralized identity. Future versions would manage identity by sharing fingerprints between clients.
In step step 2 "new fingerprints", modern browsers show a scary warning. For early adopters that's fine as a start. But for regular users, I'd prefer not to scare/untrain them. What I really want is a keyring like
Is anyone thinking about that for HTTPS and browsers?