> Given that the first login via LuCI, on a fresh install, is not with a > password anyway. What if setting the initial password sets up > letsencrypt also. Then when letsencrypt's first successful cert install, > https gets enabled as the default and then requests the user reboot to > complete the setup and will force their next session to https. > > I agree that https with self-signed certs are not good, especially on a > first boot/install device. >
My 2 cents, I still think that have a properly verified cert is madness. I really think that to address this the best way would be to add a big And very explicative alert to the first login page. The process would be 1. First boot --> First login (no password set) Append to the already present alert about password-less system, an alert about self signed cert and that the browser will tell that the router page will not be secure. (again this must be very explicative and easy to understand) 2. As soon as the user set a password, the webserver is restarted with http disabled/redirected and https now enabled. The user should now know that the page is secure and that he can whitelist/allowlist(for the inclusive people :D) it. This way the user won't be scared of unsecure page and can understand why the page is secure. Also if we want to push security to an upper level with self signed cert, we can ask the user to insert some data so that the self signed cert can be generated based on that and actually validated by the user (to prevent any MIT attack) > Cheers > Derek > > On 11/19/20 6:09 PM, Paul Spooren wrote: > > Hi, > > > > The current list of release goals for 20.xx states[0] that LuCI should > > use HTTPS per default. This works by creating on-device a self-signed > > certificate. Self-signed certificates result in warnings and may cause > > more harm than good, multiple discussion are found in the mail archive. > > > > As no clean solution seems in reach while 20.xx seems close, I'd like to > > suggest to postponse HTTPS LuCI (`luci-ssl` vs `luci`) per default. > > > > This isn't a vote but a request for developer/user opinions. > > > > Sunshine, > > Paul > > > > [0]: https://openwrt.org/docs/guide-developer/releases/goals/20.xx > > > > _______________________________________________ > > openwrt-devel mailing list > > openwrt-devel@lists.openwrt.org > > https://lists.openwrt.org/mailman/listinfo/openwrt-devel > > > _______________________________________________ > openwrt-devel mailing list > openwrt-devel@lists.openwrt.org > https://lists.openwrt.org/mailman/listinfo/openwrt-devel _______________________________________________ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel