Is it necessary to secure the connection to the local wifi with https?


Gok

I'm currently writing an application that plans to control a machine. The machine is controlled by a Raspberry Pi, which provides an API (via flask) for local wifi. On the other hand, the app also connects to the same wifi and accesses the API. To make sure that not everyone who downloads the app and connects to wifi can control the machine, I set up some basic authentication.

My next step is actually switching to https with a self signed certificate. But the machine (/raspberry pi) and the app need to be in the same wifi in order to communicate. So actually there is no intermediary in the communication. This again makes me wonder if there is a possibility of a man-in-the-middle attack and if I really need https communication.

So my question is: do I need https here?

Gwag

subjective answer. First, you have to determine what risk your machine is at if someone/something takes control of it. For most consumer applications, the risk inside the home is likely to be low (maybe not - what about an irrigation controller or heater?). So why would anyone want to hack and how likely is it to hack (maybe if your machine is the best seller in the world it could be an interesting target). You might be surprised by how many devices are on the average home wifi - there are at least a few dozen. Also - while most consumer devices don't rely on inbound access (most use websites to bounce controls/commands), there are probably far more inbound (from internet) ports open through firewalls than you might think.

So - I do think there is a lot of opportunity for MITM in normal home wifi. Whether this becomes an issue in early product development - that's up to you.

This SO answer: Is it possible to prevent man-in-the-middle attacks when using self-signed certificates? Might be useful in actual implementation.

Related


How to get files using secure connection (https)

Matthews I want to host images in a secure server (https). My app uses https in all its webpages, so I don't want to have problems with browsers saying my webpages are not secure. I am wondering if it is possible to do this in Google Cloud Storage. Brandon Jab

How to get files using secure connection (https)

Matthews I want to host images in a secure server (https). My app uses https in all its webpages, so I don't want to have problems with browsers saying my webpages are not secure. I am wondering if it is possible to do this in Google Cloud Storage. Brandon Yar

How to get files using secure connection (https)

Matthews I want to host images in a secure server (https). My app uses https in all its webpages, so I don't want to have problems with browsers saying my webpages are not secure. I am wondering if it is possible to do this in Google Cloud Storage. Brandon Yar

Wifi local connection or just unstable connection

249 First published here, on Ubuntu 12.04 (actually on linux) within a week. I only have a problem with my wireless connection at home. In college I can use the wifi without issue, but at home it never connects and stops working locally and/or within 5-10 minu

Wifi local connection or just unstable connection

249 First published here, on Ubuntu 12.04 (actually on Linux) within a week. I only have a problem with my wireless connection at home. In college I can use the wifi without issue, but at home it never connects and stops working locally and/or within 5-10 minu

Wifi local connection or just unstable connection

249 First published here, on Ubuntu 12.04 (actually on linux) within a week. I only have a problem with my wireless connection at home. In college I can use the wifi without issue, but at home it never connects and stops working locally and/or within 5-10 minu

Is HTTPS secure?

Unreal Dragon I'm developing an iPhone App that connects to an https:// link to authenticate the user. From what I understand, all traffic to a server with a 256-bit private key is secure and cannot be captured, so there is no need to encrypt the data again, a

Is HTTPS secure?

Unreal Dragon I'm developing an iPhone App that connects to an https:// link to authenticate the user. From what I understand, all traffic to a server with a 256-bit private key is secure and cannot be captured, so there is no need to encrypt the data again, a

Are HTTPS query strings secure?

John I'm creating a secure web-based API that uses HTTPS; however, if I allow the user to configure it with a query string (including sending a password), will this also be secure, or should I force it to be done via POST ? dr evil Yes. But using GET for sensi

Traefik https is not completely secure

wind blows I try to configure my server with Traefik using a Docker container. I configured Traefik to work and I got the dashboard page. The problem is that I want to have my own GitLab server. I pulled the GitLab docker image and created a docker-compose fil

Are HTTPS query strings secure?

John I'm creating a secure web-based API that uses HTTPS; however, if I allow the user to configure it using a query string (including sending a password), will this also be secure, or should I force it to be done via POST ? dr evil Yes. But using GET for sens