SystemOverlord

What, really? Your source is "some Czech guy?" I mean maybe it's true and maybe it's not, but at the same time an article that presumably doesn't link the original article because they don't want people just going directly there and which might be quoting the most lunatic fringe conspiracy theory is not worth taking particularly seriously. A five-minute search tends to indicate that this guy: https://systemoverlord.com/blog/2015/08/16/so-is-windows-10-spying-on-… hasn't been able to reproduce the traffic analysis on casual inspection. Edit: Here's what I believe to be the original source of the claim: http://aeronet.cz/news/analyza-windows-10-ve-svem-principu-jde-o-pouhy… And the translation: http://localghost.org/posts/a-traffic-analysis-of-windows-10

Here's an approach I've used before successfully. It's not perfect but it's better than nothing. 1. Create your own root Certificate Authority. 2. Create a script using your favorite language and libraries that will create a new certificate for each device something along the lines of "myiotdevice-AABBCCDD.local". The AABBCCDD needs to be some sort of serialized number that's assigned during manufacturing and won't be repeated between devices. 3. Add to your product support for ZeroConf/mDNS/DNS Service Discovery and advertise an https web server at myiotdevice-AABBCCDD.local. 4. Provide instructions to your users on how to download and install the certificate for your root CA (this only needs to be done once). 5. Print the name "myiotdevice-AABBCCDD.local" on the device and instruct users to type that in to a browser's address bar. I'm doing this from memory so I may have missed an intricacy here or there (like DNS SD is a weird story on Windows 10) but this approach should basically work well enough. EDIT - good commentary in replies about the dangers of the CA being compromised. Also, good mention of X.509 Name Constraints and how they can be used to mitigate that danger somewhat. More info here: https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-const…

Name constraints https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-const…

does iphone support name constraints on CA certificates? (https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-const…

Thank you! I'll try that with my next CA, which I think is actually expired but it seems not all apps care about that :). If "relatively modern" covers browsers and email clients, that's pretty good already. edit: here's the reference: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 and here's a practical example: https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-const…

I have a CA for home services and was worried about this, so I use name constraints to limit the domains that it is allowed to sign certs for. This blog (not mine) goes into how to do it: https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-const…

It does; they're called "name constraints". This page https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-const… claims they're supported by "all current browsers". x509 extensions can be marked "critical" or not. If the name constraint was marked critical, then AIUI old software should (in theory) fail secure, and reject everything signed by the CA.

Did anyone tried to MITM a Windows 10 install e.g. with adding his own cert to the certstore? Edit: Found this: https://systemoverlord.com/blog/so-is-windows-10-spying-on-you/

Here's a nice analysis by a well-known security researcher in response to that article. He could not confirm the results. https://systemoverlord.com/blog/2015/08/16/so-is-windows-10-spying-on-…

This advice operates from a mindset that both privacy and security risks are binary. They are not+. A third-party app that gives access to X,Y, and Z permissions is a larger security risk than an equivalent app that only has permissions for X. So if an app only needs X in its current version but requests Y and Z, then it is introducing unnecessary risk. + See e.g. https://systemoverlord.com/blog/2014/09/05/security-not-a-binary-state…