Let’s see.. I assume the warning serves two purposes:
1. You may be talking to someone other than you think. This only makes sense with registered domain names.
2. Your data can be eavesdropped or modified by someone in the middle. This would be quite rare within a LAN. Encryption itself might make sense sometimes but standard TLS is a really poor fit because there is no proper CA for the domain names.
The main issue though is people don’t want IP addresses, they want names. If a special domain (like .home or .local) will only ever query local DNS servers returning local IP addrs, it would be roughly as safe as using IP addresses directly(?).
In either case, when the user intentionally wants to speak over LAN (either IP or known home domain) the warning is unhelpful. For instance, configuring a router.
> Your data can be eavesdropped or modified by someone in the middle. This would be quite rare within a LAN
Literally every single public wifi network, which is a significant percentage of all internet traffic (including basically everyone working from a wework for example), is vulnerable to eavesdropping/mitm
That’s true and should have been phrased differently. But names and addresses within a public LAN rarely have meaning to the customers, I guess. Btw, can an adversary on such a lan typically spoof source IPs and eavesdrop on packets between other nodes? I realize I know very little about WiFi.
> Btw, can an adversary on such a lan typically spoof source IPs and eavesdrop on packets between other nodes?
Yes, or no. It's possible, and with the right lan equipment trivially easy to prevent this, however you can't tell from the outside if the network is set up this way or not so you have to assume it isn't.
Thanks for the info. I remember that 10-15y ago there were these snoopers you could install (perhaps a Firefox extension - I remember it was very easy) to steal session cookies from Facebook users in the same public WiFi’s. After that SSL by default – previously deemed “too expensive” for Facebook – was deployed rapidly, never to be mentioned again. So it sounds like WiFi too has improved then.
1. You may be talking to someone other than you think. This only makes sense with registered domain names.
2. Your data can be eavesdropped or modified by someone in the middle. This would be quite rare within a LAN. Encryption itself might make sense sometimes but standard TLS is a really poor fit because there is no proper CA for the domain names.
The main issue though is people don’t want IP addresses, they want names. If a special domain (like .home or .local) will only ever query local DNS servers returning local IP addrs, it would be roughly as safe as using IP addresses directly(?).
In either case, when the user intentionally wants to speak over LAN (either IP or known home domain) the warning is unhelpful. For instance, configuring a router.