A Warning to Users of NurseryCam
> To make matters worse, the connection to the DVR is using HTTP, not HTTPS.  It is unencrypted, allowing someone to eavesdrop on the video feed, username, and password.<p>What is the proper way to provide certificates to devices with embedded servers?<p>- Generate a self-signed certificate with the appropriate IP address and train users to bypass the browser's scary warnings?<p>- Buy certificates for every deployed device.  Make each device download a new certificate when its current one expires.  Set up dynamic DNS so the user can reach the device at a URL that matches the certificate.<p>- Make the device use an ACME server to provision its certificate.  The device must be publicly accessible so the ACME server can reach it.<p>- Proxy all device connections through a central server.  This could be expensive for high-bandwidth uses like streaming video.<p>All of these options are poor.  Why has nobody solved this problem?  Is it because the powerful browser makers (first Microsoft and now Google) prefer lucrative centralized technology?  Google will make a lot less money when everyone can easily run their own server to do shared docs and messaging.  Or is it because IoT companies prefer centralization so they can sell subscriptions to users and gather user behavior data?  Or is it just that nobody has put in enough effort to solve it yet?