Box discovery

[michielbdejong]

We need to work out how the client discovers the Box.

Terminology:
Box: The box being developed in Project Link
QR: Use a QR-code on a sticker on the Box to tell the client which URL connect to
mDNS: The Box uses mDNS to tell the client its IP address and/or its full URL
HSS: The client checks the TLS certificate against the fingerprint in the trusted URL string
plex: A public DNS zone is used to announce the Box's local IP address
LE: LetsEncrypt is used to register/renew a TLS certificate for the public plex-like domain name
NUPNP: A server on which the Box can publish its local IP address so that the client can discover it
Cordova: A tool for packaging web apps a native apps, with plugins for adding custom functionality that is usually not available in browsers.
client: A smartphone, tablet, laptop, or TV.

Assumptions:

• QR-codes work well on smartphones and tablets, but not on laptops and TVs
• mDNS is supported by major browsers on iOS, OSX and Linux, but not (yet) on Android and Windows
• we prefer a secure solution
• we prefer a local solution (not leaking user data to the cloud)
• we prefer a solution that uses standard mobile browsers (and standard mobile QR-code readers)

[michielbdejong]

See #4, #5, #6.

[dhylands]

mDNS isn't supported by WIndows (out-of-the-box).
http://stackoverflow.com/questions/23624525/standard-mdns-service-on-windows

[michielbdejong]

@dhylands ah thanks! Updated the assumption to 'mDNS is supported by major browsers on iOS, OSX and Linux, but not (yet) on Android and Windows'.

[michielbdejong]

There has not been much discussion on this topic, and all proposals were from me. But there has been some discussion in person, on the mailing list, and on irc about my proposal to use a physical side-channel for establishing a secure connection between box and client without relying on wifi network security, and given the amount of resistance against it, I retracted it as a proposal for this project.

So the question is now: apart from my updated proposal #12 (which does not use QR codes or any other physical side-channel), do people have any other/alternative proposals we can discuss?