I understand what you are saying but first, I’ve already outlined available apps for the desktop which means it’s not restricted to mobile phones and tablets. Please refer to the list of apps that I have linked.
Aah. I didn’t realize that the app could run in a desktop browser. Interesting.
Second, not sure how a user managing his own DNS would be more secure than our DNS. We take every security precaution with our DNS hosting accounts and use CloudFlare for added protection.
The issue is that a users controller/browser could be fooled into downloading malicious versions of the UI elements. SSL (with certificate validation) would prevent this, since the attacker (presumably) wouldn’t have the private key for the server certificate.
Regarding the SSL/TLS support, no Arduino could support this and instead depends on other measures for security. We are looking at cloud access instead of port forwarding in which case we will use AES 128 for communication. In the mean time, you may setup a reverse proxy that adds SSL and even BASIC auth if you wish, as the app does support this.
Does the controller download the UI elements and then send them to the client, or does it just embed links into the HTML it sends to the clients? If it’s the latter, is there a reason that https://ui.opensprinkler.com/js wouldn’t work?
I was actually thinking about going the reverse proxy route, but I wasn’t aware that the “mobile” app supported SSL. (Why would it if the controller itself doesn’t?) That’s really good to know, and it wish that it were stated more prominently (although I have no idea where it should be so stated).
I guess the other option is to go the Rasberry Pi route. Decisions, decisions.
Thanks for the response!