Hector Martin

Also "Android 6.0 devices are totally pwned!" (more like: they're actually more secure than older devices)

PSA: If you use WiFi mostly to access the Internet and don't have openly accessible devices in your LAN, you are FINE. Keep calm and WiFi on

what does “openly accessible devices” mean in this case?

Like a NAS or something, especially with no authentication. An actual server you don't want others to have access to, and without TLS.

So what's the best practice nowadays for secure authentication to a home router, printer, or NAS?

HTTPS with user/pass (2FA optional). I find I've just been throwing random stuff on the internet behind nginx with Let's Encrypt.

My policy is basically, if it's inside HTTPS with a real cert and HTTP Basic auth (gated at nginx level), no reason not to put it online.

Agreed in principle, but CAB BR says only domain owners qualify for "a real cert". Should all home LAN operators expect to have to buy one?