Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla publishes position paper on the EU Digital Identity Framework

blog.mozilla.org

Post reply on HN
Print view View original

11–20 of 161 posts

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#11

Post by indymike »

theplumber wrote: post #5
MR4D wrote: post #3

Authoritarianism raises its head in all sorts of interesting ways. Interesting to see the EU choose the path of Kazakhstan.[0] [0] - https://www.internetsociety.org/news/statements/2019/interne...

A proper online identity framework is long due though. Maybe this is not the proper one but sending copies of my passport, electricity bills and lately selfie recordings as well to "prove my identity" doesn't seem right either.

> A proper online identity framework is long due though.

Due by whom, and for what?

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#12

Post by phicoh »

I wonder why QWACs are less secure than DV.

There is an argument why EV should be treated the same a DV I'm not buying that argument but for the moment let's accept it as true.

However, now Mozilla is arguing that EV is less secure than DV. That seems weird to me.

Currently, browsers have root certificates for lots of countries. I can imagine that for a country it becomes a huge problem if suddenly a major browser decides to reject certificates used by that country's government.

Of course, it would be nice if country certificates could be restricted to country specific resources. Maybe mozilla should push for that.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#13

Post by bogle »

MR4D wrote: post #3

Authoritarianism raises its head in all sorts of interesting ways. Interesting to see the EU choose the path of Kazakhstan.[0] [0] - https://www.internetsociety.org/news/statements/2019/interne...

I don't think QWACs are at all the same as state controlled root certificates. Browsers aren't going to show EV certificates.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#14

Post by toomuchtodo »

indymike wrote: post #11
theplumber wrote: post #5

Earlier quoted context omitted.

A proper online identity framework is long due though. Maybe this is not the proper one but sending copies of my passport, electricity bills and lately selfie recordings as well to "prove my identity" doesn't seem right either.

> A proper online identity framework is long due though. Due by whom, and for what?

For citizens who want efficient, effective access to services that require identity. The need for identity isn’t going away, and a poor implementation doesn’t guard against overreach.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#15

Post by Jwarder »

phicoh wrote: post #12

I wonder why QWACs are less secure than DV. There is an argument why EV should be treated the same a DV I'm not buying that argument but for the moment let's accept it as true. However, now Mozilla is arguing that EV is less secure than DV. That seems weird to me. Currently, browsers have root certificates for lots of countries. I can imagine that for a country it becomes a huge problem if suddenly a major browser de…

I see two issues at play.

Not all European CAs meet browsers' root programs requirements. Forcing everyone to accept those certs weakens all root programs (Mozilla's, Microsoft's, etc).

There is also the concern that special indicators displayed with a certificate can mislead users. A scummy company with an EV cert isn't any more trustworthy than if they had a DV cert, but browsers want to be careful not to imply a fancy logo makes the site any safer.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#16

Post by keddad »

chuckee wrote: post #7

> In a nutshell, the revised Article 45 would force browsers to suspend the ‘root store’ policies that are essential for maintaining trust and security online. [..] At the same time, the types of website certificates that browsers would be forced to accept, namely QWACs Can someone explain where this 'force' comes from? I wasn't aware the EU had such authority to decide how programs on a users private computer must b…

Well, the original document states that "Web-browsers shall ensure support and interoperability with qualified certificates for website authentication referred to in paragraph 1...". I'm not sure, however, what punishment, if any, is there for the browsers that don't comply with that regulation.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#17

Post by wahlis »

furi wrote: post #9
emteycz wrote: post #6

Earlier quoted context omitted.

This EU effort to control is ongoing for many years now, how is it in any way unexpected?

Perhaps I'm out of the loop, but the EU attempting to make it illegal to distribute web browsers that don't include certain features is unexpected (and deeply worrying) to me.

Where do you find the information that it will be illegal?

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#18

Post by dahfizz »

xoa wrote: post #8

This did get posted a few weeks ago at the time it was written but didn't get much traction at that point, yet seems like a reasonably important issue. The EU has done worthy things for issues like privacy, but whatever pluses and minuses of regulating personal and business policy I'm a lot more dubious about government sticking its hand directly into how specific software (like browsers) functions. That seems like a…

I feel similarly about the EU forcing companies to use usb-C as a charging port. I love usb-C, and it is basically a requirement for any electronic I buy. But forcing everyone to use it until the end of time is ridiculous. Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#19

Post by bjelkeman-again »

dahfizz wrote: post #18
xoa wrote: post #8

This did get posted a few weeks ago at the time it was written but didn't get much traction at that point, yet seems like a reasonably important issue. The EU has done worthy things for issues like privacy, but whatever pluses and minuses of regulating personal and business policy I'm a lot more dubious about government sticking its hand directly into how specific software (like browsers) functions. That seems like a…

I feel similarly about the EU forcing companies to use usb-C as a charging port. I love usb-C, and it is basically a requirement for any electronic I buy. But forcing everyone to use it until the end of time is ridiculous. Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.

EU mandated GSM, which was a success, but we aren’t stuck with it still.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#20

Post by furi »

wahlis wrote: post #17
furi wrote: post #9

Earlier quoted context omitted.

Perhaps I'm out of the loop, but the EU attempting to make it illegal to distribute web browsers that don't include certain features is unexpected (and deeply worrying) to me.

Where do you find the information that it will be illegal?

The position paper linked in the article above says:

> This is because through Article 45.2, the legislative proposal, in effect, mandates that browsers automatically include Trust Service Providers (TSPs) in their browser root programs.

I haven't read the law in question but I would take "mandates" to imply that doing the opposite is somehow prohibited by the proposed law.

Post reply on HN