Live data from Hacker News

Mozilla publishes position paper on the EU Digital Identity Framework

blog.mozilla.org

51–60 of 161 posts

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#51
post #32

Earlier quoted context omitted.

EU mandated GSM, which was a success, but we aren’t stuck with it still.

We aren't stuck with _just_ gsm, but all phones still have to carry support for 2g. The analogous scenario is a phone with 2 charging ports. The legacy usb-c alongside the newer port you would actually want/use.

> [..] but all phones still have to carry support for 2g.

Q: Do network operators/SIM card (re)sellers still have to support 2G, or just the phone manufacturers?

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#52
post #3

Authoritarianism raises its head in all sorts of interesting ways. Interesting to see the EU choose the path of Kazakhstan.[0] [0] - https://www.internetsociety.org/news/statements/2019/interne...

A proper online identity framework is long due though. Maybe this is not the proper one but sending copies of my passport, electricity bills and lately selfie recordings as well to "prove my identity" doesn't seem right either.

> A proper online identity framework is long due though [..]

You're entitled to your opinion but for me, it's a firm "No, thanks".

I feel considerably more comfortable* carrying a paper document which proves my vaccination/negative test than I do using any kind of government-approved app on my phone.

* that's putting it mildly

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#53

Is the draft of the revision available anywhere? I don't see a link anywhere in the position paper. Article 45 in the current regulation[0] says nothing about browsers. I am curious about the exact language that would force Firefox support the technology and include the TSPs in their root store. [0] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=COM%3A20...

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#54
post #32

Earlier quoted context omitted.

EU mandated GSM, which was a success, but we aren’t stuck with it still.

We aren't stuck with _just_ gsm, but all phones still have to carry support for 2g. The analogous scenario is a phone with 2 charging ports. The legacy usb-c alongside the newer port you would actually want/use.

GSM aka 2G is kept as fallback for dumb terminals - it's rather 3G which was (is) sunsetted. I think keeping it is actually a sensible decision.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#55

Earlier quoted context omitted.

> A proper online identity framework is long due though. Due by whom, and for what?

For citizens who want efficient, effective access to services that require identity. The need for identity isn’t going away, and a poor implementation doesn’t guard against overreach.

> The need for identity isn’t going away [..]

My identity is just fine, but thanks for your concern :)

I can walk into my local bank branch and ask to either pay in or withdraw money and they don't ask for any kind of ID(!), or my account number, becuase they actually know me :) They even tend to say "Hello $firstname" when I walk in, even if I only called in to use the ATM.

Amazing how good ol'fashioned _offline_ identity can actually be secure.

Try walking into my local branch with faked ID of me and attempting to withdraw funds from my account.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#56
post #26

Earlier quoted context omitted.

A proper online identity framework is long due though. Maybe this is not the proper one but sending copies of my passport, electricity bills and lately selfie recordings as well to "prove my identity" doesn't seem right either.

When this becomes widespread then you can expect to have to authenticate this way everywhere. Want to make a Twitter account? Please authenticate with your government ID. Facebook? Of course. Video games? You bet. South Korea already has these retirements for (some of) their video games.

The draft revisions actually propose such authentication to be mandatory to implement for service providers if their users would like to use it.

That is, it specifically targets websites (particularly Very Large Online Platforms) that they MUST accept such ID in lieu of an email or password, at the user’s request. This was part of the original motivation for the revisions, to target “Sign in with Facebook” or “Sign in with Google” and require such sites also offer a “Login with EU” option.

Source: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=COM%3A20...

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#57
post #18

Earlier quoted context omitted.

I feel similarly about the EU forcing companies to use usb-C as a charging port. I love usb-C, and it is basically a requirement for any electronic I buy. But forcing everyone to use it until the end of time is ridiculous. Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.

> Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C. They did, you don't have to imagine it. In 2009 they've signed a memorandum of understanding with 14 phone companies, which is why micro-B was the standard before type C. Apple was within those that signed it, and used a loophole in the text to ship a lightning-to-micro-B adapter instead. Around…

A Memorandum of Understanding is a far cry from the legislation they are trying to push through. A MoU is not legally binding. From your link:

> The recent 582-40 parliamentary vote in favor of a common charging standard came about because the European Commission's previous approach of merely "encouraging" tech companies to develop a standardized solution "fell short of the co-legislators' objectives," according to a briefing on the European Parliament website.

The first phones with USB-C came out in 2015. If this MoU was instead binding legislation, those USB-C phones never would not have been allowed.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#58
post #32

Earlier quoted context omitted.

We aren't stuck with _just_ gsm, but all phones still have to carry support for 2g. The analogous scenario is a phone with 2 charging ports. The legacy usb-c alongside the newer port you would actually want/use.

> [..] but all phones still have to carry support for 2g. Q: Do network operators/SIM card (re)sellers still have to support 2G, or just the phone manufacturers?

The sim/operator is irrelevant for emergency calls, and the motivation behind keeping 2G is better signal reach for emergency calls. So I guess even if you wouldn't be able to call your friends from the top of the mountain, you could successfully dial or sms to 112 (if there's a distant mast somewhere in sight with a signal to camp on).

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#59
post #33
post #15

Earlier quoted context omitted.

I see two issues at play. Not all European CAs meet browsers' root programs requirements. Forcing everyone to accept those certs weakens all root programs (Mozilla's, Microsoft's, etc). There is also the concern that special indicators displayed with a certificate can mislead users. A scummy company with an EV cert isn't any more trustworthy than if they had a DV cert, but browsers want to be careful not to imply a f…

I doubt there is any text that browsers have to enable those certs by default outside the EU. It could weaken protection for people in the EU, but then the way forward is to make requirements for root certs mandatory in the EU. Maybe I missed it, but did the document require special UI elements for EU certs?

Yes. It requires the EU Trustmark, a logo designed through a secondary-school competition, to be displayed with certain colors and sizing, as directed through Implementing Acts (which have the force of law, but decided at the Commission level).

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#60
post #57

Earlier quoted context omitted.

> Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C. They did, you don't have to imagine it. In 2009 they've signed a memorandum of understanding with 14 phone companies, which is why micro-B was the standard before type C. Apple was within those that signed it, and used a loophole in the text to ship a lightning-to-micro-B adapter instead. Around…

A Memorandum of Understanding is a far cry from the legislation they are trying to push through. A MoU is not legally binding. From your link: > The recent 582-40 parliamentary vote in favor of a common charging standard came about because the European Commission's previous approach of merely "encouraging" tech companies to develop a standardized solution "fell short of the co-legislators' objectives," according to a…

Almost as if they've seen a shortcoming with signing just a memorandum of understanding and took it a step further this time around.

> To address the challenges for consumers as well as the environment, the Commission has supported a common charging solution for mobile phones and similar electronic devices since 2009. The Commission first facilitated a voluntary agreement by the industry in 2009 that resulted in the adoption of the first Memorandum of Understanding (MoU) and led to reducing the number of existing charging solutions for mobile phones on the market from 30 to 3. Following the Memorandum's expiration in 2014, a new proposal by industry presented in March 2018 was not considered satisfactory in delivering a common charging solution or meeting the need for improved consumer convenience and e-waste reduction.

https://ec.europa.eu/commission/presscorner/detail/en/ip_21_...

Post reply on HN