Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla publishes position paper on the EU Digital Identity Framework

blog.mozilla.org

Post reply on HN
Print view View original

81–90 of 161 posts

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#81

Post by barrkel »

dahfizz wrote: post #71
input_sh wrote: post #60

Earlier quoted context omitted.

Almost as if they've seen a shortcoming with signing just a memorandum of understanding and took it a step further this time around. > To address the challenges for consumers as well as the environment, the Commission has supported a common charging solution for mobile phones and similar electronic devices since 2009. The Commission first facilitated a voluntary agreement by the industry in 2009 that resulted in the…

> Almost as if they've seen a shortcoming A shortcoming for _their_ goals. Their goals are at odds with what is best for us. It is a good thing the micro-b MoU did not have any teeth.

Do you have so short a memory about all the proprietary connectors we needed to suffer before?

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#82

Post by Jensson »

plandis wrote: post #39
Shadonototra wrote: post #25

Earlier quoted context omitted.

They are protecting their interest Why should a foreign country have control over my interests? Why should Mozilla DECIDE what I should and shouldn't trust? I am very glad that the public opinion decided to not trust Firefox at all (3% market share today)

Mozilla doesn’t decide that. Mozilla is an option _you_ can chose to use. It’s one of N options.

But all large browsers happens to be American. It makes sense that EU wants to regulate this rather than hand over all decisions related to trust to USA.

For example, imagine if all big browsers everyone uses where made in China, and mostly just trusted Chinese CA. Do you think that would be a problem? Do you think the rest of the world would just let that happen instead of starting to regulate it? That is the situation EU faces right now with American browsers.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#83

Post by admax88qqq »

input_sh wrote: post #74
dahfizz wrote: post #71

Earlier quoted context omitted.

> Almost as if they've seen a shortcoming A shortcoming for _their_ goals. Their goals are at odds with what is best for us. It is a good thing the micro-b MoU did not have any teeth.

I can't speak on behalf of anyone but myself, but when that goal is less e-waste, their goal sure does align with mine, even if it may take me 20 extra minutes to charge my devices when something better than type C comes around. If I can charge my laptop with it, it's surely good enough for charging devices with a much smaller battery at least for the next decade or so.

Are chargers really a significant source of e-waste?

E-waste is a direct consequence of technology progress. We're not still all using 486s. Technology advances, people want that new stuff.

I would wager charging ports are insignificant.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#84

Post by Jensson »

logifail wrote: post #55
toomuchtodo wrote: post #14

Earlier quoted context omitted.

For citizens who want efficient, effective access to services that require identity. The need for identity isn’t going away, and a poor implementation doesn’t guard against overreach.

> The need for identity isn’t going away [..] My identity is just fine, but thanks for your concern :) I can walk into my local bank branch and ask to either pay in or withdraw money and they don't ask for any kind of ID(!), or my account number, becuase they actually know me :) They even tend to say "Hello $firstname" when I walk in, even if I only called in to use the ATM. Amazing how good ol'fashioned _offline_ id…

Identify theft happens because you have weak online identity protections. Strong e-id systems as can be found in many parts of Europe almost completely fixes that. Where I live nobody is afraid of identity theft since you can't do anything just because you know someone's names, addresses or numbers.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#85

Post by argomo »

ostenning wrote: post #44
theplumber wrote: post #5

Earlier quoted context omitted.

A proper online identity framework is long due though. Maybe this is not the proper one but sending copies of my passport, electricity bills and lately selfie recordings as well to "prove my identity" doesn't seem right either.

I guess that depends what you expect from society and government. Do you expect that everything runs like an extremely powerful well oiled machine, where 100% interoperability likely means complete surveillance? A seemingly technocratic dystopian reality where every impulse is quantified and catalogued? I think its naive to believe that governments don't want more money, power and control over its citizens and govern…

Question: how will the free/liberal society (plagued by polarization, etc) fare against the dystopian ones?

In the past we've been able to out-innovate and maintain moral leadership thru a fictional aspiration to democratic norms. Now state actors can run finely targeted propaganda campaigns and measure our engagement with them in real time while using extensive censorship measures to prevent us from doing the same to their populations.

None of this invalidates your point, but the tables have been tilted and abstract discussions of freedom tend to avoid wrestling with the geopolitical ramifications.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#86

Post by floatboth »

logifail wrote: post #51
dahfizz wrote: post #32

Earlier quoted context omitted.

We aren't stuck with _just_ gsm, but all phones still have to carry support for 2g. The analogous scenario is a phone with 2 charging ports. The legacy usb-c alongside the newer port you would actually want/use.

> [..] but all phones still have to carry support for 2g. Q: Do network operators/SIM card (re)sellers still have to support 2G, or just the phone manufacturers?

Not sure how it is in the EU specifically but many new networks around the world do not have 2G (Jio in India is (in)famously 4G-only, Tele2 in Moscow is 3G+4G)

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#87

Post by Jensson »

denton-scratch wrote: post #70
sleevi wrote: post #56

Earlier quoted context omitted.

The draft revisions actually propose such authentication to be mandatory to implement for service providers if their users would like to use it. That is, it specifically targets websites (particularly Very Large Online Platforms) that they MUST accept such ID in lieu of an email or password, at the user’s request. This was part of the original motivation for the revisions, to target “Sign in with Facebook” or “Sign i…

So $VLOP is compelled to accept QWAC user-certificates, if one user requests it? And QWAC user-certificates are issued by TSPs whose CA cert must appear in the root-store unconditionally? That means there is nothing preventing $TSP from forging my certificate, and giving it to criminals/government-agents, and nothing to keep the TSP in line, because the single audit constraint is "Keep the Minister satisfied". I pers…

The "unreliable CA" you are talking about here happens to be banks and similar. Do you trust that your bank doesn't just steal your money? Yes, you basically can't function in modern society if you don't. These e-id's just piggybacks on that trust to also work on online sign-ins. Most people worry more about their bank account being compromised than their github, so if these CA's (ie banks) starts to abuse their position we would have way bigger troubles than someone stealing your github accounts.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#88

Post by taxyz23 »

Jensson wrote: post #72
dahfizz wrote: post #18

Earlier quoted context omitted.

I feel similarly about the EU forcing companies to use usb-C as a charging port. I love usb-C, and it is basically a requirement for any electronic I buy. But forcing everyone to use it until the end of time is ridiculous. Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.

> Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C. But they didn't. These people aren't that dumb, they told companies to settle on a standard, and now that we have a good standard that basically everyone follows they want to make a law to ensure everybody follows it. Bringing up a scenario where they did the right thing and argue "just imagine i…

If basically everyone follows, then why require it and shut off or slow down future innovation? Regulations like this are nearly always obsolete by the time they are implemented.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#89

Post by Jwarder »

Jensson wrote: post #68
Jwarder wrote: post #15

Earlier quoted context omitted.

I see two issues at play. Not all European CAs meet browsers' root programs requirements. Forcing everyone to accept those certs weakens all root programs (Mozilla's, Microsoft's, etc). There is also the concern that special indicators displayed with a certificate can mislead users. A scummy company with an EV cert isn't any more trustworthy than if they had a DV cert, but browsers want to be careful not to imply a f…

> Not all European CAs meet browsers' root programs requirements. That sounds like a huge problem, why should EU trust that USA handles trust certificates well? Of course they would want to regulate this instead of leaving that extremely large security hole open, letting USA alone decide what counts as secure or not is not in EU's interests.

I think it is a legitimate concern in both directions. Who should users trust more: Mozilla or their local government? Some countries have tried to use local PKI to spy on citizens. Mozilla has taken steps in the past to prevent abuse. On the other hand, can Mozilla accept an Iranian CA even if they can match the root program's requirements?

Amusingly, Mozilla rejected the US government's request to add the federal PKI to the root store.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#90

Post by mariusor »

dahfizz wrote: post #18
xoa wrote: post #8

This did get posted a few weeks ago at the time it was written but didn't get much traction at that point, yet seems like a reasonably important issue. The EU has done worthy things for issues like privacy, but whatever pluses and minuses of regulating personal and business policy I'm a lot more dubious about government sticking its hand directly into how specific software (like browsers) functions. That seems like a…

I feel similarly about the EU forcing companies to use usb-C as a charging port. I love usb-C, and it is basically a requirement for any electronic I buy. But forcing everyone to use it until the end of time is ridiculous. Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.

What makes you believe it's until the end of time? They did do it with micro USB also. From what I can see the mandate changes with the times, so if everything evolves I would assume that they'll update their requirements.
Post reply on HN