Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla publishes position paper on the EU Digital Identity Framework

blog.mozilla.org

Post reply on HN
Print view View original

151–160 of 161 posts

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#151

Post by raxxorrax »

keddad wrote: post #16
chuckee wrote: post #7

> In a nutshell, the revised Article 45 would force browsers to suspend the ‘root store’ policies that are essential for maintaining trust and security online. [..] At the same time, the types of website certificates that browsers would be forced to accept, namely QWACs Can someone explain where this 'force' comes from? I wasn't aware the EU had such authority to decide how programs on a users private computer must b…

Well, the original document states that "Web-browsers shall ensure support and interoperability with qualified certificates for website authentication referred to in paragraph 1...". I'm not sure, however, what punishment, if any, is there for the browsers that don't comply with that regulation.

Not the browsers will be reprimanded. That would be webservices like Youtube that only allows browsers providing a certified ID to let users look at the more controversial cat pictures. It is an extremely transparent power grab.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#152

Post by raxxorrax »

Shadonototra wrote: post #23

Why is it ok for an american company to collude with foreign politics? Can't they focus on their broken system first?

As someone from Europe I am thankful for any resistance to such plans and many laws implemented by the EU are written by foreign companies. Companies like central administrations, far easier to lobby against compared to citizens that must carry themselves through countless more or less democratic institutions.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#153

Post by raxxorrax »

Jensson wrote: post #109
denton-scratch wrote: post #64

It's ultimately my decision which certificates I will trust. I can choose to trust just one certificate, and ignore the Mozilla root store, or I can use Mozilla's root store, and modify it. These are my decisions, not Mozzilla's. So this proposed regulation mandates that my browser must support QWAC, and include TSP roots? Does that mean that browsers MUST deprive me of the ability to control my root store? Would I b…

This is all the initial recommendations says about browsers and certificates, there is nothing about preventing browsers from allowing the users to configure this, just to have them support it (and most of this is already supported by browsers, this is mostly just a recommendation to force all browsers to implement site security): > To that end, web-browsers should ensure support and interoperability with Qualified c…

"It is just this" is something we hear very often when it is about user surveillance.

And then mandate sites use it for any age restricted content? Comes a year later. And everything against a backdrop that some EU members want encryption backdoors. Meanwhile we have safe e-commerce for years. No, thank you.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#154

Post by diffeomorphism »

dahfizz wrote: post #18
xoa wrote: post #8

This did get posted a few weeks ago at the time it was written but didn't get much traction at that point, yet seems like a reasonably important issue. The EU has done worthy things for issues like privacy, but whatever pluses and minuses of regulating personal and business policy I'm a lot more dubious about government sticking its hand directly into how specific software (like browsers) functions. That seems like a…

I feel similarly about the EU forcing companies to use usb-C as a charging port. I love usb-C, and it is basically a requirement for any electronic I buy. But forcing everyone to use it until the end of time is ridiculous. Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.

That is a really, really obvious problem, so why do you think you are the first person on the planet who ever thought of it? And that nobody addressed it?

> But forcing everyone to use it until the end of time is ridiculous.

Correct, it is ridiculous you think anyone did that.

> Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.

They did. We do have usb-c.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#155

Post by indymike »

toomuchtodo wrote: post #14
indymike wrote: post #11

Earlier quoted context omitted.

> A proper online identity framework is long due though. Due by whom, and for what?

For citizens who want efficient, effective access to services that require identity. The need for identity isn’t going away, and a poor implementation doesn’t guard against overreach.

> For citizens who want efficient, effective access to services that require identity.

There are some citizens who want this. Not all.

> a poor implementation doesn’t guard against overreach.

A good implementation enables overreach as in, "Please confiscate everything belonging to John Q. Public." An effective identity enables government overreach.

This cure is worse than the disease.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#156

Post by indymike »

nucleardog wrote: post #69
logifail wrote: post #55

Earlier quoted context omitted.

> The need for identity isn’t going away [..] My identity is just fine, but thanks for your concern :) I can walk into my local bank branch and ask to either pay in or withdraw money and they don't ask for any kind of ID(!), or my account number, becuase they actually know me :) They even tend to say "Hello $firstname" when I walk in, even if I only called in to use the ATM. Amazing how good ol'fashioned _offline_ id…

Why would someone try your local branch instead of any one of their 200 convenient nation-wide locations that all have access to your money and don’t know what you look like? Personal trust as a foundation for identity became an untenable option as soon as the modern age arrived and our world expanded beyond our immediate geographic area.

> Personal trust as a foundation for identity

Eventually every system boils down to personal trust, from the doctor that certifies you were born, to the person looking at the computer screen in a licensing office who is deciding if she is going to issue the license. There is no escaping this.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#157

Post by Ygg2 »

kergonath wrote: post #134
Ygg2 wrote: post #93

Earlier quoted context omitted.

Hey on my Android, I'm happy to reuse my old chargers. It would be another thing if I was on Apple ecosystem.

All the Apple chargers are compatible, and have been for quite a long time. They’ve had a standard USB-A port since at least 2004, and they now have a standard USB-C port. The only reason to get a new charger is if you need more power, but that’s exactly the same situation as with Android. Where did you get the idea that you had to get new chargers?

Isn't Apple on Lightning port? Still. All Androids work fine on USB-C and Apple is the outlier.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#158

Post by Jwarder »

xorcist wrote: post #131
Jwarder wrote: post #89

Earlier quoted context omitted.

I think it is a legitimate concern in both directions. Who should users trust more: Mozilla or their local government? Some countries have tried to use local PKI to spy on citizens. Mozilla has taken steps in the past to prevent abuse. On the other hand, can Mozilla accept an Iranian CA even if they can match the root program's requirements? Amusingly, Mozilla rejected the US government's request to add the federal P…

> Who should users trust more: Mozilla or their local government? Is that really a question to be taken seriously? One is a private organization, completely unaccounted for and in a foreign jurisdiction, who sets their own rules and follows up on themselves. The other is accountable and audited by independent auditors in a system which upholds separation of power and keeps independent media? (Just to clarify: Neither…

When it comes to international relations I would depend on (not exactly trust, but close enough) my government more than Mozilla. When it comes to browser implementation topics I trust Mozilla more than any government.

There is nothing intrinsic to any system of government that would make any of them good at solving technical issues on their own.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#159

Post by the_greyd »

tasogare wrote: post #126
the_greyd wrote: post #111

Earlier quoted context omitted.

You make a good point. In a state of pandemic, the population IS in some sense similar to livestock, bodies to be managed, since the virus has weaponized our bodies. Wouldn't you say?

The common method to deal with avian influenza is killing all the livestock when one case is detected. Your comparison is scary and uncanny, but well aligned with how violent the pandemic has been handled by various governments.

Overall I like yuval noah harrari's point about our systems, that liberal democracies and free market are based on the assumption that we have rational individuals making decisions in their self-interest. Which is not true at all, in today's day and age where misinformation and propaganda run rampant. You cannot rely on individual judgement to get us out of a pandemic. Same can be stated about climate change. I would say it's more alarming with climate change, since the consequences of our actions are stretched out in the far future (atleast when compared to covid). How the heck are we going to get people/companies/govt to get in line with what's needed for the survival of our species?

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#160

Post by samus »

chii wrote: post #141
cortesoft wrote: post #140

Earlier quoted context omitted.

It is the standard now, but should it be the standard forever? What happens when we want better features as new tech is invented?

> What happens when we want better features as new tech is invented? The new tech would prove itself, somehow, and then the standard changed over after there's evidence that the new tech improves more than the cost of the change!

Dropping a Memorandum of Understanding is almost for free. Putting a law out of commission (pun not intended) is a completely different story!
Post reply on HN