Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Some observations on the final text of the European Digital Identity framework

blog.xot.nl

Post reply on HN
Print view View original

51–60 of 153 posts

Re: Some observations on the final text of the European Digital Identity framework

#51

Post by dataking »

danielheath wrote: post #29
ko27 wrote: post #25

Earlier quoted context omitted.

> This is a transfer of power from a voluntary industry consortium to appointed EU technocrats Or a transfer of power from US-centric companies to actual sovereign bodies. I don't want to live in a cyberpunk world. This sounds good to me. Note that browsers are still allowed to remove them if they are compromised.

Browsers are allowed to ask permission to remove them if they are compromised. They still have to receive that permission before they can do it.

I believe it is well understood by now that users tend to ignore security warnings; anyone serious about computer security will not accept this as a solution. We don't even apply security-critical patches reliably.

Re: Some observations on the final text of the European Digital Identity framework

#52

Post by devman0 »

amluto wrote: post #21
asdffdasasdf wrote: post #2

> We were concerned about the phrasing of Article 45, that lays down a requirement for browsers to recognize any certificate ... So same as today but with less steps? Most govs are already in you browser/OS CA list. And every single government force you to download their own cert and add to your browser at some point. There's no way to add that cert and say "limit this to gov.in only"! after you added that cert it is…

I filed the obvious bug against Firefox ten years ago :( https://bugzilla.mozilla.org/show_bug.cgi?id=953322

Do browsers check the CAA records for a domain if they exist? Seems like that would solve the issue.

Re: Some observations on the final text of the European Digital Identity framework

#53

Post by ThePowerOfFuet »

dariosalvi78 wrote: post #45
nextos wrote: post #44

Earlier quoted context omitted.

Yes, this is a huge problem. In fact, when looking into Swedish jobs, you are usually advised to try to get a personnummer ASAP to make your relocation as smooth as possible. Denmark also has similar problems with their digital ID. Any unusual scenario turns into a nightmare. For instance, I moved abroad during their transition from a codecard to an app, and I lost access to my bank account and all ID-linked services…

an this is why a EU wide system is needed. I hold 3 digital identities (Spain, Italy and Sweden) and, believe me, it's not fun.

At least your Spanish DNIe contains an X.509 certificate you can access via PKCS#11 that Just Works, both for authentication and signature. You can even use it for SSH!

Re: Some observations on the final text of the European Digital Identity framework

#54

Post by devman0 »

sigilis wrote: post #34
Astraco wrote: post #28

Earlier quoted context omitted.

I think they are just certs to identify yourself to EU or national insititutions for procedures (filling taxes and so), like the certs some European countries issue.

The proposed certificate authorities can generate certificates for any entity, not just EU sites and not just new ones. They would have to be treated as valid, per the regulation. Trust is the critical component in the PKI infrastructure. When it’s subverted and you can’t just remove the offending authorities, then it’s not really working properly anymore.

Seems like moving to something like DANE would be a good way forward. Seems like having the site owners tell the public what cert should be expected via DNS with appropriate signatures would obviate the need for CAs. (Yes I realize that this just moves the trust anchor to the DNS root authority, but it does reduce the number of authorities you need to trust).

Re: Some observations on the final text of the European Digital Identity framework

#55

Post by ThePowerOfFuet »

neodypsis wrote: post #19
asdffdasasdf wrote: post #2

> We were concerned about the phrasing of Article 45, that lays down a requirement for browsers to recognize any certificate ... So same as today but with less steps? Most govs are already in you browser/OS CA list. And every single government force you to download their own cert and add to your browser at some point. There's no way to add that cert and say "limit this to gov.in only"! after you added that cert it is…

In my own country, for digital signature purposes, the official Windows installer provided by the government adds the country's Central Bank's CA for any purposes, even for software signatures. If you have a company, they also force you to use their own application for making some annual declarations. That software asks for your OS user password using a home-brew dialog so that it can update itself. If you don't prov…

Sounds like the perfect candidate to run in a VM.

Re: Some observations on the final text of the European Digital Identity framework

#56

Post by SiempreViernes »

dataking wrote: post #49
ko27 wrote: post #25

Earlier quoted context omitted.

> This is a transfer of power from a voluntary industry consortium to appointed EU technocrats Or a transfer of power from US-centric companies to actual sovereign bodies. I don't want to live in a cyberpunk world. This sounds good to me. Note that browsers are still allowed to remove them if they are compromised.

A reasonable concern here is that power is transfered from subject matter experts to technocrats with a poor track record of making technical decisions. Some recent examples of EU tech debacles include Quaero, Galileo, Gaia-X, Ariane 6.

On the other hand, the technocrats are beholden to actual elected officials, instead of the current situation where a group of random people selected by private companies coordinate their work by consensus without much formal structure and the members are beholden to nobody by their company boss.

Re: Some observations on the final text of the European Digital Identity framework

#58

Post by foota »

theonlybutlet wrote: post #12

So basically: Governments are being given authority to create dodgey certificates, Browsers can't take it down if discovered unless they have evidence it's being used and will be harmful, and Browsers need to advise and wait for the requisite approval [of authorities] for when the browser can take it down (i.e. the authorities can decide how long it stays up). Or am I missing something?

I wonder if this would require browsers to allow government certs in place of their own pinned certs (e.g., chrome pins certs for google sites and maybe others I believe, if a non matching cert is used then the connection is rejected).

Re: Some observations on the final text of the European Digital Identity framework

#59

Post by ekr____ »

devman0 wrote: post #52
amluto wrote: post #21

Earlier quoted context omitted.

I filed the obvious bug against Firefox ten years ago :( https://bugzilla.mozilla.org/show_bug.cgi?id=953322

Do browsers check the CAA records for a domain if they exist? Seems like that would solve the issue.

As far as I know, they do not.

Even if they did, it doesn't really address the problem. In order to mount an effective impersonation attack, the attacker needs to either control the network or the DNS. In either case, they will generally be able to remove or change the CAA record; remember that DNSSEC deployment is comparatively rare and browsers do not verify DNSSEC in any case.

Re: Some observations on the final text of the European Digital Identity framework

#60

Post by pezezin »

ThePowerOfFuet wrote: post #53
dariosalvi78 wrote: post #45

Earlier quoted context omitted.

an this is why a EU wide system is needed. I hold 3 digital identities (Spain, Italy and Sweden) and, believe me, it's not fun.

At least your Spanish DNIe contains an X.509 certificate you can access via PKCS#11 that Just Works, both for authentication and signature. You can even use it for SSH!

Can confirm. I just renewed my Spanish DNIe last summer and not only was the whole process super smooth and took only a few minutes, but the certificate works on Linux out of the box! DNIe was crap for many years, but credit where credit is due, it has improved a lot.

On the other hand I also have the Japanese digital ID card (マイナンバーカード), and what a piece of crap. If you ever hear that Japan is the most technologically advanced country in the world: no, it is not.

Post reply on HN