Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform • Hacker News Board

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#11

Post by radicalbyte » Fri, Nov 03, 2023, 1:18 PM UTC

I'm no fan of the existing system of CA - in 2023 we should have certificate pinning for sites with mechanism for checking which certificate hashes are valid for which site (via a distributed ledger or via browser vendors etc).

However this amendment is disgusting.

I was one of the many experts reviewing previous drafts; the timing and content of these changes are absolutely an attempt by security services to break security on the web.

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#12

Post by radicalbyte » Fri, Nov 03, 2023, 1:20 PM UTC

If this goes through without change the browser vendors should implement an UX which allows the user to disable these root certificates; ideally within different contexts.

I also hope that our community produces tools to allow the cert stack on our OSes to be purged of these certificates.

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#13

Post by imranhou » Fri, Nov 03, 2023, 1:21 PM UTC

It would be nice if browsers can require that certificates be co-signed by multiple, mutually distrusting root CAs, such as a hypothetical EU CA whose certificates are only trusted if also signed by an OSSF-backed root CA.

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#14

Post by parski » Fri, Nov 03, 2023, 1:24 PM UTC

throwawaaarrgh wrote: post #6

Wow. Does the EU intend on basically killing their economies? Online commerce is a huge deal and would be heavily impacted if people didn't trust their connections.

I don't think people know what connections are, let alone hold a position on wether to trust them or not.

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#15

Post by EGreg » Fri, Nov 03, 2023, 1:26 PM UTC

radicalbyte wrote: post #12

If this goes through without change the browser vendors should implement an UX which allows the user to disable these root certificates; ideally within different contexts. I also hope that our community produces tools to allow the cert stack on our OSes to be purged of these certificates.

Then they’ll ban that UX. Just like US banned the ability to disclose how much taxes you pay for airline tickets

EDIT: for clarification, they banned disclosing it in initial communications like emails. They can do same for browsers. Apple also successfully banned apps from disclosing links to buying stuff online etc.

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#16

Post by severino » Fri, Nov 03, 2023, 1:26 PM UTC

throwawaaarrgh wrote: post #6

Wow. Does the EU intend on basically killing their economies? Online commerce is a huge deal and would be heavily impacted if people didn't trust their connections.

Why would people worry? We already have mobile phones, televisions, cars, etc., continuously monitoring and sending private information about ourselves and our relatives to external parties that we may don't even know about. This -if comes to be true- would just mean that more parties could have access to our data. But who cares once we are already giving it for free?

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#17

Post by EGreg » Fri, Nov 03, 2023, 1:31 PM UTC

severino wrote: post #16

throwawaaarrgh wrote: post #6

Wow. Does the EU intend on basically killing their economies? Online commerce is a huge deal and would be heavily impacted if people didn't trust their connections.

Why would people worry? We already have mobile phones, televisions, cars, etc., continuously monitoring and sending private information about ourselves and our relatives to external parties that we may don't even know about. This -if comes to be true- would just mean that more parties could have access to our data. But who cares once we are already giving it for free?

We aren’t giving away all the https data for free. Not even close.

Next they will ban other certs other than their own. Like Dubai did or Monaco.

https://community.qbix.com/t/the-coming-war-on-end-to-end-en...

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#18

Post by adolph » Fri, Nov 03, 2023, 1:33 PM UTC

tansan wrote: post #9

Does this mean they would essentially be able to MITM attack all traffic?

At a high level yes. Here is some information about Kazakhstan's effort:

https://security.stackexchange.com/questions/189647/what-hap...

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#19

Post by motohagiography » Fri, Nov 03, 2023, 1:33 PM UTC

I had a comment, but I think the tide has passed the point where there is any value or wisdom in speaking against the intelligence agencies.

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#20

Post by zajio1am » Fri, Nov 03, 2023, 1:34 PM UTC

radicalbyte wrote: post #11

I'm no fan of the existing system of CA - in 2023 we should have certificate pinning for sites with mechanism for checking which certificate hashes are valid for which site (via a distributed ledger or via browser vendors etc). However this amendment is disgusting. I was one of the many experts reviewing previous drafts; the timing and content of these changes are absolutely an attempt by security services to break s…

We already have such system: DANE + DNSSEC. Unfortunately browsers vendors do not implement it.