Earlier quoted context omitted.
We're talking about normal browsing, not webapps performing their encryption
Webapps are also vulnerable because the Javascript can be manipulated in a MitM attack. The only way around this would be a "real" app.
True
Last Chance to fix eIDAS: Secret EU law threatens Internet security
121–130 of 314 posts
Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security
#122For anyone who’s about to say that surveillance isn’t the point of this legislation: it definitely is; we very recently saw Germany trying to MITM jabber.ru users[1], having a CA that can be asked to issue any certificate is definitely something that’d be used for surveillance purposes. [1] https://notes.valdikss.org.ru/jabber.ru-mitm/
A proper solution for MitM is mandatory independent certificate transparency, not outright denial of national CAs support in browsers. A German National CA should not be able to issue certificates for .ru in the first place and having a clear record of misbehavior in CT is probably not something operators of such CA would like to have even when pressured by intelligence agencies.
Browsers should get their shit together and add proper support of domain-limited CAs and add optional whitelisting of CAs for given websites.
Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security
#123Earlier quoted context omitted.
Probably not really. The EU itself (at the Brussels level) doesn't have much of an intelligence apparatus. One exists but it's small and weak compared to the likes of the NSA. The most capable was GCHQ but of course that's no longer a part of the EU. The EU likes passing internet related legislation because of: 1. The politics of it. It involves the raw exercise of power over people who are easily bullied and that th…
It’s intriguing to observe this phenomena on HN where any posts critical of the EU will get downvoted, even though it is natural for any country or block to try various means to show or enforce its power. And before someone says otherwise, I’ve seen this playing out hundreds of times.
Eurosceptics aren't welcome here and will usually give up rather than burn karma and get throttled.
If you spend time in central Europe you'll see why this occurs. Some people have incorporated the EU institutions into their personal identity. People will call themselves European Citizens although the EU doesn't grant citizenship. Businesses will be called Euro-this or Euro-that for no obvious reason. You can catch the Eurobus to go ride the rollercoasters at the Europa Park then meet their famous mascot Ed Euromouse. This stuff is everywhere.
And in some ways, it is understandable. The 20th century was wracked by wars between different European empires or countries. The assumption at the core of this movement is that if everyone has the same social identity and is ruled by the same government, then everyone will hold hands and there will be peace on Earth. Or at least that bit of it.
But you can't force unity on people. It has to develop naturally, through shared experiences and cultures. Unfortunately the vision is so enticing that the political and credentialed classes in these countries don't want to wait, and so attempt to enforce it from the top down via schemes that eliminate democracy in favor of power transfers towards the Right Sort Of People, the type who "get it" and who can then rule unchecked without needing to answer to electorates. This is deeply corrupting, but because it's an identity issue when this is pointed out people feel their personal identity and whole progress story is under attack.
Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security
#124Candid question : if this is european legislation, how browser editor would handle this regional specific requirement ? Provide several flavor of their browser ? I doubt people and companies from outside europe would agree to use a european flavored version of their browser.
Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security
#125Ignorant question: what happens if Mozilla or Brave or whoever says fuck that, we're not complying? What's the enforcement mechanism for non-EU-based devs publishing FOSS freely on the global internet?
The enforcement mechanism is to warn and then ban non-compliant. There are just too few playeds in the field here.
It would take only two major browser development companies to make the world 99% compliant. And the rest is statistical error no matter how safe and secure they are.
Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security
#126Just adding a perspective (not necessarily mine, I'm still on the fence) supporting this legislation from a tech-literate person in the EU. The digital administration in my country has made my life so much easier. We all have mandatory ID cards since decades ago, but now they have a chip with some certs for auth, signing, etc. I can check my taxes, fill government forms, see any traffic tickets, sign official documen…
This isn't adding a few CAs s your browser trusts the tax website. This appears to be replacing all of them so the eu can see the contents of all traffic that is proxied in and out of the country. None of that seems likely to work for actual bad people.
Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security
#127Just adding a perspective (not necessarily mine, I'm still on the fence) supporting this legislation from a tech-literate person in the EU. The digital administration in my country has made my life so much easier. We all have mandatory ID cards since decades ago, but now they have a chip with some certs for auth, signing, etc. I can check my taxes, fill government forms, see any traffic tickets, sign official documen…
You should read the letter, it's worse than that. It makes these gov CA's unrejectable, along with providing a means of tracking your activity. Essentially, it's like giving your least trusted eu country access to your browsing history and some of your decrypted traffic.
They could have reduced scope, but looking at effects perhaps that's not what they actual want.
Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security
#128Earlier quoted context omitted.
It is a digital certificate standard. Browser certificates is only a tiny part of it, that wasn't why it was made. Having a standard for digital certificates is a good thing, it makes it easy to switch document signer provider etc since they all are forced to implement the same interface.
>it makes it easy to switch document signer provider etc since they all are forced to implement the same interface. eIDAS was introduced in 2016. Now 7 years later there still isn't a API specification for interoperability (there are drawings though https://blog.eid.as/new-apis-for-the-eidas-ecosystem/ ) In the meantime, any digital signature done in EU must be done with a certificate issued only by the "select" CA t…
> Now 7 years later there still isn't a API specification for interoperability
The standard existed 2016, I did a short stint for a company that was implemented eIDAS back then.
They even have a test suite you can use to check how well you comply with the standard: https://ec.europa.eu/digital-building-blocks/wikis/display/D...
It is very archaic to work with though, but at least they try to have a standard.
Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security
#129Just adding a perspective (not necessarily mine, I'm still on the fence) supporting this legislation from a tech-literate person in the EU. The digital administration in my country has made my life so much easier. We all have mandatory ID cards since decades ago, but now they have a chip with some certs for auth, signing, etc. I can check my taxes, fill government forms, see any traffic tickets, sign official documen…
> Not saying this is right or wrong, but maybe this helps understand why many people in the EU may not be so against this type of legislation.
I'm with you. I think most of the fuzz is about forcefully involving government into the CA infrastructure and the fact that this affects rest of the world.
As to the latter, I've always found it weird that by default all root stores contain hundreds of CAs from over the world. By default, anyone is assumed to trust large companies (Google, Amazon) equally as nation states (Staat der Nerderlanden) shady entities (Hongkong Post office). So it's not surprising to have everyone up in arms if the EU adds yet another chair to this table.
Wouldn't it make much more sense if users took more control and responsibility of the certs in their root store? Wouldn't it make more sense to restrict CAs to certain domains? I would be okay with a EU sanctioned CA if it could only assert authenticity of EU services, but not shops or whitehouse.gov. I've always felt that it would make much more sense if CAs were much more restricted to specific "trust use cases".
Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security
#130Earlier quoted context omitted.
CA changes can happen due to many legitimate regions. Pinning certificates in this way doesn’t scale, as we saw with the deprecation of HPKP.
All you need is a list of trusted CA's, like we do right now, and then issue a warning if it isn't on that list. It is a very simple plugin to make.
These certificate authories will also issue legitimate certificates btw, the regulation explicitly encourages local states to use them for their services