Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Last Chance to fix eIDAS: Secret EU law threatens Internet security

last-chance-for-eidas.org

Post reply on HN
Print view View original

131–140 of 314 posts

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#131

Post by supriyo-biswas »

Jensson wrote: post #112
supriyo-biswas wrote: post #87

For anyone who’s about to say that surveillance isn’t the point of this legislation: it definitely is; we very recently saw Germany trying to MITM jabber.ru users[1], having a CA that can be asked to issue any certificate is definitely something that’d be used for surveillance purposes. [1] https://notes.valdikss.org.ru/jabber.ru-mitm/

eIDAS exists since there are many conflicting standards for electronic certificates. eIDAS is an effort to unify those standards. Maybe the clause where they say browsers has to add specific CA's is for spying, but eIDAS in general isn't to help spying its just there to help unify all the different electronic certificate services in EU. For example banking, signing official documents like grades from school etc, all…

> Browsers already had their own standard that they think is better than eIDAS

Unlike the Browser/CA forum rules which are security focused, EIDAS comes from a government mandate first and foremost, so the concern isn’t entirely subjective as you suggest.

> "and browsers should also do this" instead of there being some conspiracy behind it

The law isn’t RFC 2119 where there is a distinction between SHOULD and MUST: the law is all about what an entity MUST do, so bringing up “should” in this context isn’t helping the point you’re typing to make.

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#132

Post by Vinnl »

sofixa wrote: post #98
NoboruWataya wrote: post #80

Very concerning. As a slight aside though, it is not a "secret law". All EU laws are published on its website in every official language, and the vast majority of laws (including this one) must be publicly ratified by the directly elected European Parliament before coming effective. They should tone down this kind of sensationalist clickbait that I would expect to find in UK tabloids. They probably think it helps the…

Also, this: > and will be presented to the public and parliament for a rubber stamp before the end of the year That's not how the EU parliament works, they're not just a rubber stamp. The topic is sufficiently grave without the need for clickbait and painfully obvious exaggerations.

As I understand it, the EU Parliament engages through the trilogues. Once agreement has been reached there, final approval is indeed more of a rubberstamp. (But: I'm just somewhat interested in the subject; I'm not an expert on the process.)

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#133

Post by Jensson »

yaris wrote: post #113
Jensson wrote: post #49

Earlier quoted context omitted.

And then you can just tell the browser to not trust those CAs and you are safe. This is nothing like "chat control". This only lets the government spy on people who don't care if the government spies on them.

IIRC one cannot tell the browser to not trust root CAs, that's why all the fuss.

Why shouldn't you be able to do that? Seems like a simple thing to implement. I get why they want a hardcoded list, but I don't get why you can't add a way to block parts of that hardcoded list.

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#134

Post by agwa »

fuoqi wrote: post #122
supriyo-biswas wrote: post #87

For anyone who’s about to say that surveillance isn’t the point of this legislation: it definitely is; we very recently saw Germany trying to MITM jabber.ru users[1], having a CA that can be asked to issue any certificate is definitely something that’d be used for surveillance purposes. [1] https://notes.valdikss.org.ru/jabber.ru-mitm/

A proper solution for MitM is mandatory independent certificate transparency, not outright denial of national CAs support in browsers. A German National CA should not be able to issue certificates for .ru in the first place and having a clear record of misbehavior in CT is probably not something operators of such CA would like to have even when pressured by intelligence agencies. Browsers should get their shit togeth…

> Browsers should get their shit together and add proper support of domain-limited CAs

They do in fact support this - e.g. Mozilla trusts KamuSM only for .tr [1], Chrome limited ANSSI to French TLDs [2].

However, there is no indication that the EU would be willing to accept such constraints on their national CAs. If you look at several of the current national European CAs, they routinely issue for generic TLDs like .com.

[1] https://groups.google.com/a/mozilla.org/g/dev-security-polic...

[2] https://security.googleblog.com/2013/12/further-improving-di...

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#135

Post by kreetx »

agarsev wrote: post #109

Just adding a perspective (not necessarily mine, I'm still on the fence) supporting this legislation from a tech-literate person in the EU. The digital administration in my country has made my life so much easier. We all have mandatory ID cards since decades ago, but now they have a chip with some certs for auth, signing, etc. I can check my taxes, fill government forms, see any traffic tickets, sign official documen…

The things that get me thinking are:

- for a CA that is business (or a non-profit), trust is their product, and if Let's Encrypt fails at it's job then clients can go elsewhere

- not sure but in EU I would assume they are going to install all member states' CA certificates into all browsers, so then EU member state government A can MITM a connection for a citizen of member state B

- even if a website has a certificate from any current provider, any EU government can still MITM a user without the company knowing

Also, as it's technically possible to combat the legislation then how much would it actually help, wouldn't any "criminal" pay attention to it too, e.g by using an appropriate browser?

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#136

Post by supriyo-biswas »

fuoqi wrote: post #122
supriyo-biswas wrote: post #87

For anyone who’s about to say that surveillance isn’t the point of this legislation: it definitely is; we very recently saw Germany trying to MITM jabber.ru users[1], having a CA that can be asked to issue any certificate is definitely something that’d be used for surveillance purposes. [1] https://notes.valdikss.org.ru/jabber.ru-mitm/

A proper solution for MitM is mandatory independent certificate transparency, not outright denial of national CAs support in browsers. A German National CA should not be able to issue certificates for .ru in the first place and having a clear record of misbehavior in CT is probably not something operators of such CA would like to have even when pressured by intelligence agencies. Browsers should get their shit togeth…

Browsers do have this, although this measure is only selectively applied for certain CAs where misissuance has been an issue (There was a Indian CA for which this was used, need to look around MDSP for the link. I’ll post it shortly.)

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#137

Post by Jensson »

jruohonen wrote: post #46
g_p wrote: post #42

Earlier quoted context omitted.

I believe that the stated/claimed intent is to create cross-country, bloc-wide digital signature interoperability and acceptance standards. The theory being that you can "digitally sign" things with a national ID (e.g. a smart card), and have that recognised anywhere in the EU. That would, in theory, help to reduce and simplify bureaucracy, especially for people moving between countries in the EU (a process which can…

Indeed: the goals are justifiable and very much welcome, in my opinion. Yet, I do not understand what CAs and the global TLS/PKI ecosystem have to do with the goals.

> Yet, I do not understand what CAs and the global TLS/PKI ecosystem have to do with the goals.

Technically that is also digital signing. The regulators probably thought that all kinds of digital signing should be included in this bill and just slapped something down for browsers while they were at it.

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#138

Post by kreetx »

galangalalgol wrote: post #126
agarsev wrote: post #109

Just adding a perspective (not necessarily mine, I'm still on the fence) supporting this legislation from a tech-literate person in the EU. The digital administration in my country has made my life so much easier. We all have mandatory ID cards since decades ago, but now they have a chip with some certs for auth, signing, etc. I can check my taxes, fill government forms, see any traffic tickets, sign official documen…

This isn't adding a few CAs s your browser trusts the tax website. This appears to be replacing all of them so the eu can see the contents of all traffic that is proxied in and out of the country. None of that seems likely to work for actual bad people.

If the root CA is installed in my browser then the government can MITM any connection at will.

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#139

Post by g-b-r »

agarsev wrote: post #109

Just adding a perspective (not necessarily mine, I'm still on the fence) supporting this legislation from a tech-literate person in the EU. The digital administration in my country has made my life so much easier. We all have mandatory ID cards since decades ago, but now they have a chip with some certs for auth, signing, etc. I can check my taxes, fill government forms, see any traffic tickets, sign official documen…

No, there's no need for your browser to accept particular CAs

If some government sites want to use their CA that's one thing but what matters to identify you is the key stored in your ID card

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#140

Post by justinclift »

supriyo-biswas wrote: post #105
justinclift wrote: post #82

Earlier quoted context omitted.

New Firefox plugin: "Disable EU Certs"

EU court: serves Mozilla a court order to add the extension to the blocklist.xml file, a global blocklist of all extension IDs that users can’t install.

Sure, and thereby begins yet another game of whack-a-mole as people create ever more elaborate workarounds.
Post reply on HN