Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla publishes position paper on the EU Digital Identity Framework

blog.mozilla.org

Post reply on HN
Print view View original

31–40 of 161 posts

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#31

Post by deadbunny »

parasense wrote: post #28

I think the Browsers should swing the axe the other direction. Indicate the website is broken when EV certificates are present. Also, indicate all websites are broken if/or when the Root-CA-trust ever be forcefully extended to include EV CA authorities, in particular state backed authorities. I'm not sure about the EU, but forcing browsers green-light weak security is a violation of the USA's 1st amendment freedom of…

I'm not sure I follow. How are EV certificates weak? They use the same cyphers and just have extra validation on the owner/domain.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#32

Post by dahfizz »

bjelkeman-again wrote: post #19
dahfizz wrote: post #18

Earlier quoted context omitted.

I feel similarly about the EU forcing companies to use usb-C as a charging port. I love usb-C, and it is basically a requirement for any electronic I buy. But forcing everyone to use it until the end of time is ridiculous. Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.

EU mandated GSM, which was a success, but we aren’t stuck with it still.

We aren't stuck with _just_ gsm, but all phones still have to carry support for 2g.

The analogous scenario is a phone with 2 charging ports. The legacy usb-c alongside the newer port you would actually want/use.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#33

Post by phicoh »

Jwarder wrote: post #15
phicoh wrote: post #12

I wonder why QWACs are less secure than DV. There is an argument why EV should be treated the same a DV I'm not buying that argument but for the moment let's accept it as true. However, now Mozilla is arguing that EV is less secure than DV. That seems weird to me. Currently, browsers have root certificates for lots of countries. I can imagine that for a country it becomes a huge problem if suddenly a major browser de…

I see two issues at play. Not all European CAs meet browsers' root programs requirements. Forcing everyone to accept those certs weakens all root programs (Mozilla's, Microsoft's, etc). There is also the concern that special indicators displayed with a certificate can mislead users. A scummy company with an EV cert isn't any more trustworthy than if they had a DV cert, but browsers want to be careful not to imply a f…

I doubt there is any text that browsers have to enable those certs by default outside the EU.

It could weaken protection for people in the EU, but then the way forward is to make requirements for root certs mandatory in the EU.

Maybe I missed it, but did the document require special UI elements for EU certs?

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#34

Post by Tom4hawk »

toomuchtodo wrote: post #14
indymike wrote: post #11

Earlier quoted context omitted.

> A proper online identity framework is long due though. Due by whom, and for what?

For citizens who want efficient, effective access to services that require identity. The need for identity isn’t going away, and a poor implementation doesn’t guard against overreach.

In Poland you can do a lot of things digitally by authenticating on governments sites with your Bank (Imagine "Continue with your bank" instead of "Continue with Google" or "Continue with Facebook"). It's nice because bank already verified my identity when I was creating a bank account. I did not have to scan&send anything, go verify in some office etc. and I was able to do multiple things: change how my company is taxed, register for COVID vaccination, government census.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#35

Post by AlexandrB »

Tom4hawk wrote: post #34
toomuchtodo wrote: post #14

Earlier quoted context omitted.

For citizens who want efficient, effective access to services that require identity. The need for identity isn’t going away, and a poor implementation doesn’t guard against overreach.

In Poland you can do a lot of things digitally by authenticating on governments sites with your Bank (Imagine "Continue with your bank" instead of "Continue with Google" or "Continue with Facebook"). It's nice because bank already verified my identity when I was creating a bank account. I did not have to scan&send anything, go verify in some office etc. and I was able to do multiple things: change how my company is t…

Canada has this too for some government services like the tax system.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#36

Post by phicoh »

dahfizz wrote: post #18
xoa wrote: post #8

This did get posted a few weeks ago at the time it was written but didn't get much traction at that point, yet seems like a reasonably important issue. The EU has done worthy things for issues like privacy, but whatever pluses and minuses of regulating personal and business policy I'm a lot more dubious about government sticking its hand directly into how specific software (like browsers) functions. That seems like a…

I feel similarly about the EU forcing companies to use usb-C as a charging port. I love usb-C, and it is basically a requirement for any electronic I buy. But forcing everyone to use it until the end of time is ridiculous. Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.

I don't understand the 'never gotten usb-C' part. Modern phones have more than enough space for two connectors. So usb-C next to a micro-B charging port is no problem.

After a while, almost all phone also have usb-C, most people like usb-C, so the industry can petition to replace micro-B with usb-C.

Are there any examples where the EU mandates legacy stuff that is no longer useful, but still has to be kept anyway?

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#37

Post by muricula »

Shadonototra wrote: post #23

Why is it ok for an american company to collude with foreign politics? Can't they focus on their broken system first?

This sort of thing is actually somewhere I think Mozilla can make a difference. As a major browser, they are listened to when they lobby standards bodies and political bodies about the web and internet security, and very often they are listened to.

I agree Firefox could be better, but time spent on effective lobbying which will help all browsers is well spent.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#38

Post by phicoh »

phicoh wrote: post #12

I wonder why QWACs are less secure than DV. There is an argument why EV should be treated the same a DV I'm not buying that argument but for the moment let's accept it as true. However, now Mozilla is arguing that EV is less secure than DV. That seems weird to me. Currently, browsers have root certificates for lots of countries. I can imagine that for a country it becomes a huge problem if suddenly a major browser de…

Most browser vendors do business in the EU. And governments in general have a right to set standards for products and services.

In some sense, Firefox could be an exception, because Mozilla doesn't seem to do a lot of advertising in the EU.

It is not like Apple, Google, or Microsoft can say: we don't really care about the EU, we just remove the browser from products we distribute (directly or through third parties) in the EU.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#39

Post by plandis »

Shadonototra wrote: post #25
furi wrote: post #9

Earlier quoted context omitted.

Perhaps I'm out of the loop, but the EU attempting to make it illegal to distribute web browsers that don't include certain features is unexpected (and deeply worrying) to me.

They are protecting their interest Why should a foreign country have control over my interests? Why should Mozilla DECIDE what I should and shouldn't trust? I am very glad that the public opinion decided to not trust Firefox at all (3% market share today)

Mozilla doesn’t decide that. Mozilla is an option _you_ can chose to use. It’s one of N options.

Re: Mozilla publishes position paper on the EU Digital Identity Framework

#40

Post by jollybean »

dahfizz wrote: post #18
xoa wrote: post #8

This did get posted a few weeks ago at the time it was written but didn't get much traction at that point, yet seems like a reasonably important issue. The EU has done worthy things for issues like privacy, but whatever pluses and minuses of regulating personal and business policy I'm a lot more dubious about government sticking its hand directly into how specific software (like browsers) functions. That seems like a…

I feel similarly about the EU forcing companies to use usb-C as a charging port. I love usb-C, and it is basically a requirement for any electronic I buy. But forcing everyone to use it until the end of time is ridiculous. Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.

USB-C is at least to some extent about standardization.

It's a less complicated issue, while nuanced, I think most of the details are manageable by a willing political actor.

It's also a known quantity.

This MOZ paper deals with much more complicated things.

I'm wary of involvement, I wonder if there are industry-led solutions that could be supported.

If MSFT, G, FB, AMZN could agree on something with the blessing of the EU and indirectly the US, I wonder if would happen very quickly.

Post reply on HN